redline | 5a4da54758f9a1a86f382cc9808e3f8e925376693555e9f834807ca352ca761c

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2023, 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe
Size

15.3MB
MD5

ef9428407424cc578442727f6fe3bc5e
SHA1

ba6599fbc6a77b1973b1e1b58e2a9cb0655467c0
SHA256

5a4da54758f9a1a86f382cc9808e3f8e925376693555e9f834807ca352ca761c
SHA512

c3a2a5ee6cd269fc86a49e8c5759e24074df0321a1e40c3eff2bedabaec074c253d9a43dfe4a0bfad03f50c8a5c0b70a8151826e77877d26b4e090bcb798e8e6
SSDEEP

393216:CaFCt7regPFRhBfvhIq4zvAkXxj5dbwUWs6QxF6iu:RFcTP7LidzIwHTWlQxoz

Score

10^/10

redline infostealer spyware

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/1004-5-0x0000000000310000-0x000000000036A000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	OpenAndClose.exe

Executes dropped EXE 1 IoCs

pid	Process
2968	OpenAndClose.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2920 set thread context of 1004	2920	SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1004	vbc.exe
1004	vbc.exe
1004	vbc.exe
1004	vbc.exe
1004	vbc.exe
3420	chrome.exe
3420	chrome.exe
1004	vbc.exe
2264	msedge.exe
2264	msedge.exe
1004	vbc.exe
1004	vbc.exe
1524	msedge.exe
1524	msedge.exe
2968	OpenAndClose.exe
2968	OpenAndClose.exe
2968	OpenAndClose.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3420	chrome.exe
3420	chrome.exe
2264	msedge.exe
2264	msedge.exe
3420	chrome.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	vbc.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeDebugPrivilege	2968	OpenAndClose.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1004	2920	SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe	91
PID 2920 wrote to memory of 1004	2920	SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe	91
PID 2920 wrote to memory of 1004	2920	SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe	91
PID 2920 wrote to memory of 1004	2920	SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe	91
PID 2920 wrote to memory of 1004	2920	SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe	91
PID 2920 wrote to memory of 1004	2920	SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe	91
PID 2920 wrote to memory of 1004	2920	SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe	91
PID 2920 wrote to memory of 1004	2920	SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe	91
PID 2920 wrote to memory of 2968	2920	SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe	92
PID 2920 wrote to memory of 2968	2920	SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe	92
PID 2920 wrote to memory of 2968	2920	SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe	92
PID 2968 wrote to memory of 3420	2968	OpenAndClose.exe	94
PID 2968 wrote to memory of 3420	2968	OpenAndClose.exe	94
PID 3420 wrote to memory of 4332	3420	chrome.exe	95
PID 3420 wrote to memory of 4332	3420	chrome.exe	95
PID 2968 wrote to memory of 2264	2968	OpenAndClose.exe	96
PID 2968 wrote to memory of 2264	2968	OpenAndClose.exe	96
PID 2264 wrote to memory of 1636	2264	msedge.exe	97
PID 2264 wrote to memory of 1636	2264	msedge.exe	97
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 4284	3420	chrome.exe	98
PID 3420 wrote to memory of 3392	3420	chrome.exe	100
PID 3420 wrote to memory of 3392	3420	chrome.exe	100
PID 3420 wrote to memory of 3340	3420	chrome.exe	99
PID 3420 wrote to memory of 3340	3420	chrome.exe	99
PID 3420 wrote to memory of 3340	3420	chrome.exe	99
PID 3420 wrote to memory of 3340	3420	chrome.exe	99
PID 3420 wrote to memory of 3340	3420	chrome.exe	99

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1004
- C:\Users\Admin\AppData\Local\Temp\OpenAndClose.exe
  "C:\Users\Admin\AppData\Local\Temp\OpenAndClose.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce3639758,0x7ffce3639768,0x7ffce3639778
      4⤵
      PID:4332
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:2
      4⤵
      PID:4284
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:8
      4⤵
      PID:3340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:8
      4⤵
      PID:3392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:1
      4⤵
      PID:2848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:1
      4⤵
      PID:824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4692 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:1
      4⤵
      PID:5216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4708 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:8
      4⤵
      PID:5248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4952 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:8
      4⤵
      PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce34f46f8,0x7ffce34f4708,0x7ffce34f4718
      4⤵
      PID:1636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,13662402396061750596,11109330212072216188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,13662402396061750596,11109330212072216188,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
      4⤵
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,13662402396061750596,11109330212072216188,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13662402396061750596,11109330212072216188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13662402396061750596,11109330212072216188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      PID:1228

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
22663c19d825e1a1223480b84769be14

SHA1
b46ed533a7cd8368af4ba4b757ad6c478e48cc5c

SHA256
7e327c2d62ae264902924c5db403012c56f26ede1e9ce65053aa17c4014bb6c7

SHA512
fe80b4ff6828f20086305773509f456476ea0ff6d07d1c14721d2d3de09c6cfddf8558fb40de602d3e0405631664e8761daf0d41d5bb8171495ba0d0e39f22c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\OpenAndClose.exe

