redline | 757e8f8597d5ccee67ad3f1e48a2adf371f26ae1720013052ece0ea1adea4dd8

Analysis

max time kernel
121s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2023 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

757e8f8597d5ccee67ad3f1e48a2adf371f26ae1720013052ece0ea1adea4dd8.exe
Size

764KB
MD5

c5f101f93e02c2b978685b69061470a6
SHA1

5ec41ad3f2943b605f9c216063ffc8fd1b11f5c6
SHA256

757e8f8597d5ccee67ad3f1e48a2adf371f26ae1720013052ece0ea1adea4dd8
SHA512

3eb0794595c8810a5f8a4eabd8515227b59ce7a9b5c707d513549af4625152fd22d29e157900e15d9821ecfbf85d87637ab0499174766884a3a2633f81a1105b
SSDEEP

12288:oMrIy906V3eCV48VcG2wy/9bagQMlvpEaBeIK6OIxzyh+iPxG5lFh:gy3NcIO9baevp9en6Omzyh+i5ilFh

Score

10^/10

redline maxi sheron discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

83.97.73.129:19068

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Extracted

Family

redline

Botnet

sheron

83.97.73.129:19068

Attributes

auth_value
2d067e7e2372227d3a03b335260112e9

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

AppLaunch.exea1683960.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1683960.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1683960.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1683960.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1683960.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a1683960.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1683960.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d2614411.exelamod.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	d2614411.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	lamod.exe

Executes dropped EXE 11 IoCs

Processes:

v4310159.exev4151875.exev5008466.exea1683960.exeb0880877.exec8256908.exed2614411.exelamod.exee2519644.exelamod.exelamod.exe

pid	process
1808	v4310159.exe
5020	v4151875.exe
4824	v5008466.exe
1820	a1683960.exe
112	b0880877.exe
4552	c8256908.exe
1396	d2614411.exe
4800	lamod.exe
2764	e2519644.exe
1060	lamod.exe
2040	lamod.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4344 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a1683960.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a1683960.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4344	rundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1683960.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v4310159.exev4151875.exev5008466.exe757e8f8597d5ccee67ad3f1e48a2adf371f26ae1720013052ece0ea1adea4dd8.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v4310159.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4310159.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v4151875.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v4151875.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v5008466.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v5008466.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	757e8f8597d5ccee67ad3f1e48a2adf371f26ae1720013052ece0ea1adea4dd8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	757e8f8597d5ccee67ad3f1e48a2adf371f26ae1720013052ece0ea1adea4dd8.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

Processes:

b0880877.exee2519644.exe

description	pid	process	target process
PID 112 set thread context of 636	112	b0880877.exe	AppLaunch.exe
PID 2764 set thread context of 4324	2764	e2519644.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2188 112 WerFault.exe b0880877.exe
3248 2764 WerFault.exe e2519644.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4380 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

a1683960.exeAppLaunch.exec8256908.exeAppLaunch.exe

pid process

1820 a1683960.exe
1820 a1683960.exe
636 AppLaunch.exe
636 AppLaunch.exe
4552 c8256908.exe
4552 c8256908.exe
4324 AppLaunch.exe
4324 AppLaunch.exe

pid	pid_target	process	target process
2188	112	WerFault.exe	b0880877.exe
3248	2764	WerFault.exe	e2519644.exe

pid	process
4380	schtasks.exe

pid	process
1820	a1683960.exe
1820	a1683960.exe
636	AppLaunch.exe
636	AppLaunch.exe
4552	c8256908.exe
4552	c8256908.exe
4324	AppLaunch.exe
4324	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

a1683960.exeAppLaunch.exec8256908.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1820	a1683960.exe
Token: SeDebugPrivilege	636	AppLaunch.exe
Token: SeDebugPrivilege	4552	c8256908.exe
Token: SeDebugPrivilege	4324	AppLaunch.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

d2614411.exe

pid process

1396 d2614411.exe

pid	process
1396	d2614411.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

757e8f8597d5ccee67ad3f1e48a2adf371f26ae1720013052ece0ea1adea4dd8.exev4310159.exev4151875.exev5008466.exeb0880877.exed2614411.exelamod.exee2519644.execmd.exe

