redline | 54fa997a05b646ef3b2ec4840ccca6b5229d3d5ff28aa53f12e268fcb39473a9

Analysis

max time kernel
125s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2023 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54fa997a05b646ef3b2ec4840ccca6b5229d3d5ff28aa53f12e268fcb39473a9.exe
Size

773KB
MD5

3e85b4c8f3101f102f0ae784bbaaa408
SHA1

16af26893ce2e7277c906292f41538e8e0dac658
SHA256

54fa997a05b646ef3b2ec4840ccca6b5229d3d5ff28aa53f12e268fcb39473a9
SHA512

25490ae1eea1c5f5910a2e6c7aed6d2f572df0ef3296b40fc382cd6035ea766408ccd6e9a35df78d89ff79ea8af17d9f8431022c212722f2dffb8b7725058f08
SSDEEP

24576:cyFNy+ZHmy05Zl3tiqprzrc/8qXi2GMD08:L7jHX0xkkY1D0

Score

10^/10

redline maxi sheron discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

83.97.73.129:19068

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Extracted

Family

redline

Botnet

sheron

83.97.73.129:19068

Attributes

auth_value
2d067e7e2372227d3a03b335260112e9

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a6305638.exeAppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a6305638.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6305638.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6305638.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6305638.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6305638.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6305638.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d3040022.exelamod.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	d3040022.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	lamod.exe

Executes dropped EXE 11 IoCs

Processes:

v9212933.exev3925323.exev9484503.exea6305638.exeb6975518.exec4349044.exed3040022.exelamod.exee7870455.exelamod.exelamod.exe

pid	process
1728	v9212933.exe
1144	v3925323.exe
3152	v9484503.exe
3944	a6305638.exe
4052	b6975518.exe
552	c4349044.exe
3440	d3040022.exe
1912	lamod.exe
2320	e7870455.exe
5052	lamod.exe
1000	lamod.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1736 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a6305638.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a6305638.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1736	rundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6305638.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v3925323.exev9484503.exe54fa997a05b646ef3b2ec4840ccca6b5229d3d5ff28aa53f12e268fcb39473a9.exev9212933.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v3925323.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v9484503.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v9484503.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	54fa997a05b646ef3b2ec4840ccca6b5229d3d5ff28aa53f12e268fcb39473a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	54fa997a05b646ef3b2ec4840ccca6b5229d3d5ff28aa53f12e268fcb39473a9.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v9212933.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9212933.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v3925323.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

Processes:

b6975518.exee7870455.exe

description	pid	process	target process
PID 4052 set thread context of 1276	4052	b6975518.exe	AppLaunch.exe
PID 2320 set thread context of 4332	2320	e7870455.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4664 4052 WerFault.exe b6975518.exe
2316 2320 WerFault.exe e7870455.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

5068 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

a6305638.exeAppLaunch.exec4349044.exeAppLaunch.exe

pid process

3944 a6305638.exe
3944 a6305638.exe
1276 AppLaunch.exe
1276 AppLaunch.exe
552 c4349044.exe
552 c4349044.exe
4332 AppLaunch.exe
4332 AppLaunch.exe

pid	pid_target	process	target process
4664	4052	WerFault.exe	b6975518.exe
2316	2320	WerFault.exe	e7870455.exe

pid	process
5068	schtasks.exe

pid	process
3944	a6305638.exe
3944	a6305638.exe
1276	AppLaunch.exe
1276	AppLaunch.exe
552	c4349044.exe
552	c4349044.exe
4332	AppLaunch.exe
4332	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

a6305638.exeAppLaunch.exec4349044.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	3944	a6305638.exe
Token: SeDebugPrivilege	1276	AppLaunch.exe
Token: SeDebugPrivilege	552	c4349044.exe
Token: SeDebugPrivilege	4332	AppLaunch.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

d3040022.exe

pid process

3440 d3040022.exe

pid	process
3440	d3040022.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

54fa997a05b646ef3b2ec4840ccca6b5229d3d5ff28aa53f12e268fcb39473a9.exev9212933.exev3925323.exev9484503.exeb6975518.exed3040022.exelamod.execmd.exee7870455.exe

