redline | 3eae65d5ba07e2d32f73d1e411698982e73b603b52302118aef14b7e1dcb04e5

Analysis

max time kernel
126s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2023 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3eae65d5ba07e2d32f73d1e411698982e73b603b52302118aef14b7e1dcb04e5.exe
Size

772KB
MD5

7f134c995c0aec55fc66003f54411a36
SHA1

c97af7fb56f0e37bd111be331f354681dac047fc
SHA256

3eae65d5ba07e2d32f73d1e411698982e73b603b52302118aef14b7e1dcb04e5
SHA512

3276f81eca787b0692bd928255c1319a3bc718fd606f7ae3cd34a59301a0a54babb02076361b15e3ab9b73bfca6416694d724a90754d5ad3a5af0c5dacbbe5ee
SSDEEP

24576:6y6KUx+MSEwhBOeOXdSCZsYI+nF8aBatgDB:B6JkMSEABOeOACZst8F9B

Score

10^/10

redline maxi sheron discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

83.97.73.129:19068

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Extracted

Family

redline

Botnet

sheron

83.97.73.129:19068

Attributes

auth_value
2d067e7e2372227d3a03b335260112e9

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a9186077.exeAppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a9186077.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a9186077.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a9186077.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a9186077.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a9186077.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a9186077.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d8715439.exelamod.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	d8715439.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	lamod.exe

Executes dropped EXE 11 IoCs

Processes:

v6493220.exev1949988.exev1857794.exea9186077.exeb2154417.exec9210403.exed8715439.exelamod.exee8638401.exelamod.exelamod.exe

pid	process
3432	v6493220.exe
3732	v1949988.exe
4280	v1857794.exe
1228	a9186077.exe
1580	b2154417.exe
2196	c9210403.exe
4776	d8715439.exe
2648	lamod.exe
2444	e8638401.exe
468	lamod.exe
4844	lamod.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4040 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a9186077.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a9186077.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4040	rundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a9186077.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v1949988.exev1857794.exe3eae65d5ba07e2d32f73d1e411698982e73b603b52302118aef14b7e1dcb04e5.exev6493220.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v1949988.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v1857794.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v1857794.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	3eae65d5ba07e2d32f73d1e411698982e73b603b52302118aef14b7e1dcb04e5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3eae65d5ba07e2d32f73d1e411698982e73b603b52302118aef14b7e1dcb04e5.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v6493220.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v6493220.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v1949988.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

Processes:

b2154417.exee8638401.exe

description	pid	process	target process
PID 1580 set thread context of 1072	1580	b2154417.exe	AppLaunch.exe
PID 2444 set thread context of 3436	2444	e8638401.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

320 1580 WerFault.exe b2154417.exe
1584 2444 WerFault.exe e8638401.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4812 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

a9186077.exeAppLaunch.exec9210403.exeAppLaunch.exe

pid process

1228 a9186077.exe
1228 a9186077.exe
1072 AppLaunch.exe
1072 AppLaunch.exe
2196 c9210403.exe
2196 c9210403.exe
3436 AppLaunch.exe
3436 AppLaunch.exe

pid	pid_target	process	target process
320	1580	WerFault.exe	b2154417.exe
1584	2444	WerFault.exe	e8638401.exe

pid	process
4812	schtasks.exe

pid	process
1228	a9186077.exe
1228	a9186077.exe
1072	AppLaunch.exe
1072	AppLaunch.exe
2196	c9210403.exe
2196	c9210403.exe
3436	AppLaunch.exe
3436	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

a9186077.exeAppLaunch.exec9210403.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1228	a9186077.exe
Token: SeDebugPrivilege	1072	AppLaunch.exe
Token: SeDebugPrivilege	2196	c9210403.exe
Token: SeDebugPrivilege	3436	AppLaunch.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

d8715439.exe

pid process

4776 d8715439.exe

pid	process
4776	d8715439.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

3eae65d5ba07e2d32f73d1e411698982e73b603b52302118aef14b7e1dcb04e5.exev6493220.exev1949988.exev1857794.exeb2154417.exed8715439.exelamod.execmd.exee8638401.exe