Filesize
14.9MB

MD5
ce79be6531d3f05b0f3dfabb846acb71

SHA1
218e07e6a6f89c46015883a0e385576a834e776e

SHA256
51ce4a95c911798a4d7a0cd7b16a68509d4b171cf3e4b8281cd46517d1f2e61c

SHA512
d27795741e6eb565a4fd132c0695ae5163f64adfb875451023f5ee880af5ea5082744137240a3d324dd6041753bf1198ffc328eb75f0283d3f4d19790a4e68a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\OpenAndClose.exe

Filesize
14.9MB

MD5
ce79be6531d3f05b0f3dfabb846acb71

SHA1
218e07e6a6f89c46015883a0e385576a834e776e

SHA256
51ce4a95c911798a4d7a0cd7b16a68509d4b171cf3e4b8281cd46517d1f2e61c

SHA512
d27795741e6eb565a4fd132c0695ae5163f64adfb875451023f5ee880af5ea5082744137240a3d324dd6041753bf1198ffc328eb75f0283d3f4d19790a4e68a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\OpenAndClose.exe

Filesize
14.9MB

MD5
ce79be6531d3f05b0f3dfabb846acb71

SHA1
218e07e6a6f89c46015883a0e385576a834e776e

SHA256
51ce4a95c911798a4d7a0cd7b16a68509d4b171cf3e4b8281cd46517d1f2e61c

SHA512
d27795741e6eb565a4fd132c0695ae5163f64adfb875451023f5ee880af5ea5082744137240a3d324dd6041753bf1198ffc328eb75f0283d3f4d19790a4e68a1

Download Submit
memory/1004-9-0x0000000007470000-0x000000000747A000-memory.dmp

Filesize
40KB

Download
memory/1004-37-0x0000000008F40000-0x0000000008F5E000-memory.dmp

Filesize
120KB

Download
memory/1004-88-0x00000000749F0000-0x00000000751A0000-memory.dmp

Filesize
7.7MB

Download
memory/1004-10-0x00000000083A0000-0x00000000089B8000-memory.dmp

Filesize
6.1MB

Download
memory/1004-11-0x0000000007540000-0x0000000007552000-memory.dmp

Filesize
72KB

Download
memory/1004-12-0x0000000007670000-0x000000000777A000-memory.dmp

Filesize
1.0MB

Download
memory/1004-14-0x00000000075A0000-0x00000000075DC000-memory.dmp

Filesize
240KB

Download
memory/1004-7-0x00000000072C0000-0x0000000007352000-memory.dmp

Filesize
584KB

Download
memory/1004-16-0x00000000075E0000-0x000000000762C000-memory.dmp

Filesize
304KB

Download
memory/1004-6-0x00000000749F0000-0x00000000751A0000-memory.dmp

Filesize
7.7MB

Download
memory/1004-5-0x0000000000310000-0x000000000036A000-memory.dmp

Filesize
360KB

Download
memory/1004-75-0x0000000004EA0000-0x0000000004EF0000-memory.dmp

Filesize
320KB

Download
memory/1004-8-0x00000000074A0000-0x00000000074B0000-memory.dmp

Filesize
64KB

Download
memory/1004-34-0x0000000009730000-0x0000000009C5C000-memory.dmp

Filesize
5.2MB

Download
memory/1004-29-0x0000000007E80000-0x0000000007EE6000-memory.dmp

Filesize
408KB

Download
memory/1004-31-0x0000000008DE0000-0x0000000008E56000-memory.dmp

Filesize
472KB

Download
memory/1004-33-0x0000000009030000-0x00000000091F2000-memory.dmp

Filesize
1.8MB

Download
memory/2920-3-0x0000000006590000-0x00000000065A0000-memory.dmp

Filesize
64KB

Download
memory/2920-2-0x0000000006A10000-0x0000000006FB4000-memory.dmp

Filesize
5.6MB

Download
memory/2920-1-0x0000000000C00000-0x0000000001B4A000-memory.dmp

Filesize
15.3MB

Download
memory/2920-27-0x00000000749F0000-0x00000000751A0000-memory.dmp

Filesize
7.7MB

Download
memory/2920-0-0x00000000749F0000-0x00000000751A0000-memory.dmp

Filesize
7.7MB

Download
memory/2968-32-0x0000000005A70000-0x0000000005A80000-memory.dmp

Filesize
64KB

Download
memory/2968-28-0x00000000002C0000-0x00000000011A8000-memory.dmp

Filesize
14.9MB

Download
memory/2968-26-0x00000000749F0000-0x00000000751A0000-memory.dmp

Filesize
7.7MB

Download
memory/2968-86-0x00000000749F0000-0x00000000751A0000-memory.dmp

Filesize
7.7MB

Download