description	pid	process	target process
PID 5032 wrote to memory of 1728	5032	54fa997a05b646ef3b2ec4840ccca6b5229d3d5ff28aa53f12e268fcb39473a9.exe	v9212933.exe
PID 5032 wrote to memory of 1728	5032	54fa997a05b646ef3b2ec4840ccca6b5229d3d5ff28aa53f12e268fcb39473a9.exe	v9212933.exe
PID 5032 wrote to memory of 1728	5032	54fa997a05b646ef3b2ec4840ccca6b5229d3d5ff28aa53f12e268fcb39473a9.exe	v9212933.exe
PID 1728 wrote to memory of 1144	1728	v9212933.exe	v3925323.exe
PID 1728 wrote to memory of 1144	1728	v9212933.exe	v3925323.exe
PID 1728 wrote to memory of 1144	1728	v9212933.exe	v3925323.exe
PID 1144 wrote to memory of 3152	1144	v3925323.exe	v9484503.exe
PID 1144 wrote to memory of 3152	1144	v3925323.exe	v9484503.exe
PID 1144 wrote to memory of 3152	1144	v3925323.exe	v9484503.exe
PID 3152 wrote to memory of 3944	3152	v9484503.exe	a6305638.exe
PID 3152 wrote to memory of 3944	3152	v9484503.exe	a6305638.exe
PID 3152 wrote to memory of 4052	3152	v9484503.exe	b6975518.exe
PID 3152 wrote to memory of 4052	3152	v9484503.exe	b6975518.exe
PID 3152 wrote to memory of 4052	3152	v9484503.exe	b6975518.exe
PID 4052 wrote to memory of 1276	4052	b6975518.exe	AppLaunch.exe
PID 4052 wrote to memory of 1276	4052	b6975518.exe	AppLaunch.exe
PID 4052 wrote to memory of 1276	4052	b6975518.exe	AppLaunch.exe
PID 4052 wrote to memory of 1276	4052	b6975518.exe	AppLaunch.exe
PID 4052 wrote to memory of 1276	4052	b6975518.exe	AppLaunch.exe
PID 1144 wrote to memory of 552	1144	v3925323.exe	c4349044.exe
PID 1144 wrote to memory of 552	1144	v3925323.exe	c4349044.exe
PID 1144 wrote to memory of 552	1144	v3925323.exe	c4349044.exe
PID 1728 wrote to memory of 3440	1728	v9212933.exe	d3040022.exe
PID 1728 wrote to memory of 3440	1728	v9212933.exe	d3040022.exe
PID 1728 wrote to memory of 3440	1728	v9212933.exe	d3040022.exe
PID 3440 wrote to memory of 1912	3440	d3040022.exe	lamod.exe
PID 3440 wrote to memory of 1912	3440	d3040022.exe	lamod.exe
PID 3440 wrote to memory of 1912	3440	d3040022.exe	lamod.exe
PID 5032 wrote to memory of 2320	5032	54fa997a05b646ef3b2ec4840ccca6b5229d3d5ff28aa53f12e268fcb39473a9.exe	e7870455.exe
PID 5032 wrote to memory of 2320	5032	54fa997a05b646ef3b2ec4840ccca6b5229d3d5ff28aa53f12e268fcb39473a9.exe	e7870455.exe
PID 5032 wrote to memory of 2320	5032	54fa997a05b646ef3b2ec4840ccca6b5229d3d5ff28aa53f12e268fcb39473a9.exe	e7870455.exe
PID 1912 wrote to memory of 5068	1912	lamod.exe	schtasks.exe
PID 1912 wrote to memory of 5068	1912	lamod.exe	schtasks.exe
PID 1912 wrote to memory of 5068	1912	lamod.exe	schtasks.exe
PID 1912 wrote to memory of 3904	1912	lamod.exe	cmd.exe
PID 1912 wrote to memory of 3904	1912	lamod.exe	cmd.exe
PID 1912 wrote to memory of 3904	1912	lamod.exe	cmd.exe
PID 3904 wrote to memory of 3544	3904	cmd.exe	cmd.exe
PID 3904 wrote to memory of 3544	3904	cmd.exe	cmd.exe
PID 3904 wrote to memory of 3544	3904	cmd.exe	cmd.exe
PID 3904 wrote to memory of 4660	3904	cmd.exe	cacls.exe
PID 3904 wrote to memory of 4660	3904	cmd.exe	cacls.exe
PID 3904 wrote to memory of 4660	3904	cmd.exe	cacls.exe
PID 2320 wrote to memory of 4332	2320	e7870455.exe	AppLaunch.exe
PID 2320 wrote to memory of 4332	2320	e7870455.exe	AppLaunch.exe
PID 2320 wrote to memory of 4332	2320	e7870455.exe	AppLaunch.exe
PID 2320 wrote to memory of 4332	2320	e7870455.exe	AppLaunch.exe
PID 3904 wrote to memory of 4708	3904	cmd.exe	cacls.exe
PID 3904 wrote to memory of 4708	3904	cmd.exe	cacls.exe
PID 3904 wrote to memory of 4708	3904	cmd.exe	cacls.exe
PID 2320 wrote to memory of 4332	2320	e7870455.exe	AppLaunch.exe
PID 3904 wrote to memory of 3292	3904	cmd.exe	cmd.exe
PID 3904 wrote to memory of 3292	3904	cmd.exe	cmd.exe
PID 3904 wrote to memory of 3292	3904	cmd.exe	cmd.exe
PID 3904 wrote to memory of 5004	3904	cmd.exe	cacls.exe
PID 3904 wrote to memory of 5004	3904	cmd.exe	cacls.exe
PID 3904 wrote to memory of 5004	3904	cmd.exe	cacls.exe
PID 3904 wrote to memory of 3368	3904	cmd.exe	cacls.exe
PID 3904 wrote to memory of 3368	3904	cmd.exe	cacls.exe
PID 3904 wrote to memory of 3368	3904	cmd.exe	cacls.exe
PID 1912 wrote to memory of 1736	1912	lamod.exe	rundll32.exe
PID 1912 wrote to memory of 1736	1912	lamod.exe	rundll32.exe
PID 1912 wrote to memory of 1736	1912	lamod.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\54fa997a05b646ef3b2ec4840ccca6b5229d3d5ff28aa53f12e268fcb39473a9.exe
"C:\Users\Admin\AppData\Local\Temp\54fa997a05b646ef3b2ec4840ccca6b5229d3d5ff28aa53f12e268fcb39473a9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9212933.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9212933.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3925323.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3925323.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9484503.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9484503.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6305638.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6305638.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6975518.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6975518.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4052
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1276
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 564
        6⤵
        Program crash
        
        PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4349044.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4349044.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:552
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3040022.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3040022.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
      "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1912
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:5068
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "Admin:N"&&CACLS "lamod.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3904
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3544
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "lamod.exe" /P "Admin:N"
        6⤵
        
        PID:4660
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "lamod.exe" /P "Admin:R" /E
        6⤵
        
        PID:4708
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3292
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\a9e2a16078" /P "Admin:N"
        6⤵
        
        PID:5004
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\a9e2a16078" /P "Admin:R" /E
        6⤵
        
        PID:3368
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:1736
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e7870455.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e7870455.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 608
    3⤵
    - Program crash
    PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4052 -ip 4052
1⤵
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2320 -ip 2320
1⤵
PID:4444

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
1⤵
- Executes dropped EXE
PID:5052

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
1⤵
- Executes dropped EXE
PID:1000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e7870455.exe

Filesize
309KB

MD5
4595aec45ce04129d4b2ce65bc566b35

SHA1
e535e0cf089554fa3e368887e4535a333b303bec

SHA256
9438b3b808e3907fec88c342e17127dc62f2ee6ccd9e095c36227f93119c75bd

SHA512
91913b1f34e55b4e521c8bb754317ffb6aa4ec1b84c23522388ad6744a7ca400e40b55794fa94758bd1d7ace5f100b901e20bf56738bf7d6b45f4aecf4ff35d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e7870455.exe