description	pid	process	target process
PID 2796 wrote to memory of 1808	2796	757e8f8597d5ccee67ad3f1e48a2adf371f26ae1720013052ece0ea1adea4dd8.exe	v4310159.exe
PID 2796 wrote to memory of 1808	2796	757e8f8597d5ccee67ad3f1e48a2adf371f26ae1720013052ece0ea1adea4dd8.exe	v4310159.exe
PID 2796 wrote to memory of 1808	2796	757e8f8597d5ccee67ad3f1e48a2adf371f26ae1720013052ece0ea1adea4dd8.exe	v4310159.exe
PID 1808 wrote to memory of 5020	1808	v4310159.exe	v4151875.exe
PID 1808 wrote to memory of 5020	1808	v4310159.exe	v4151875.exe
PID 1808 wrote to memory of 5020	1808	v4310159.exe	v4151875.exe
PID 5020 wrote to memory of 4824	5020	v4151875.exe	v5008466.exe
PID 5020 wrote to memory of 4824	5020	v4151875.exe	v5008466.exe
PID 5020 wrote to memory of 4824	5020	v4151875.exe	v5008466.exe
PID 4824 wrote to memory of 1820	4824	v5008466.exe	a1683960.exe
PID 4824 wrote to memory of 1820	4824	v5008466.exe	a1683960.exe
PID 4824 wrote to memory of 112	4824	v5008466.exe	b0880877.exe
PID 4824 wrote to memory of 112	4824	v5008466.exe	b0880877.exe
PID 4824 wrote to memory of 112	4824	v5008466.exe	b0880877.exe
PID 112 wrote to memory of 636	112	b0880877.exe	AppLaunch.exe
PID 112 wrote to memory of 636	112	b0880877.exe	AppLaunch.exe
PID 112 wrote to memory of 636	112	b0880877.exe	AppLaunch.exe
PID 112 wrote to memory of 636	112	b0880877.exe	AppLaunch.exe
PID 112 wrote to memory of 636	112	b0880877.exe	AppLaunch.exe
PID 5020 wrote to memory of 4552	5020	v4151875.exe	c8256908.exe
PID 5020 wrote to memory of 4552	5020	v4151875.exe	c8256908.exe
PID 5020 wrote to memory of 4552	5020	v4151875.exe	c8256908.exe
PID 1808 wrote to memory of 1396	1808	v4310159.exe	d2614411.exe
PID 1808 wrote to memory of 1396	1808	v4310159.exe	d2614411.exe
PID 1808 wrote to memory of 1396	1808	v4310159.exe	d2614411.exe
PID 1396 wrote to memory of 4800	1396	d2614411.exe	lamod.exe
PID 1396 wrote to memory of 4800	1396	d2614411.exe	lamod.exe
PID 1396 wrote to memory of 4800	1396	d2614411.exe	lamod.exe
PID 2796 wrote to memory of 2764	2796	757e8f8597d5ccee67ad3f1e48a2adf371f26ae1720013052ece0ea1adea4dd8.exe	e2519644.exe
PID 2796 wrote to memory of 2764	2796	757e8f8597d5ccee67ad3f1e48a2adf371f26ae1720013052ece0ea1adea4dd8.exe	e2519644.exe
PID 2796 wrote to memory of 2764	2796	757e8f8597d5ccee67ad3f1e48a2adf371f26ae1720013052ece0ea1adea4dd8.exe	e2519644.exe
PID 4800 wrote to memory of 4380	4800	lamod.exe	schtasks.exe
PID 4800 wrote to memory of 4380	4800	lamod.exe	schtasks.exe
PID 4800 wrote to memory of 4380	4800	lamod.exe	schtasks.exe
PID 4800 wrote to memory of 2552	4800	lamod.exe	cmd.exe
PID 4800 wrote to memory of 2552	4800	lamod.exe	cmd.exe
PID 4800 wrote to memory of 2552	4800	lamod.exe	cmd.exe
PID 2764 wrote to memory of 4324	2764	e2519644.exe	AppLaunch.exe
PID 2764 wrote to memory of 4324	2764	e2519644.exe	AppLaunch.exe
PID 2764 wrote to memory of 4324	2764	e2519644.exe	AppLaunch.exe
PID 2764 wrote to memory of 4324	2764	e2519644.exe	AppLaunch.exe
PID 2552 wrote to memory of 5024	2552	cmd.exe	cmd.exe
PID 2552 wrote to memory of 5024	2552	cmd.exe	cmd.exe
PID 2552 wrote to memory of 5024	2552	cmd.exe	cmd.exe
PID 2552 wrote to memory of 4796	2552	cmd.exe	cacls.exe
PID 2552 wrote to memory of 4796	2552	cmd.exe	cacls.exe
PID 2552 wrote to memory of 4796	2552	cmd.exe	cacls.exe
PID 2552 wrote to memory of 1148	2552	cmd.exe	cacls.exe
PID 2552 wrote to memory of 1148	2552	cmd.exe	cacls.exe
PID 2552 wrote to memory of 1148	2552	cmd.exe	cacls.exe
PID 2764 wrote to memory of 4324	2764	e2519644.exe	AppLaunch.exe
PID 2552 wrote to memory of 1892	2552	cmd.exe	cmd.exe
PID 2552 wrote to memory of 1892	2552	cmd.exe	cmd.exe
PID 2552 wrote to memory of 1892	2552	cmd.exe	cmd.exe
PID 2552 wrote to memory of 2028	2552	cmd.exe	cacls.exe
PID 2552 wrote to memory of 2028	2552	cmd.exe	cacls.exe
PID 2552 wrote to memory of 2028	2552	cmd.exe	cacls.exe
PID 2552 wrote to memory of 744	2552	cmd.exe	cacls.exe
PID 2552 wrote to memory of 744	2552	cmd.exe	cacls.exe
PID 2552 wrote to memory of 744	2552	cmd.exe	cacls.exe
PID 4800 wrote to memory of 4344	4800	lamod.exe	rundll32.exe
PID 4800 wrote to memory of 4344	4800	lamod.exe	rundll32.exe
PID 4800 wrote to memory of 4344	4800	lamod.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\757e8f8597d5ccee67ad3f1e48a2adf371f26ae1720013052ece0ea1adea4dd8.exe
"C:\Users\Admin\AppData\Local\Temp\757e8f8597d5ccee67ad3f1e48a2adf371f26ae1720013052ece0ea1adea4dd8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2796