description	pid	process	target process
PID 2672 wrote to memory of 3432	2672	3eae65d5ba07e2d32f73d1e411698982e73b603b52302118aef14b7e1dcb04e5.exe	v6493220.exe
PID 2672 wrote to memory of 3432	2672	3eae65d5ba07e2d32f73d1e411698982e73b603b52302118aef14b7e1dcb04e5.exe	v6493220.exe
PID 2672 wrote to memory of 3432	2672	3eae65d5ba07e2d32f73d1e411698982e73b603b52302118aef14b7e1dcb04e5.exe	v6493220.exe
PID 3432 wrote to memory of 3732	3432	v6493220.exe	v1949988.exe
PID 3432 wrote to memory of 3732	3432	v6493220.exe	v1949988.exe
PID 3432 wrote to memory of 3732	3432	v6493220.exe	v1949988.exe
PID 3732 wrote to memory of 4280	3732	v1949988.exe	v1857794.exe
PID 3732 wrote to memory of 4280	3732	v1949988.exe	v1857794.exe
PID 3732 wrote to memory of 4280	3732	v1949988.exe	v1857794.exe
PID 4280 wrote to memory of 1228	4280	v1857794.exe	a9186077.exe
PID 4280 wrote to memory of 1228	4280	v1857794.exe	a9186077.exe
PID 4280 wrote to memory of 1580	4280	v1857794.exe	b2154417.exe
PID 4280 wrote to memory of 1580	4280	v1857794.exe	b2154417.exe
PID 4280 wrote to memory of 1580	4280	v1857794.exe	b2154417.exe
PID 1580 wrote to memory of 1072	1580	b2154417.exe	AppLaunch.exe
PID 1580 wrote to memory of 1072	1580	b2154417.exe	AppLaunch.exe
PID 1580 wrote to memory of 1072	1580	b2154417.exe	AppLaunch.exe
PID 1580 wrote to memory of 1072	1580	b2154417.exe	AppLaunch.exe
PID 1580 wrote to memory of 1072	1580	b2154417.exe	AppLaunch.exe
PID 3732 wrote to memory of 2196	3732	v1949988.exe	c9210403.exe
PID 3732 wrote to memory of 2196	3732	v1949988.exe	c9210403.exe
PID 3732 wrote to memory of 2196	3732	v1949988.exe	c9210403.exe
PID 3432 wrote to memory of 4776	3432	v6493220.exe	d8715439.exe
PID 3432 wrote to memory of 4776	3432	v6493220.exe	d8715439.exe
PID 3432 wrote to memory of 4776	3432	v6493220.exe	d8715439.exe
PID 4776 wrote to memory of 2648	4776	d8715439.exe	lamod.exe
PID 4776 wrote to memory of 2648	4776	d8715439.exe	lamod.exe
PID 4776 wrote to memory of 2648	4776	d8715439.exe	lamod.exe
PID 2672 wrote to memory of 2444	2672	3eae65d5ba07e2d32f73d1e411698982e73b603b52302118aef14b7e1dcb04e5.exe	e8638401.exe
PID 2672 wrote to memory of 2444	2672	3eae65d5ba07e2d32f73d1e411698982e73b603b52302118aef14b7e1dcb04e5.exe	e8638401.exe
PID 2672 wrote to memory of 2444	2672	3eae65d5ba07e2d32f73d1e411698982e73b603b52302118aef14b7e1dcb04e5.exe	e8638401.exe
PID 2648 wrote to memory of 4812	2648	lamod.exe	schtasks.exe
PID 2648 wrote to memory of 4812	2648	lamod.exe	schtasks.exe
PID 2648 wrote to memory of 4812	2648	lamod.exe	schtasks.exe
PID 2648 wrote to memory of 3460	2648	lamod.exe	cmd.exe
PID 2648 wrote to memory of 3460	2648	lamod.exe	cmd.exe
PID 2648 wrote to memory of 3460	2648	lamod.exe	cmd.exe
PID 3460 wrote to memory of 2792	3460	cmd.exe	cmd.exe
PID 3460 wrote to memory of 2792	3460	cmd.exe	cmd.exe
PID 3460 wrote to memory of 2792	3460	cmd.exe	cmd.exe
PID 3460 wrote to memory of 2244	3460	cmd.exe	cacls.exe
PID 3460 wrote to memory of 2244	3460	cmd.exe	cacls.exe
PID 3460 wrote to memory of 2244	3460	cmd.exe	cacls.exe
PID 3460 wrote to memory of 1324	3460	cmd.exe	cacls.exe
PID 3460 wrote to memory of 1324	3460	cmd.exe	cacls.exe
PID 3460 wrote to memory of 1324	3460	cmd.exe	cacls.exe
PID 3460 wrote to memory of 4716	3460	cmd.exe	cmd.exe
PID 3460 wrote to memory of 4716	3460	cmd.exe	cmd.exe
PID 3460 wrote to memory of 4716	3460	cmd.exe	cmd.exe
PID 3460 wrote to memory of 3348	3460	cmd.exe	cacls.exe
PID 3460 wrote to memory of 3348	3460	cmd.exe	cacls.exe
PID 3460 wrote to memory of 3348	3460	cmd.exe	cacls.exe
PID 2444 wrote to memory of 3436	2444	e8638401.exe	AppLaunch.exe
PID 2444 wrote to memory of 3436	2444	e8638401.exe	AppLaunch.exe
PID 2444 wrote to memory of 3436	2444	e8638401.exe	AppLaunch.exe
PID 2444 wrote to memory of 3436	2444	e8638401.exe	AppLaunch.exe
PID 2444 wrote to memory of 3436	2444	e8638401.exe	AppLaunch.exe
PID 3460 wrote to memory of 4008	3460	cmd.exe	cacls.exe
PID 3460 wrote to memory of 4008	3460	cmd.exe	cacls.exe
PID 3460 wrote to memory of 4008	3460	cmd.exe	cacls.exe
PID 2648 wrote to memory of 4040	2648	lamod.exe	rundll32.exe
PID 2648 wrote to memory of 4040	2648	lamod.exe	rundll32.exe
PID 2648 wrote to memory of 4040	2648	lamod.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\3eae65d5ba07e2d32f73d1e411698982e73b603b52302118aef14b7e1dcb04e5.exe
"C:\Users\Admin\AppData\Local\Temp\3eae65d5ba07e2d32f73d1e411698982e73b603b52302118aef14b7e1dcb04e5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6493220.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6493220.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1949988.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1949988.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1857794.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1857794.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9186077.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9186077.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2154417.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2154417.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1580
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 156
        6⤵
        Program crash
        