Filesize
309KB

MD5
4595aec45ce04129d4b2ce65bc566b35

SHA1
e535e0cf089554fa3e368887e4535a333b303bec

SHA256
9438b3b808e3907fec88c342e17127dc62f2ee6ccd9e095c36227f93119c75bd

SHA512
91913b1f34e55b4e521c8bb754317ffb6aa4ec1b84c23522388ad6744a7ca400e40b55794fa94758bd1d7ace5f100b901e20bf56738bf7d6b45f4aecf4ff35d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9212933.exe

Filesize
549KB

MD5
a5a32b6db7922d9edec336e595ad9ed6

SHA1
3605eef617a03b7188dd5afae5cffa5e4530caf4

SHA256
ea35e73e5e2cdd7ed6b72a4a844d4fc01c8b2daf617cb090873068367d35e4bd

SHA512
7ceaae283b2b61dc2b3d8f3ef3a37bc6abf2a4b06d95e6422d6e1b07a4b49c28503fd27ce3f1d2dbc04d34c4ca730f029b3f84d629742e6279cff5cc34a24243

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9212933.exe

Filesize
549KB

MD5
a5a32b6db7922d9edec336e595ad9ed6

SHA1
3605eef617a03b7188dd5afae5cffa5e4530caf4

SHA256
ea35e73e5e2cdd7ed6b72a4a844d4fc01c8b2daf617cb090873068367d35e4bd

SHA512
7ceaae283b2b61dc2b3d8f3ef3a37bc6abf2a4b06d95e6422d6e1b07a4b49c28503fd27ce3f1d2dbc04d34c4ca730f029b3f84d629742e6279cff5cc34a24243

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3040022.exe

Filesize
208KB

MD5
bdf4e8dba43a58149334cb3046ed56e0

SHA1
091094f10e7dcf89639bbd637b8f4d22b4fe7f18

SHA256
4f6cf5322b678e4751e6f2393c765880fe702e20f76b39c55734b423f506989c

SHA512
8a3c17d4795c6b3658570bad8ae23704a77bb2ddd2c797497b9a9e87ed0dcebe93db1d61a4c813503cae75a47f167bd9f4a731f8027780a329a42d94ecf89fe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3040022.exe

Filesize
208KB

MD5
bdf4e8dba43a58149334cb3046ed56e0

SHA1
091094f10e7dcf89639bbd637b8f4d22b4fe7f18

SHA256
4f6cf5322b678e4751e6f2393c765880fe702e20f76b39c55734b423f506989c

SHA512
8a3c17d4795c6b3658570bad8ae23704a77bb2ddd2c797497b9a9e87ed0dcebe93db1d61a4c813503cae75a47f167bd9f4a731f8027780a329a42d94ecf89fe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3925323.exe

Filesize
377KB

MD5
371dee7aee74e8fb51928073fe7a4d42

SHA1
d80981cdc9881c8cb39db959616538ccd1abac06

SHA256
577fff42f2ef311fe28b34cd47780d3bfd3a764ca0e1c1772fbeeb94945c4354

SHA512
64bc69d90c7c133a9b693359438e805bae3da8cb21816b1f3898aa986a328d1fe796620da8787dd1a4d20f1eb394d12c0254e224e982d0692eb4779ac9d44b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3925323.exe

Filesize
377KB

MD5
371dee7aee74e8fb51928073fe7a4d42

SHA1
d80981cdc9881c8cb39db959616538ccd1abac06

SHA256
577fff42f2ef311fe28b34cd47780d3bfd3a764ca0e1c1772fbeeb94945c4354

SHA512
64bc69d90c7c133a9b693359438e805bae3da8cb21816b1f3898aa986a328d1fe796620da8787dd1a4d20f1eb394d12c0254e224e982d0692eb4779ac9d44b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4349044.exe

