redline | 84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a

Analysis

max time kernel
107s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2023 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a.exe
Size

772KB
MD5

6227ed61522396a6c569edcc43e224d9
SHA1

c81fda860fbaf7baa76eb2976ccc786eb327e3e3
SHA256

84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a
SHA512

5ef22acdc25131ef9a095302a263aa425e3437e3e868df18a2f1badef59278050515fce47b564ee69352c0a9caa79b05ebcb6bbe9fbfa34023c9387fb1a73b57
SSDEEP

24576:Jy9Q54TS9Pcn9bJiQfOw8Ix2OjTfsAi3I0igb:89Q4TS+9bbWbOPfsAi3ti

Score

10^/10

redline maxi sheron discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

83.97.73.129:19068

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Extracted

Family

redline

Botnet

sheron

83.97.73.129:19068

Attributes

auth_value
2d067e7e2372227d3a03b335260112e9

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a9477898.exeAppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a9477898.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a9477898.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a9477898.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a9477898.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a9477898.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a9477898.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d3768092.exelamod.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	d3768092.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	lamod.exe

Executes dropped EXE 11 IoCs

Processes:

v0709706.exev4125574.exev5008133.exea9477898.exeb6514588.exec8122717.exed3768092.exelamod.exee9783307.exelamod.exelamod.exe

pid	process
5060	v0709706.exe
4700	v4125574.exe
3540	v5008133.exe
1524	a9477898.exe
116	b6514588.exe
3788	c8122717.exe
1836	d3768092.exe
4928	lamod.exe
3956	e9783307.exe
3848	lamod.exe
628	lamod.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2556 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a9477898.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a9477898.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2556	rundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a9477898.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v5008133.exe84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a.exev0709706.exev4125574.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v5008133.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v0709706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v0709706.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v4125574.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v4125574.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v5008133.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

Processes:

b6514588.exee9783307.exe

description	pid	process	target process
PID 116 set thread context of 4288	116	b6514588.exe	AppLaunch.exe
PID 3956 set thread context of 3916	3956	e9783307.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4824 116 WerFault.exe b6514588.exe
4748 3956 WerFault.exe e9783307.exe
4868 3956 WerFault.exe e9783307.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4780 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

a9477898.exeAppLaunch.exec8122717.exeAppLaunch.exe

pid process

1524 a9477898.exe
1524 a9477898.exe
4288 AppLaunch.exe
4288 AppLaunch.exe
3788 c8122717.exe
3788 c8122717.exe
3916 AppLaunch.exe
3916 AppLaunch.exe

pid	pid_target	process	target process
4824	116	WerFault.exe	b6514588.exe
4748	3956	WerFault.exe	e9783307.exe
4868	3956	WerFault.exe	e9783307.exe

pid	process
4780	schtasks.exe

pid	process
1524	a9477898.exe
1524	a9477898.exe
4288	AppLaunch.exe
4288	AppLaunch.exe
3788	c8122717.exe
3788	c8122717.exe
3916	AppLaunch.exe
3916	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

a9477898.exeAppLaunch.exec8122717.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1524	a9477898.exe
Token: SeDebugPrivilege	4288	AppLaunch.exe
Token: SeDebugPrivilege	3788	c8122717.exe
Token: SeDebugPrivilege	3916	AppLaunch.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

d3768092.exe

pid process

1836 d3768092.exe

pid	process
1836	d3768092.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a.exev0709706.exev4125574.exev5008133.exeb6514588.exed3768092.exelamod.execmd.exee9783307.exe