        PID:320
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c9210403.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c9210403.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2196
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d8715439.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d8715439.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
      "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4812
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "Admin:N"&&CACLS "lamod.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3460
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2792
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "lamod.exe" /P "Admin:N"
        6⤵
        
        PID:2244
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "lamod.exe" /P "Admin:R" /E
        6⤵
        
        PID:1324
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4716
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\a9e2a16078" /P "Admin:N"
        6⤵
        
        PID:3348
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\a9e2a16078" /P "Admin:R" /E
        6⤵
        
        PID:4008
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:4040
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e8638401.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e8638401.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 152
    3⤵
    - Program crash
    PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 1580 -ip 1580
1⤵
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2444 -ip 2444
1⤵
PID:4868

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
1⤵
- Executes dropped EXE
PID:468

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
1⤵
- Executes dropped EXE
PID:4844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e8638401.exe

Filesize
309KB

MD5
d2b051059ccf7a2af0a562162eb9f5d5

SHA1
5ecac4963516beec9ef6071f014c8bdb26a4d573

SHA256
5cb568d4ecfe43eec98571a08f136e53b86639ec90817f3a283d7c6f70288a1c

SHA512
386cf7ce21f59a3b5866dcb859f05b5088a38dbff0ceda7ac5aa5d551e31139cc709d2d3003a667dca9062e4c4269d026dd07bf09eb58e4ea4bd1e987a08b9e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e8638401.exe