Filesize
172KB

MD5
0f15c56c48cd30b0882dbac61d92b2c5

SHA1
670d4d7c3935eb89d15d9ae5ef072d5e41f93782

SHA256
ff21dd84762138478ea66921662990aeededa5685c86c23508779838e858227a

SHA512
532eabed2eaaf7a52d68ad8ae08b050e43d084940a75f5a3d6b7ca3dfd7980a9b95ed8fd0988cc2eead2837b8d510247203a2db6e2c9874f12d1a73aaa0c46e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4349044.exe

Filesize
172KB

MD5
0f15c56c48cd30b0882dbac61d92b2c5

SHA1
670d4d7c3935eb89d15d9ae5ef072d5e41f93782

SHA256
ff21dd84762138478ea66921662990aeededa5685c86c23508779838e858227a

SHA512
532eabed2eaaf7a52d68ad8ae08b050e43d084940a75f5a3d6b7ca3dfd7980a9b95ed8fd0988cc2eead2837b8d510247203a2db6e2c9874f12d1a73aaa0c46e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9484503.exe

Filesize
221KB

MD5
750a1bfb02ec254426a8ab8ff7cae14f

SHA1
96f2687aef218e1b7834b11dd7bf9a0f8774f206

SHA256
c0b089f804033dfdae34941ca9021ad9a75619d2cde8092005ee0742c40bf598

SHA512
515cd803ce8af2fc5a8066fd42de00320de033cda5fe8fbe74a86e1d44dca9506993e49b69cb8adde45909443c3bd828235b5cef7f42a03c3f5288a775274d2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9484503.exe

Filesize
221KB

MD5
750a1bfb02ec254426a8ab8ff7cae14f

SHA1
96f2687aef218e1b7834b11dd7bf9a0f8774f206

SHA256
c0b089f804033dfdae34941ca9021ad9a75619d2cde8092005ee0742c40bf598

SHA512
515cd803ce8af2fc5a8066fd42de00320de033cda5fe8fbe74a86e1d44dca9506993e49b69cb8adde45909443c3bd828235b5cef7f42a03c3f5288a775274d2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6305638.exe

Filesize
14KB

MD5
22a692d6d0717b5ad374f2375648cce4

SHA1
2109f32b243d0f7dc4f9ad12b7f8a571f162f833

SHA256
d9a9bb44842812e2c9f0b36c00d59e439fe8ccfd6583d6a80c0c5a3266b7422a

SHA512
0d460626f096167543535744299e1a773b3fca848ac0872e7f31b1952856e3712a1309accb91d1b650fcbb11ca008cc7f34e837d6262537c8154273cca201700

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6305638.exe

Filesize
14KB

MD5
22a692d6d0717b5ad374f2375648cce4

SHA1
2109f32b243d0f7dc4f9ad12b7f8a571f162f833

SHA256
d9a9bb44842812e2c9f0b36c00d59e439fe8ccfd6583d6a80c0c5a3266b7422a

SHA512
0d460626f096167543535744299e1a773b3fca848ac0872e7f31b1952856e3712a1309accb91d1b650fcbb11ca008cc7f34e837d6262537c8154273cca201700

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6975518.exe

Filesize
148KB

MD5
fd25ca4f553385f85025479158388e60

SHA1
59a1d1da44bd4560e521e4cb550c26d7986d0da6

SHA256
cbd6b0e040cd9a0c8bd947f290b22477a1917053fc175c1e147b51bb8c0230de

SHA512
0a6ce2086cf0d6108e5b35edd322a7e27767bb1666b8b34a8bc3ad8f323ae71c56b7c37828a3093486708945d698a91cc4513057c407abf5c9641c5024ee4e26

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6975518.exe

Filesize
148KB

MD5
fd25ca4f553385f85025479158388e60

SHA1
59a1d1da44bd4560e521e4cb550c26d7986d0da6

SHA256
cbd6b0e040cd9a0c8bd947f290b22477a1917053fc175c1e147b51bb8c0230de

SHA512
0a6ce2086cf0d6108e5b35edd322a7e27767bb1666b8b34a8bc3ad8f323ae71c56b7c37828a3093486708945d698a91cc4513057c407abf5c9641c5024ee4e26

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
bdf4e8dba43a58149334cb3046ed56e0