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4310159.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4310159.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1808

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4151875.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4151875.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5020

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5008466.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5008466.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4824

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1683960.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1683960.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0880877.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0880877.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 156
6⤵
- Program crash
PID:2188

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8256908.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8256908.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d2614411.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d2614411.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1396

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
"C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe" /F
5⤵
- Creates scheduled task(s)
PID:4380

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "Admin:N"&&CACLS "lamod.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
5⤵
- Suspicious use of WriteProcessMemory
PID:2552

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:5024

C:\Windows\SysWOW64\cacls.exe
CACLS "lamod.exe" /P "Admin:N"
6⤵
PID:4796

C:\Windows\SysWOW64\cacls.exe
CACLS "lamod.exe" /P "Admin:R" /E
6⤵
PID:1148

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:1892

C:\Windows\SysWOW64\cacls.exe
CACLS "..\a9e2a16078" /P "Admin:N"
6⤵
PID:2028

C:\Windows\SysWOW64\cacls.exe
CACLS "..\a9e2a16078" /P "Admin:R" /E
6⤵
PID:744

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
5⤵
- Loads dropped DLL
PID:4344

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e2519644.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e2519644.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 152
3⤵
- Program crash
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 112 -ip 112
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2764 -ip 2764
1⤵
PID:3936

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
1⤵
- Executes dropped EXE
PID:1060

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
1⤵
- Executes dropped EXE
PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e2519644.exe

Filesize
309KB

MD5
86836952ad1c36c306cb27b60115141e

SHA1
0270aff969321acdcb16ae789d068c5d0a9b9d23

SHA256
3a49f4dad000278f9b44525bd2f102e783f17ebeed59729474559075bdb36e6f

SHA512
4bd8b18c76ca39e5dfb2d83659228c0639ed31dc9f6a6df947a051332e89f47bd26eed23c933ed4e0e85576525449fc22f018c4266346ab0b12e33719475ec8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e2519644.exe