Filesize
309KB

MD5
d2b051059ccf7a2af0a562162eb9f5d5

SHA1
5ecac4963516beec9ef6071f014c8bdb26a4d573

SHA256
5cb568d4ecfe43eec98571a08f136e53b86639ec90817f3a283d7c6f70288a1c

SHA512
386cf7ce21f59a3b5866dcb859f05b5088a38dbff0ceda7ac5aa5d551e31139cc709d2d3003a667dca9062e4c4269d026dd07bf09eb58e4ea4bd1e987a08b9e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6493220.exe

Filesize
548KB

MD5
4c24069fc5c937c15b3d58bf2dde4ece

SHA1
25ff72396c91d76edbca7624ef1d041e010e9078

SHA256
28f21058fd206cde6150ff490ca47e4ae7226a736db6c1f77656f294c7c0e157

SHA512
f2f99974208ee1a565e1f7a81523e20f6024e384d6995c0f587072633c9a31040d033a4160741e83a6121d3bde0b19f5a24efa243e137471710668ff4addde15

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6493220.exe

Filesize
548KB

MD5
4c24069fc5c937c15b3d58bf2dde4ece

SHA1
25ff72396c91d76edbca7624ef1d041e010e9078

SHA256
28f21058fd206cde6150ff490ca47e4ae7226a736db6c1f77656f294c7c0e157

SHA512
f2f99974208ee1a565e1f7a81523e20f6024e384d6995c0f587072633c9a31040d033a4160741e83a6121d3bde0b19f5a24efa243e137471710668ff4addde15

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d8715439.exe

Filesize
208KB

MD5
f68df19c793cb755ef159fa5049de3fd

SHA1
f4d8e2761f0dac977a7aaa94ac69fde10d9d3d95

SHA256
216caa50c053d45cc36c27489c3b5fa9b9b9384ebfe85a0fd75d4e9b4750be63

SHA512
730d136d6e59d057ed379d4fbe3f81eae07bb8d083d38695dd9fae6d75f0f98c5d6e44cfcd6329e9d4c25abc72762359cf373e61c5bcc324d330097acb84d518

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d8715439.exe

Filesize
208KB

MD5
f68df19c793cb755ef159fa5049de3fd

SHA1
f4d8e2761f0dac977a7aaa94ac69fde10d9d3d95

SHA256
216caa50c053d45cc36c27489c3b5fa9b9b9384ebfe85a0fd75d4e9b4750be63

SHA512
730d136d6e59d057ed379d4fbe3f81eae07bb8d083d38695dd9fae6d75f0f98c5d6e44cfcd6329e9d4c25abc72762359cf373e61c5bcc324d330097acb84d518

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1949988.exe

Filesize
376KB

MD5
521c454311c8b49f82f578f50143ba7d

SHA1
c1e2095ff59e7ece99f047ccc98ea1ceaaca2a83

SHA256
dc953bc996d6b562bb067123dcc55f49c49ba1c8de3271183786dda26eb8c462

SHA512
91dbb670b74d4a34a3eee2d24f6a4b69ea8aefc15be99431bf08d6dd76164d48d4f1c6244f9091d848115eef2888270c9dbfcc58857ada3780b27f2fb65a493d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1949988.exe

Filesize
376KB

MD5
521c454311c8b49f82f578f50143ba7d

SHA1
c1e2095ff59e7ece99f047ccc98ea1ceaaca2a83

SHA256
dc953bc996d6b562bb067123dcc55f49c49ba1c8de3271183786dda26eb8c462

SHA512
91dbb670b74d4a34a3eee2d24f6a4b69ea8aefc15be99431bf08d6dd76164d48d4f1c6244f9091d848115eef2888270c9dbfcc58857ada3780b27f2fb65a493d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c9210403.exe

Filesize
172KB

MD5
3f10f0dbc488803177720c1bd27bfc84

SHA1
1459375fd68e6afdf794488049efcb3f7db12ebc

SHA256
781b90d416a86ba39e38d2f19a9062ba30969f371baa0556401db99a6eb76544

SHA512
ea4b1bb4c49372581130d47968a7ce3277dbec978e34f79e8093e087ca84d98b78d4aa08b0cc871a30974631b3844991d05771ec910a99485d0b679094425b8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c9210403.exe