description	pid	process	target process
PID 4452 wrote to memory of 5060	4452	84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a.exe	v0709706.exe
PID 4452 wrote to memory of 5060	4452	84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a.exe	v0709706.exe
PID 4452 wrote to memory of 5060	4452	84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a.exe	v0709706.exe
PID 5060 wrote to memory of 4700	5060	v0709706.exe	v4125574.exe
PID 5060 wrote to memory of 4700	5060	v0709706.exe	v4125574.exe
PID 5060 wrote to memory of 4700	5060	v0709706.exe	v4125574.exe
PID 4700 wrote to memory of 3540	4700	v4125574.exe	v5008133.exe
PID 4700 wrote to memory of 3540	4700	v4125574.exe	v5008133.exe
PID 4700 wrote to memory of 3540	4700	v4125574.exe	v5008133.exe
PID 3540 wrote to memory of 1524	3540	v5008133.exe	a9477898.exe
PID 3540 wrote to memory of 1524	3540	v5008133.exe	a9477898.exe
PID 3540 wrote to memory of 116	3540	v5008133.exe	b6514588.exe
PID 3540 wrote to memory of 116	3540	v5008133.exe	b6514588.exe
PID 3540 wrote to memory of 116	3540	v5008133.exe	b6514588.exe
PID 116 wrote to memory of 4288	116	b6514588.exe	AppLaunch.exe
PID 116 wrote to memory of 4288	116	b6514588.exe	AppLaunch.exe
PID 116 wrote to memory of 4288	116	b6514588.exe	AppLaunch.exe
PID 116 wrote to memory of 4288	116	b6514588.exe	AppLaunch.exe
PID 116 wrote to memory of 4288	116	b6514588.exe	AppLaunch.exe
PID 4700 wrote to memory of 3788	4700	v4125574.exe	c8122717.exe
PID 4700 wrote to memory of 3788	4700	v4125574.exe	c8122717.exe
PID 4700 wrote to memory of 3788	4700	v4125574.exe	c8122717.exe
PID 5060 wrote to memory of 1836	5060	v0709706.exe	d3768092.exe
PID 5060 wrote to memory of 1836	5060	v0709706.exe	d3768092.exe
PID 5060 wrote to memory of 1836	5060	v0709706.exe	d3768092.exe
PID 1836 wrote to memory of 4928	1836	d3768092.exe	lamod.exe
PID 1836 wrote to memory of 4928	1836	d3768092.exe	lamod.exe
PID 1836 wrote to memory of 4928	1836	d3768092.exe	lamod.exe
PID 4452 wrote to memory of 3956	4452	84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a.exe	e9783307.exe
PID 4452 wrote to memory of 3956	4452	84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a.exe	e9783307.exe
PID 4452 wrote to memory of 3956	4452	84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a.exe	e9783307.exe
PID 4928 wrote to memory of 4780	4928	lamod.exe	schtasks.exe
PID 4928 wrote to memory of 4780	4928	lamod.exe	schtasks.exe
PID 4928 wrote to memory of 4780	4928	lamod.exe	schtasks.exe
PID 4928 wrote to memory of 2100	4928	lamod.exe	cmd.exe
PID 4928 wrote to memory of 2100	4928	lamod.exe	cmd.exe
PID 4928 wrote to memory of 2100	4928	lamod.exe	cmd.exe
PID 2100 wrote to memory of 2524	2100	cmd.exe	cmd.exe
PID 2100 wrote to memory of 2524	2100	cmd.exe	cmd.exe
PID 2100 wrote to memory of 2524	2100	cmd.exe	cmd.exe
PID 2100 wrote to memory of 3476	2100	cmd.exe	cacls.exe
PID 2100 wrote to memory of 3476	2100	cmd.exe	cacls.exe
PID 2100 wrote to memory of 3476	2100	cmd.exe	cacls.exe
PID 2100 wrote to memory of 2180	2100	cmd.exe	cacls.exe
PID 2100 wrote to memory of 2180	2100	cmd.exe	cacls.exe
PID 2100 wrote to memory of 2180	2100	cmd.exe	cacls.exe
PID 3956 wrote to memory of 3916	3956	e9783307.exe	AppLaunch.exe
PID 3956 wrote to memory of 3916	3956	e9783307.exe	AppLaunch.exe
PID 3956 wrote to memory of 3916	3956	e9783307.exe	AppLaunch.exe
PID 3956 wrote to memory of 3916	3956	e9783307.exe	AppLaunch.exe
PID 3956 wrote to memory of 3916	3956	e9783307.exe	AppLaunch.exe
PID 2100 wrote to memory of 1684	2100	cmd.exe	cmd.exe
PID 2100 wrote to memory of 1684	2100	cmd.exe	cmd.exe
PID 2100 wrote to memory of 1684	2100	cmd.exe	cmd.exe
PID 2100 wrote to memory of 1372	2100	cmd.exe	cacls.exe
PID 2100 wrote to memory of 1372	2100	cmd.exe	cacls.exe
PID 2100 wrote to memory of 1372	2100	cmd.exe	cacls.exe
PID 2100 wrote to memory of 2760	2100	cmd.exe	cacls.exe
PID 2100 wrote to memory of 2760	2100	cmd.exe	cacls.exe
PID 2100 wrote to memory of 2760	2100	cmd.exe	cacls.exe
PID 4928 wrote to memory of 2556	4928	lamod.exe	rundll32.exe
PID 4928 wrote to memory of 2556	4928	lamod.exe	rundll32.exe
PID 4928 wrote to memory of 2556	4928	lamod.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a.exe
"C:\Users\Admin\AppData\Local\Temp\84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0709706.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0709706.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4125574.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4125574.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5008133.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5008133.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9477898.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9477898.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6514588.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6514588.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:116
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4288
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 152
        6⤵
        Program crash
        
        PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8122717.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8122717.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3788
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3768092.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3768092.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
      "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4780
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "Admin:N"&&CACLS "lamod.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2100
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2524
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "lamod.exe" /P "Admin:N"
        6⤵
        
        PID:3476
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "lamod.exe" /P "Admin:R" /E
        6⤵
        
        PID:2180
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1684
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\a9e2a16078" /P "Admin:N"
        6⤵
        
        PID:1372
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\a9e2a16078" /P "Admin:R" /E
        6⤵
        
        PID:2760
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:2556
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e9783307.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e9783307.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 152
    3⤵
    - Program crash
    PID:4748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 620
    3⤵
    - Program crash
    PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 116 -ip 116
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3956 -ip 3956
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3956 -ip 3956
1⤵
PID:4696

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
1⤵
- Executes dropped EXE
PID:3848

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
1⤵
- Executes dropped EXE
PID:628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e9783307.exe

Filesize
309KB

MD5
fc5cbb16ec526e2849562899c62225a0

SHA1
a151affba0c56a3ffb55885324968809f4dc14a5

SHA256
b6dbed63566f2b44a327e964446d7b61aa3c0577500ef6a7b5412d253b42d151

SHA512
98d40cd12b8ee69a11f60b772aead57da5ee71b3621a06e7168e1ce6e5ee2dc98da811d35099b3160e980fffd973ca32576ec058730ad8bcc4c5d21d126d8c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e9783307.exe

Filesize
309KB

MD5
fc5cbb16ec526e2849562899c62225a0

SHA1
a151affba0c56a3ffb55885324968809f4dc14a5

SHA256
b6dbed63566f2b44a327e964446d7b61aa3c0577500ef6a7b5412d253b42d151

SHA512
98d40cd12b8ee69a11f60b772aead57da5ee71b3621a06e7168e1ce6e5ee2dc98da811d35099b3160e980fffd973ca32576ec058730ad8bcc4c5d21d126d8c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0709706.exe

Filesize
549KB

MD5
a0ae5887cabda70ed90e41ad5da090a4

SHA1
53c7efac6cfc77e3671dd34d94b736528909adbd

SHA256
11594435c77f465c1eae04e2376d752e920e66a69f729ab4c1a225799bcd8251

SHA512
c93d8d6e3238985cdcf30cff4a8e849c1c1eb30bd4be25f5690e85291272c7000b64c282fab917ea5ca2343d8af56e1f7a693096b6b32e1fa174feaf5103a320

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0709706.exe

Filesize
549KB

MD5
a0ae5887cabda70ed90e41ad5da090a4

SHA1
53c7efac6cfc77e3671dd34d94b736528909adbd

SHA256
11594435c77f465c1eae04e2376d752e920e66a69f729ab4c1a225799bcd8251

SHA512
c93d8d6e3238985cdcf30cff4a8e849c1c1eb30bd4be25f5690e85291272c7000b64c282fab917ea5ca2343d8af56e1f7a693096b6b32e1fa174feaf5103a320

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3768092.exe

Filesize
208KB

MD5
798ff02bb15fbbbf19faf573915a6d00

SHA1
4468976f9bb02100df4a49c26d0a7c4518ad3876

SHA256
718f921460968644995dbebe58526cf2a3a68f5d5ad100f531369f20718e850f

SHA512
625d09dbf2a6eb00b4a27dcd49f7da0c774aabba1bdb6ac5fb755d1790dea55b6829b86dcb782725cb4f3dc9632b4bde901f106a23b583bedc0b492cba376619

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3768092.exe

Filesize
208KB

MD5
798ff02bb15fbbbf19faf573915a6d00

SHA1
4468976f9bb02100df4a49c26d0a7c4518ad3876

SHA256
718f921460968644995dbebe58526cf2a3a68f5d5ad100f531369f20718e850f

SHA512
625d09dbf2a6eb00b4a27dcd49f7da0c774aabba1bdb6ac5fb755d1790dea55b6829b86dcb782725cb4f3dc9632b4bde901f106a23b583bedc0b492cba376619

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4125574.exe

Filesize
377KB

MD5
c40f701414d2be025e31a5b26b028464

SHA1
2e377852f6c36acb30a221786affd8bd1fc207b2

SHA256
57588dac09557ab68d3698d0cd63ee43b5ab8cc3594d30a921f07dd25c8c2c1e

SHA512
f079790d6d86109cec209492992f405aad1d22f5aed1ac9f87cbd59b21bb988cdb53be8c67b89059a09fc5d1bd6cafdb47084ee09b4d25d1f0ca92a5ec1a9eab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4125574.exe