Filesize
309KB

MD5
86836952ad1c36c306cb27b60115141e

SHA1
0270aff969321acdcb16ae789d068c5d0a9b9d23

SHA256
3a49f4dad000278f9b44525bd2f102e783f17ebeed59729474559075bdb36e6f

SHA512
4bd8b18c76ca39e5dfb2d83659228c0639ed31dc9f6a6df947a051332e89f47bd26eed23c933ed4e0e85576525449fc22f018c4266346ab0b12e33719475ec8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4310159.exe

Filesize
548KB

MD5
4043a6094e1527ff0baab2cb863a65b6

SHA1
e0bc02908bfb9c36bf4003bdd25afa28e207f810

SHA256
e39e3b961e2d722cb5b3884e2f0f48853fd68fe60fd811db4cc5a319b910fbd3

SHA512
1be8928e7afa973974caacd48e98154618717b09d8f690141d040a3a0066c1a2020cd202d1a77bd28e1c9acb8ba6047a5578082042b5b716d54db0634ace7dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4310159.exe

Filesize
548KB

MD5
4043a6094e1527ff0baab2cb863a65b6

SHA1
e0bc02908bfb9c36bf4003bdd25afa28e207f810

SHA256
e39e3b961e2d722cb5b3884e2f0f48853fd68fe60fd811db4cc5a319b910fbd3

SHA512
1be8928e7afa973974caacd48e98154618717b09d8f690141d040a3a0066c1a2020cd202d1a77bd28e1c9acb8ba6047a5578082042b5b716d54db0634ace7dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d2614411.exe

Filesize
208KB

MD5
2bceaeb5fbb6cb6397f62e481130eef9

SHA1
b18e71e5021fbf4e0fbdd8bf10ebd43f2c68e7a8

SHA256
1f59634b075ee52e9a8a813b097924f8a28de59bdcadab3d02ab66a0075ac438

SHA512
4339ac5f6233d79c6c5bbd6c858d56a7253c23748ee00ada59e5f7f5f2fa9b1bc2a61759df2ad72e2353b07153d9b5d80082e3408f5a114e80b96a0d56ebb691

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d2614411.exe

Filesize
208KB

MD5
2bceaeb5fbb6cb6397f62e481130eef9

SHA1
b18e71e5021fbf4e0fbdd8bf10ebd43f2c68e7a8

SHA256
1f59634b075ee52e9a8a813b097924f8a28de59bdcadab3d02ab66a0075ac438

SHA512
4339ac5f6233d79c6c5bbd6c858d56a7253c23748ee00ada59e5f7f5f2fa9b1bc2a61759df2ad72e2353b07153d9b5d80082e3408f5a114e80b96a0d56ebb691

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4151875.exe

Filesize
376KB

MD5
4100558e37260c0727bc93454ae92fe1

SHA1
7d32367cc4de7e4ffa8b426cf0cbc6f6dfb1557e

SHA256
c8ed2bf53e6c9527112b92d25a0edb3e3954dcbe597e9f00cf0f93fe25b781ce

SHA512
44d8c4060183c9078bac7267a1e2f6294e04606d07088f48b7e855a5596000c9f89fa7834782049093eac5af69910933c2adb06ee52bdfdffa84464eaa94dad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4151875.exe

Filesize
376KB

MD5
4100558e37260c0727bc93454ae92fe1

SHA1
7d32367cc4de7e4ffa8b426cf0cbc6f6dfb1557e

SHA256
c8ed2bf53e6c9527112b92d25a0edb3e3954dcbe597e9f00cf0f93fe25b781ce

SHA512
44d8c4060183c9078bac7267a1e2f6294e04606d07088f48b7e855a5596000c9f89fa7834782049093eac5af69910933c2adb06ee52bdfdffa84464eaa94dad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8256908.exe