Filesize
172KB

MD5
3f10f0dbc488803177720c1bd27bfc84

SHA1
1459375fd68e6afdf794488049efcb3f7db12ebc

SHA256
781b90d416a86ba39e38d2f19a9062ba30969f371baa0556401db99a6eb76544

SHA512
ea4b1bb4c49372581130d47968a7ce3277dbec978e34f79e8093e087ca84d98b78d4aa08b0cc871a30974631b3844991d05771ec910a99485d0b679094425b8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1857794.exe

Filesize
221KB

MD5
9de758802fb23cbe1a6f740d4d6ff821

SHA1
5373de93a8966798c1614550d6d09f51e03646c9

SHA256
b67badae9b11000e3fd7ec3fad473cb5f8ab6b0ce4463ff6c0db87f7815f402d

SHA512
1a20a5abdf7e204082b37472ad4a6922271a49a614620c3190376ee659579a724aba8e72356b3eb3b239b3ec88ccb713b9aa28ebddc78b7608b6dc4a6dffa231

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1857794.exe

Filesize
221KB

MD5
9de758802fb23cbe1a6f740d4d6ff821

SHA1
5373de93a8966798c1614550d6d09f51e03646c9

SHA256
b67badae9b11000e3fd7ec3fad473cb5f8ab6b0ce4463ff6c0db87f7815f402d

SHA512
1a20a5abdf7e204082b37472ad4a6922271a49a614620c3190376ee659579a724aba8e72356b3eb3b239b3ec88ccb713b9aa28ebddc78b7608b6dc4a6dffa231

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9186077.exe

Filesize
14KB

MD5
88597f225e335d9ddd7b328360f949b9

SHA1
35c88c95dee904a55c7140fbc27948f795a787d4

SHA256
2b7e210356fa05c1e1b9c364b102668085135909fbf6ef64487abf51b8b7a343

SHA512
25bac7868b86bdc6a1533b39babe79f5a4847fa956204eb12c76beadc663851f5e5f3e89bed637036e209c6c53545db9dd821a05f650487b587c30beb7f0b7d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9186077.exe

Filesize
14KB

MD5
88597f225e335d9ddd7b328360f949b9

SHA1
35c88c95dee904a55c7140fbc27948f795a787d4

SHA256
2b7e210356fa05c1e1b9c364b102668085135909fbf6ef64487abf51b8b7a343

SHA512
25bac7868b86bdc6a1533b39babe79f5a4847fa956204eb12c76beadc663851f5e5f3e89bed637036e209c6c53545db9dd821a05f650487b587c30beb7f0b7d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2154417.exe

Filesize
148KB

MD5
aeb1d56a5fd394d575900d4b1853f770

SHA1
26ae38d98a11e7dcdbce04986dc79dbb2d73e87a

SHA256
fcfcdc22e81670fd0eef763d34211226e6766d32069d29b7d3ce090203fd849c

SHA512
e5a2122ecf7ce79a9fcbcf25c8ed783323c2d023c2b17e7b6e026628f9fa9670d79be4ec94c441c57bda54f8ab38e9b340fe50465ba4537f44a2ed114e213554

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2154417.exe

Filesize
148KB

MD5
aeb1d56a5fd394d575900d4b1853f770

SHA1
26ae38d98a11e7dcdbce04986dc79dbb2d73e87a

SHA256
fcfcdc22e81670fd0eef763d34211226e6766d32069d29b7d3ce090203fd849c

SHA512
e5a2122ecf7ce79a9fcbcf25c8ed783323c2d023c2b17e7b6e026628f9fa9670d79be4ec94c441c57bda54f8ab38e9b340fe50465ba4537f44a2ed114e213554

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
f68df19c793cb755ef159fa5049de3fd