Filesize
377KB

MD5
c40f701414d2be025e31a5b26b028464

SHA1
2e377852f6c36acb30a221786affd8bd1fc207b2

SHA256
57588dac09557ab68d3698d0cd63ee43b5ab8cc3594d30a921f07dd25c8c2c1e

SHA512
f079790d6d86109cec209492992f405aad1d22f5aed1ac9f87cbd59b21bb988cdb53be8c67b89059a09fc5d1bd6cafdb47084ee09b4d25d1f0ca92a5ec1a9eab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8122717.exe

Filesize
172KB

MD5
e5e8869b5b9f5fbde060d7df78df53cc

SHA1
3b257a2edff5bb5b6666df4b0795a53a122f1ac6

SHA256
3ca98648853db1c878634a1da2bc4eca82d6509e1891e662ff9f2b8c4bf38e1f

SHA512
2780dcd8b19c2918b41f61f89cbdc0d0ca41d39792e4cfdab4696898af5cb216aeb3d22f6fa5a69de06a75e26defd1d076f34701baed4613771837c6d147fbab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8122717.exe

Filesize
172KB

MD5
e5e8869b5b9f5fbde060d7df78df53cc

SHA1
3b257a2edff5bb5b6666df4b0795a53a122f1ac6

SHA256
3ca98648853db1c878634a1da2bc4eca82d6509e1891e662ff9f2b8c4bf38e1f

SHA512
2780dcd8b19c2918b41f61f89cbdc0d0ca41d39792e4cfdab4696898af5cb216aeb3d22f6fa5a69de06a75e26defd1d076f34701baed4613771837c6d147fbab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5008133.exe

Filesize
221KB

MD5
9cf73238d9e6ca8860db184a0b1b73bf

SHA1
866d264acee7a212497ea3a73e041109e437b698

SHA256
8357c168ef9a8bfaceb7b725b792bcfca3e4bfd95ef866f86f7fe12711226438

SHA512
cc642630ab61a9c17a0001123e9a03660dba0b8e2927c92fa361125a8d0323eed7dd3a1317343b6a7a005b16aa346279d643a55decd49f3242716260176033e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5008133.exe

Filesize
221KB

MD5
9cf73238d9e6ca8860db184a0b1b73bf

SHA1
866d264acee7a212497ea3a73e041109e437b698

SHA256
8357c168ef9a8bfaceb7b725b792bcfca3e4bfd95ef866f86f7fe12711226438

SHA512
cc642630ab61a9c17a0001123e9a03660dba0b8e2927c92fa361125a8d0323eed7dd3a1317343b6a7a005b16aa346279d643a55decd49f3242716260176033e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9477898.exe

Filesize
14KB

MD5
3da18b80a1df7d7fdc334a943b071b2b

SHA1
0db7681749b0f2965a7097883400284c93e34d28

SHA256
9b83021343c207b9e11990c12688c72f902db3da6ebd95e31bae445c8ba238f1

SHA512
bf02fcf1a544277d179c3dd7f3affc482ab233b9cc47f4df3ec764760172750122aebd93b5dd4a5d8659bb837d505ba03be46b52c8c51c50b1da9537ae79a1ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9477898.exe

Filesize
14KB

MD5
3da18b80a1df7d7fdc334a943b071b2b

SHA1
0db7681749b0f2965a7097883400284c93e34d28

SHA256
9b83021343c207b9e11990c12688c72f902db3da6ebd95e31bae445c8ba238f1

SHA512
bf02fcf1a544277d179c3dd7f3affc482ab233b9cc47f4df3ec764760172750122aebd93b5dd4a5d8659bb837d505ba03be46b52c8c51c50b1da9537ae79a1ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6514588.exe

Filesize
148KB

MD5
55f8a688b6de597cb49d08184b4c4ea7

SHA1
933ce8a8b672a33cf1cd4653e2185e4bb90699df

SHA256
66c97029873bb1115d83ccbd035e9f821f0dc756e02eadc86cd2366b51c91b63

SHA512
6c6c08be48698e8bccd2258ce30ada76ae9f4f9c116ba6a04d3912c78082c30415bbaad61768e61624ab18f35158a1a6df206bfb650f14e3fd7475a25177bf95