Filesize
172KB

MD5
392ff6a1c26747bd83980bc7a44c7326

SHA1
0a0dddaa36b85a86cf1605c0734d16d8f2566244

SHA256
a38e952cbba27d01b1ca0027bfc0cc70842d89ddb189c44661117f59858de25e

SHA512
fa41cbc286fc0b23051d96d16b94647f89cc78942595b29cbe0df09c908f7cf07e145443a3812c67ed79eb8adf3134472403bef2516ffd12e3e98bb8789dd3c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8256908.exe

Filesize
172KB

MD5
392ff6a1c26747bd83980bc7a44c7326

SHA1
0a0dddaa36b85a86cf1605c0734d16d8f2566244

SHA256
a38e952cbba27d01b1ca0027bfc0cc70842d89ddb189c44661117f59858de25e

SHA512
fa41cbc286fc0b23051d96d16b94647f89cc78942595b29cbe0df09c908f7cf07e145443a3812c67ed79eb8adf3134472403bef2516ffd12e3e98bb8789dd3c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5008466.exe

Filesize
221KB

MD5
76182496fd7f9193f4fe499cce11b27e

SHA1
338cc3717d84444474320a7dd0e2e35c505c9db8

SHA256
caaf9ab089c3b79f200d4753204002d541cf886ad5b8c3794bc6b886aa5a1db4

SHA512
42cb88922531c9ed3605b93a11790238c582ba45d945e9c3191c4877ef0c1408f4547bb16acbbbee62ea58f641bf87445d7e8f823347f027ff0fbd6751909d70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5008466.exe

Filesize
221KB

MD5
76182496fd7f9193f4fe499cce11b27e

SHA1
338cc3717d84444474320a7dd0e2e35c505c9db8

SHA256
caaf9ab089c3b79f200d4753204002d541cf886ad5b8c3794bc6b886aa5a1db4

SHA512
42cb88922531c9ed3605b93a11790238c582ba45d945e9c3191c4877ef0c1408f4547bb16acbbbee62ea58f641bf87445d7e8f823347f027ff0fbd6751909d70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1683960.exe

Filesize
14KB

MD5
fb6ee0b4e7c3beef31ff24893b437fe9

SHA1
2b37895748a4d103f513920ee7b7cdb18556730e

SHA256
1d178ce9426d062300b11f23bae5186ea70514109599350e310a01f897588e7f

SHA512
68a5eed6d27544114f217c4f5f85a78ba1db7b11261004e274d3fc091987d9578948182d2ed78224d77df4b2615f91b5b9fdfbb8d25b70afd9acdbf5caf85043

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1683960.exe

Filesize
14KB

MD5
fb6ee0b4e7c3beef31ff24893b437fe9

SHA1
2b37895748a4d103f513920ee7b7cdb18556730e

SHA256
1d178ce9426d062300b11f23bae5186ea70514109599350e310a01f897588e7f

SHA512
68a5eed6d27544114f217c4f5f85a78ba1db7b11261004e274d3fc091987d9578948182d2ed78224d77df4b2615f91b5b9fdfbb8d25b70afd9acdbf5caf85043

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0880877.exe

Filesize
148KB

MD5
bff23fd018c13a366d70e1a8986764e3

SHA1
5662ff294fe13480801612cea96e1a3f57636656

SHA256
f56d769c6eba9e7aaf690171ad212d78e1a81db0fad53de5bf172463954972be

SHA512
f137500783a50a153402a66df0d18f8b235a4b595a386dfd7fc65cf494d320a3b65d22e384a25fbdf718913a163a3f50f499f93b29d428198b7fac3122a32750

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0880877.exe

Filesize
148KB

MD5
bff23fd018c13a366d70e1a8986764e3

SHA1
5662ff294fe13480801612cea96e1a3f57636656

SHA256
f56d769c6eba9e7aaf690171ad212d78e1a81db0fad53de5bf172463954972be

SHA512
f137500783a50a153402a66df0d18f8b235a4b595a386dfd7fc65cf494d320a3b65d22e384a25fbdf718913a163a3f50f499f93b29d428198b7fac3122a32750

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
2bceaeb5fbb6cb6397f62e481130eef9

SHA1
b18e71e5021fbf4e0fbdd8bf10ebd43f2c68e7a8

SHA256
1f59634b075ee52e9a8a813b097924f8a28de59bdcadab3d02ab66a0075ac438

SHA512
4339ac5f6233d79c6c5bbd6c858d56a7253c23748ee00ada59e5f7f5f2fa9b1bc2a61759df2ad72e2353b07153d9b5d80082e3408f5a114e80b96a0d56ebb691