SHA1
091094f10e7dcf89639bbd637b8f4d22b4fe7f18

SHA256
4f6cf5322b678e4751e6f2393c765880fe702e20f76b39c55734b423f506989c

SHA512
8a3c17d4795c6b3658570bad8ae23704a77bb2ddd2c797497b9a9e87ed0dcebe93db1d61a4c813503cae75a47f167bd9f4a731f8027780a329a42d94ecf89fe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
bdf4e8dba43a58149334cb3046ed56e0

SHA1
091094f10e7dcf89639bbd637b8f4d22b4fe7f18

SHA256
4f6cf5322b678e4751e6f2393c765880fe702e20f76b39c55734b423f506989c

SHA512
8a3c17d4795c6b3658570bad8ae23704a77bb2ddd2c797497b9a9e87ed0dcebe93db1d61a4c813503cae75a47f167bd9f4a731f8027780a329a42d94ecf89fe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
bdf4e8dba43a58149334cb3046ed56e0

SHA1
091094f10e7dcf89639bbd637b8f4d22b4fe7f18

SHA256
4f6cf5322b678e4751e6f2393c765880fe702e20f76b39c55734b423f506989c

SHA512
8a3c17d4795c6b3658570bad8ae23704a77bb2ddd2c797497b9a9e87ed0dcebe93db1d61a4c813503cae75a47f167bd9f4a731f8027780a329a42d94ecf89fe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
bdf4e8dba43a58149334cb3046ed56e0

SHA1
091094f10e7dcf89639bbd637b8f4d22b4fe7f18

SHA256
4f6cf5322b678e4751e6f2393c765880fe702e20f76b39c55734b423f506989c

SHA512
8a3c17d4795c6b3658570bad8ae23704a77bb2ddd2c797497b9a9e87ed0dcebe93db1d61a4c813503cae75a47f167bd9f4a731f8027780a329a42d94ecf89fe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
bdf4e8dba43a58149334cb3046ed56e0

SHA1
091094f10e7dcf89639bbd637b8f4d22b4fe7f18

SHA256
4f6cf5322b678e4751e6f2393c765880fe702e20f76b39c55734b423f506989c

SHA512
8a3c17d4795c6b3658570bad8ae23704a77bb2ddd2c797497b9a9e87ed0dcebe93db1d61a4c813503cae75a47f167bd9f4a731f8027780a329a42d94ecf89fe6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/552-182-0x0000000006380000-0x0000000006924000-memory.dmp

Filesize
5.6MB

Download
memory/552-176-0x0000000004DC0000-0x0000000004ECA000-memory.dmp

Filesize
1.0MB

Download
memory/552-187-0x0000000008550000-0x0000000008A7C000-memory.dmp

Filesize
5.2MB

Download
memory/552-186-0x0000000006140000-0x0000000006302000-memory.dmp

Filesize
1.8MB

Download
memory/552-184-0x0000000005F20000-0x0000000005F70000-memory.dmp

Filesize
320KB

Download
memory/552-183-0x0000000005980000-0x00000000059E6000-memory.dmp

Filesize
408KB

Download
memory/552-181-0x00000000058E0000-0x0000000005972000-memory.dmp

Filesize
584KB

Download
memory/552-180-0x0000000005170000-0x00000000051E6000-memory.dmp

Filesize
472KB

Download
memory/552-179-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/552-174-0x00000000003A0000-0x00000000003D0000-memory.dmp

Filesize
192KB

Download
memory/552-178-0x0000000004D60000-0x0000000004D9C000-memory.dmp

Filesize
240KB

Download
memory/552-175-0x00000000052C0000-0x00000000058D8000-memory.dmp

Filesize
6.1MB

Download
memory/552-177-0x0000000004D00000-0x0000000004D12000-memory.dmp

Filesize
72KB

Download
memory/552-188-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/1276-166-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3944-161-0x00000000004F0000-0x00000000004FA000-memory.dmp

Filesize
40KB

Download
memory/4332-212-0x0000000005210000-0x0000000005220000-memory.dmp

Filesize
64KB

Download
memory/4332-206-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download