nullmixer | f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be

Analysis

max time kernel
37s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be.exe
Size 5.5MB
Sample240107-w8jghacfg7
SHA256 f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be
MD5 0a313a73aac1905c6ef571c4e700554a
SHA1 7f2e2d4656ae4a5e6015c51184e19ef26510fb12
SHA512 b8323f01a915c1e28d9926a07518c798546ab12aa8d8c1038c9f18973beab78fda972aaea1b7a0814b6c3efa0847ee2f89ccc3abfa8bcc239eb12a36a069b576
SSDEEP 98304:xorRBQQyUroZi+nTf55/2UJ70UsjVk+io3McLpN3SQXB/uz7h4sWsjFe5qx:xorR3rETfjB70Ush9io3MeDOl4sW8+qx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nullmixer redline sectoprat vidar 706 pab777 aspackv2 dropper infostealer rat stealer trojan

Malware Config

Extracted

Family

redline

Botnet

pab777

185.215.113.15:6043

Extracted

Family

vidar

Version

40.3

Botnet

https://lenko349.tumblr.com/

Attributes

profile_id
706

Extracted

Family

nullmixer

http://hsiens.xyz/

Signatures

NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/4236-151-0x0000000003C30000-0x0000000003C56000-memory.dmp	family_redline
behavioral2/memory/4236-174-0x0000000003D50000-0x0000000003D74000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/4236-151-0x0000000003C30000-0x0000000003C56000-memory.dmp	family_sectoprat
behavioral2/memory/4236-174-0x0000000003D50000-0x0000000003D74000-memory.dmp	family_sectoprat

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/2896-176-0x0000000003EF0000-0x0000000003FC3000-memory.dmp	family_vidar
behavioral2/memory/2896-182-0x0000000000400000-0x00000000021D9000-memory.dmp	family_vidar
behavioral2/memory/2896-205-0x0000000000400000-0x00000000021D9000-memory.dmp	family_vidar

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0006000000023205-22.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	e6e22792e2586e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	Wed1723a697f7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	Wed17f6f9bbb339c2.exe

Executes dropped EXE 15 IoCs

pid	Process
4784	setup_install.exe
2516	e6e22792e2586e.exe
3692	setup_install.exe
2420	Wed1744842952dc03a.exe
3736	WerFault.exe
2784	Wed1714d285085.exe
2896	Wed17d4eac5c83e204dc.exe
1216	Wed17f6f9bbb339c2.exe
4236	Wed17dff1d3c799e.exe
1768	Wed171b4c251d7.exe
3776	Wed1785e69fa9997.exe
3216	Wed1723a697f7.exe
440	Wed1714d285085.tmp
2644	KiffApp2.exe
3224	Wed17f6f9bbb339c2.exe

Loads dropped DLL 11 IoCs

pid	Process
4784	setup_install.exe
4784	setup_install.exe
4784	setup_install.exe
4784	setup_install.exe
3692	setup_install.exe
3692	setup_install.exe
3692	setup_install.exe
3692	setup_install.exe
3692	setup_install.exe
3692	setup_install.exe
440	Wed1714d285085.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 17 IoCs

pid	pid_target	Process	procid_target
1928	3692	WerFault.exe	96
4232	2896	WerFault.exe	109
5244	2896	WerFault.exe	109
5448	2896	WerFault.exe	109
5544	2896	WerFault.exe	109
5704	2896	WerFault.exe	109
5908	2896	WerFault.exe	109
5284	2896	WerFault.exe	109
5756	2896	WerFault.exe	109
5728	2896	WerFault.exe	109
3036	2896	WerFault.exe	109
5256	2896	WerFault.exe	109
6088	2896	WerFault.exe	109
4040	2896	WerFault.exe	109
5360	2896	WerFault.exe	109
5380	2896	WerFault.exe	109
564	2896	WerFault.exe	109