SHA1
f4d8e2761f0dac977a7aaa94ac69fde10d9d3d95

SHA256
216caa50c053d45cc36c27489c3b5fa9b9b9384ebfe85a0fd75d4e9b4750be63

SHA512
730d136d6e59d057ed379d4fbe3f81eae07bb8d083d38695dd9fae6d75f0f98c5d6e44cfcd6329e9d4c25abc72762359cf373e61c5bcc324d330097acb84d518

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
f68df19c793cb755ef159fa5049de3fd

SHA1
f4d8e2761f0dac977a7aaa94ac69fde10d9d3d95

SHA256
216caa50c053d45cc36c27489c3b5fa9b9b9384ebfe85a0fd75d4e9b4750be63

SHA512
730d136d6e59d057ed379d4fbe3f81eae07bb8d083d38695dd9fae6d75f0f98c5d6e44cfcd6329e9d4c25abc72762359cf373e61c5bcc324d330097acb84d518

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
f68df19c793cb755ef159fa5049de3fd

SHA1
f4d8e2761f0dac977a7aaa94ac69fde10d9d3d95

SHA256
216caa50c053d45cc36c27489c3b5fa9b9b9384ebfe85a0fd75d4e9b4750be63

SHA512
730d136d6e59d057ed379d4fbe3f81eae07bb8d083d38695dd9fae6d75f0f98c5d6e44cfcd6329e9d4c25abc72762359cf373e61c5bcc324d330097acb84d518

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
f68df19c793cb755ef159fa5049de3fd

SHA1
f4d8e2761f0dac977a7aaa94ac69fde10d9d3d95

SHA256
216caa50c053d45cc36c27489c3b5fa9b9b9384ebfe85a0fd75d4e9b4750be63

SHA512
730d136d6e59d057ed379d4fbe3f81eae07bb8d083d38695dd9fae6d75f0f98c5d6e44cfcd6329e9d4c25abc72762359cf373e61c5bcc324d330097acb84d518

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

Filesize
208KB

MD5
f68df19c793cb755ef159fa5049de3fd

SHA1
f4d8e2761f0dac977a7aaa94ac69fde10d9d3d95

SHA256
216caa50c053d45cc36c27489c3b5fa9b9b9384ebfe85a0fd75d4e9b4750be63

SHA512
730d136d6e59d057ed379d4fbe3f81eae07bb8d083d38695dd9fae6d75f0f98c5d6e44cfcd6329e9d4c25abc72762359cf373e61c5bcc324d330097acb84d518

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1072-166-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1228-161-0x00000000003C0000-0x00000000003CA000-memory.dmp

Filesize
40KB

Download
memory/2196-177-0x000000000A2B0000-0x000000000A2C2000-memory.dmp

Filesize
72KB

Download
memory/2196-180-0x000000000A620000-0x000000000A696000-memory.dmp

Filesize
472KB

Download
memory/2196-185-0x000000000BC50000-0x000000000BE12000-memory.dmp

Filesize
1.8MB

Download
memory/2196-183-0x000000000AF20000-0x000000000AF86000-memory.dmp

Filesize
408KB

Download
memory/2196-179-0x000000000A310000-0x000000000A34C000-memory.dmp

Filesize
240KB

Download
memory/2196-181-0x000000000AE80000-0x000000000AF12000-memory.dmp

Filesize
584KB

Download
memory/2196-186-0x000000000C350000-0x000000000C87C000-memory.dmp

Filesize
5.2MB

Download
memory/2196-187-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/2196-182-0x000000000B4D0000-0x000000000BA74000-memory.dmp

Filesize
5.6MB

Download
memory/2196-174-0x00000000003F0000-0x0000000000420000-memory.dmp

Filesize
192KB

Download
memory/2196-178-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/2196-188-0x000000000B440000-0x000000000B490000-memory.dmp

Filesize
320KB

Download
memory/2196-176-0x000000000A370000-0x000000000A47A000-memory.dmp

Filesize
1.0MB

Download
memory/2196-175-0x000000000A860000-0x000000000AE78000-memory.dmp

Filesize
6.1MB

Download
memory/3436-212-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/3436-206-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download