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
2bceaeb5fbb6cb6397f62e481130eef9

SHA1
b18e71e5021fbf4e0fbdd8bf10ebd43f2c68e7a8

SHA256
1f59634b075ee52e9a8a813b097924f8a28de59bdcadab3d02ab66a0075ac438

SHA512
4339ac5f6233d79c6c5bbd6c858d56a7253c23748ee00ada59e5f7f5f2fa9b1bc2a61759df2ad72e2353b07153d9b5d80082e3408f5a114e80b96a0d56ebb691

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
2bceaeb5fbb6cb6397f62e481130eef9

SHA1
b18e71e5021fbf4e0fbdd8bf10ebd43f2c68e7a8

SHA256
1f59634b075ee52e9a8a813b097924f8a28de59bdcadab3d02ab66a0075ac438

SHA512
4339ac5f6233d79c6c5bbd6c858d56a7253c23748ee00ada59e5f7f5f2fa9b1bc2a61759df2ad72e2353b07153d9b5d80082e3408f5a114e80b96a0d56ebb691

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
2bceaeb5fbb6cb6397f62e481130eef9

SHA1
b18e71e5021fbf4e0fbdd8bf10ebd43f2c68e7a8

SHA256
1f59634b075ee52e9a8a813b097924f8a28de59bdcadab3d02ab66a0075ac438

SHA512
4339ac5f6233d79c6c5bbd6c858d56a7253c23748ee00ada59e5f7f5f2fa9b1bc2a61759df2ad72e2353b07153d9b5d80082e3408f5a114e80b96a0d56ebb691

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
2bceaeb5fbb6cb6397f62e481130eef9

SHA1
b18e71e5021fbf4e0fbdd8bf10ebd43f2c68e7a8

SHA256
1f59634b075ee52e9a8a813b097924f8a28de59bdcadab3d02ab66a0075ac438

SHA512
4339ac5f6233d79c6c5bbd6c858d56a7253c23748ee00ada59e5f7f5f2fa9b1bc2a61759df2ad72e2353b07153d9b5d80082e3408f5a114e80b96a0d56ebb691

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/636-166-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1820-161-0x0000000000B70000-0x0000000000B7A000-memory.dmp

Filesize
40KB

Download
memory/4324-206-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4324-212-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/4552-183-0x000000000B750000-0x000000000B7B6000-memory.dmp

Filesize
408KB

Download
memory/4552-186-0x000000000CC80000-0x000000000D1AC000-memory.dmp

Filesize
5.2MB

Download
memory/4552-182-0x000000000BD00000-0x000000000C2A4000-memory.dmp

Filesize
5.6MB

Download
memory/4552-181-0x000000000B080000-0x000000000B112000-memory.dmp

Filesize
584KB

Download
memory/4552-180-0x000000000AF60000-0x000000000AFD6000-memory.dmp

Filesize
472KB

Download
memory/4552-184-0x000000000C580000-0x000000000C742000-memory.dmp

Filesize
1.8MB

Download
memory/4552-179-0x00000000054E0000-0x00000000054F0000-memory.dmp

Filesize
64KB

Download
memory/4552-188-0x000000000C480000-0x000000000C4D0000-memory.dmp

Filesize
320KB

Download
memory/4552-178-0x000000000AC50000-0x000000000AC8C000-memory.dmp

Filesize
240KB

Download
memory/4552-177-0x000000000ABF0000-0x000000000AC02000-memory.dmp

Filesize
72KB

Download
memory/4552-176-0x000000000ACB0000-0x000000000ADBA000-memory.dmp

Filesize
1.0MB

Download
memory/4552-175-0x000000000B130000-0x000000000B748000-memory.dmp

Filesize
6.1MB

Download
memory/4552-174-0x0000000000D30000-0x0000000000D60000-memory.dmp

Filesize
192KB

Download
memory/4552-187-0x00000000054E0000-0x00000000054F0000-memory.dmp

Filesize
64KB

Download