Kills process with taskkill 1 IoCs

evasion

pid	Process
6032	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4840	powershell.exe
4840	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	Wed1744842952dc03a.exe
Token: SeDebugPrivilege	3736	WerFault.exe
Token: SeDebugPrivilege	4840	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4784	4884	f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be.exe	91
PID 4884 wrote to memory of 4784	4884	f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be.exe	91
PID 4884 wrote to memory of 4784	4884	f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be.exe	91
PID 4784 wrote to memory of 4392	4784	setup_install.exe	94
PID 4784 wrote to memory of 4392	4784	setup_install.exe	94
PID 4784 wrote to memory of 4392	4784	setup_install.exe	94
PID 4392 wrote to memory of 2516	4392	cmd.exe	95
PID 4392 wrote to memory of 2516	4392	cmd.exe	95
PID 4392 wrote to memory of 2516	4392	cmd.exe	95
PID 2516 wrote to memory of 3692	2516	e6e22792e2586e.exe	96
PID 2516 wrote to memory of 3692	2516	e6e22792e2586e.exe	96
PID 2516 wrote to memory of 3692	2516	e6e22792e2586e.exe	96
PID 3692 wrote to memory of 4112	3692	setup_install.exe	108
PID 3692 wrote to memory of 4112	3692	setup_install.exe	108
PID 3692 wrote to memory of 4112	3692	setup_install.exe	108
PID 3692 wrote to memory of 3408	3692	setup_install.exe	107
PID 3692 wrote to memory of 3408	3692	setup_install.exe	107
PID 3692 wrote to memory of 3408	3692	setup_install.exe	107
PID 3692 wrote to memory of 2632	3692	setup_install.exe	106
PID 3692 wrote to memory of 2632	3692	setup_install.exe	106
PID 3692 wrote to memory of 2632	3692	setup_install.exe	106
PID 3692 wrote to memory of 3056	3692	setup_install.exe	105
PID 3692 wrote to memory of 3056	3692	setup_install.exe	105
PID 3692 wrote to memory of 3056	3692	setup_install.exe	105
PID 3692 wrote to memory of 748	3692	setup_install.exe	104
PID 3692 wrote to memory of 748	3692	setup_install.exe	104
PID 3692 wrote to memory of 748	3692	setup_install.exe	104
PID 3692 wrote to memory of 4108	3692	setup_install.exe	103
PID 3692 wrote to memory of 4108	3692	setup_install.exe	103
PID 3692 wrote to memory of 4108	3692	setup_install.exe	103
PID 3692 wrote to memory of 964	3692	setup_install.exe	102
PID 3692 wrote to memory of 964	3692	setup_install.exe	102
PID 3692 wrote to memory of 964	3692	setup_install.exe	102
PID 3692 wrote to memory of 2884	3692	setup_install.exe	101
PID 3692 wrote to memory of 2884	3692	setup_install.exe	101
PID 3692 wrote to memory of 2884	3692	setup_install.exe	101
PID 3692 wrote to memory of 2360	3692	setup_install.exe	100
PID 3692 wrote to memory of 2360	3692	setup_install.exe	100
PID 3692 wrote to memory of 2360	3692	setup_install.exe	100
PID 3692 wrote to memory of 3428	3692	setup_install.exe	99
PID 3692 wrote to memory of 3428	3692	setup_install.exe	99
PID 3692 wrote to memory of 3428	3692	setup_install.exe	99
PID 3428 wrote to memory of 2420	3428	cmd.exe	98
PID 3428 wrote to memory of 2420	3428	cmd.exe	98
PID 2884 wrote to memory of 3736	2884	cmd.exe	176
PID 2884 wrote to memory of 3736	2884	cmd.exe	176
PID 4108 wrote to memory of 2784	4108	cmd.exe	123
PID 4108 wrote to memory of 2784	4108	cmd.exe	123
PID 4108 wrote to memory of 2784	4108	cmd.exe	123
PID 748 wrote to memory of 2896	748	cmd.exe	109
PID 748 wrote to memory of 2896	748	cmd.exe	109
PID 748 wrote to memory of 2896	748	cmd.exe	109
PID 3408 wrote to memory of 1216	3408	cmd.exe	111
PID 3408 wrote to memory of 1216	3408	cmd.exe	111
PID 3408 wrote to memory of 1216	3408	cmd.exe	111
PID 3056 wrote to memory of 3216	3056	cmd.exe	110
PID 3056 wrote to memory of 3216	3056	cmd.exe	110
PID 3056 wrote to memory of 3216	3056	cmd.exe	110
PID 2360 wrote to memory of 4236	2360	cmd.exe	122
PID 2360 wrote to memory of 4236	2360	cmd.exe	122
PID 2360 wrote to memory of 4236	2360	cmd.exe	122
PID 2632 wrote to memory of 1768	2632	cmd.exe	121
PID 2632 wrote to memory of 1768	2632	cmd.exe	121
PID 964 wrote to memory of 3776	964	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be.exe
"C:\Users\Admin\AppData\Local\Temp\f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\7zS4137D5D7\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS4137D5D7\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\e6e22792e2586e.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\e6e22792e2586e.exe
      C:\Users\Admin\AppData\Local\Temp\e6e22792e2586e.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\7zS4D9FE597\setup_install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS4D9FE597\setup_install.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3692
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed1744842952dc03a.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3428
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed17dff1d3c799e.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D9FE597\Wed17dff1d3c799e.exe
        