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6514588.exe

Filesize
148KB

MD5
55f8a688b6de597cb49d08184b4c4ea7

SHA1
933ce8a8b672a33cf1cd4653e2185e4bb90699df

SHA256
66c97029873bb1115d83ccbd035e9f821f0dc756e02eadc86cd2366b51c91b63

SHA512
6c6c08be48698e8bccd2258ce30ada76ae9f4f9c116ba6a04d3912c78082c30415bbaad61768e61624ab18f35158a1a6df206bfb650f14e3fd7475a25177bf95

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
798ff02bb15fbbbf19faf573915a6d00

SHA1
4468976f9bb02100df4a49c26d0a7c4518ad3876

SHA256
718f921460968644995dbebe58526cf2a3a68f5d5ad100f531369f20718e850f

SHA512
625d09dbf2a6eb00b4a27dcd49f7da0c774aabba1bdb6ac5fb755d1790dea55b6829b86dcb782725cb4f3dc9632b4bde901f106a23b583bedc0b492cba376619

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
798ff02bb15fbbbf19faf573915a6d00

SHA1
4468976f9bb02100df4a49c26d0a7c4518ad3876

SHA256
718f921460968644995dbebe58526cf2a3a68f5d5ad100f531369f20718e850f

SHA512
625d09dbf2a6eb00b4a27dcd49f7da0c774aabba1bdb6ac5fb755d1790dea55b6829b86dcb782725cb4f3dc9632b4bde901f106a23b583bedc0b492cba376619

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
798ff02bb15fbbbf19faf573915a6d00

SHA1
4468976f9bb02100df4a49c26d0a7c4518ad3876

SHA256
718f921460968644995dbebe58526cf2a3a68f5d5ad100f531369f20718e850f

SHA512
625d09dbf2a6eb00b4a27dcd49f7da0c774aabba1bdb6ac5fb755d1790dea55b6829b86dcb782725cb4f3dc9632b4bde901f106a23b583bedc0b492cba376619

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
798ff02bb15fbbbf19faf573915a6d00

SHA1
4468976f9bb02100df4a49c26d0a7c4518ad3876

SHA256
718f921460968644995dbebe58526cf2a3a68f5d5ad100f531369f20718e850f

SHA512
625d09dbf2a6eb00b4a27dcd49f7da0c774aabba1bdb6ac5fb755d1790dea55b6829b86dcb782725cb4f3dc9632b4bde901f106a23b583bedc0b492cba376619

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
798ff02bb15fbbbf19faf573915a6d00

SHA1
4468976f9bb02100df4a49c26d0a7c4518ad3876

SHA256
718f921460968644995dbebe58526cf2a3a68f5d5ad100f531369f20718e850f

SHA512
625d09dbf2a6eb00b4a27dcd49f7da0c774aabba1bdb6ac5fb755d1790dea55b6829b86dcb782725cb4f3dc9632b4bde901f106a23b583bedc0b492cba376619

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1524-161-0x0000000000770000-0x000000000077A000-memory.dmp

Filesize
40KB

Download
memory/3788-182-0x000000000BEA0000-0x000000000C444000-memory.dmp

Filesize
5.6MB

Download
memory/3788-179-0x00000000056E0000-0x00000000056F0000-memory.dmp

Filesize
64KB

Download
memory/3788-187-0x00000000056E0000-0x00000000056F0000-memory.dmp

Filesize
64KB

Download
memory/3788-186-0x000000000CD20000-0x000000000D24C000-memory.dmp

Filesize
5.2MB

Download
memory/3788-185-0x000000000C620000-0x000000000C7E2000-memory.dmp

Filesize
1.8MB

Download
memory/3788-183-0x000000000B7B0000-0x000000000B816000-memory.dmp

Filesize
408KB

Download
memory/3788-181-0x000000000B850000-0x000000000B8E2000-memory.dmp

Filesize
584KB

Download
memory/3788-180-0x000000000AF80000-0x000000000AFF6000-memory.dmp

Filesize
472KB

Download
memory/3788-174-0x0000000000D50000-0x0000000000D80000-memory.dmp

Filesize
192KB

Download
memory/3788-188-0x000000000C450000-0x000000000C4A0000-memory.dmp

Filesize
320KB

Download
memory/3788-175-0x000000000B190000-0x000000000B7A8000-memory.dmp

Filesize
6.1MB

Download
memory/3788-176-0x000000000ACD0000-0x000000000ADDA000-memory.dmp

Filesize
1.0MB

Download
memory/3788-178-0x000000000AC70000-0x000000000ACAC000-memory.dmp

Filesize
240KB

Download
memory/3788-177-0x000000000AC10000-0x000000000AC22000-memory.dmp

Filesize
72KB

Download
memory/3916-213-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/3916-212-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/3916-206-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4288-166-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download