        Wed17dff1d3c799e.exe
        7⤵
        Executes dropped EXE
        
        PID:4236
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed17f15b7389c9ebf74.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D9FE597\Wed17f15b7389c9ebf74.exe
        
        Wed17f15b7389c9ebf74.exe
        7⤵
        
        PID:3736
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed1785e69fa9997.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D9FE597\Wed1785e69fa9997.exe
        
        Wed1785e69fa9997.exe
        7⤵
        Executes dropped EXE
        
        PID:3776
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed1714d285085.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D9FE597\Wed1714d285085.exe
        
        Wed1714d285085.exe
        7⤵
        Executes dropped EXE
        
        PID:2784
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed17d4eac5c83e204dc.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D9FE597\Wed17d4eac5c83e204dc.exe
        
        Wed17d4eac5c83e204dc.exe
        7⤵
        Executes dropped EXE
        
        PID:2896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 824
        8⤵
        Program crash
        
        PID:4232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 832
        8⤵
        Program crash
        
        PID:5244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 832
        8⤵
        Program crash
        
        PID:5448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 884
        8⤵
        Program crash
        
        PID:5544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1040
        8⤵
        Program crash
        
        PID:5704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1072
        8⤵
        Program crash
        
        PID:5908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1528
        8⤵
        Program crash
        
        PID:5284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1536
        8⤵
        Program crash
        
        PID:5756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1780
        8⤵
        Program crash
        
        PID:5728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1528
        8⤵
        Program crash
        
        PID:3036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1636
        8⤵
        Program crash
        
        PID:5256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1572
        8⤵
        Program crash
        
        PID:6088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1536
        8⤵
        Program crash
        
        PID:4040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1568
        8⤵
        Program crash
        
        PID:5360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1768
        8⤵
        Program crash
        
        PID:5380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1028
        8⤵
        Program crash
        
        PID:564
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed1723a697f7.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D9FE597\Wed1723a697f7.exe
        
        Wed1723a697f7.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\KiffApp2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KiffApp2.exe"
        8⤵
        Executes dropped EXE
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx_123_400.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx_123_400.exe"
        8⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCRIpt: ClOSe ( CreateObjECT ("wScRipT.shELL" ).RUN( "cMd.Exe /C COpY /Y ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx_123_400.exe"" RXaoSBVaB48N.EXE && STArt rXAOSBVaB48N.eXe -pxPQlPgRn5on8guKmOCBOu43B3pp & IF """" == """" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx_123_400.exe"") do taskkill -f /iM ""%~NxU"" " , 0, true ) )
        9⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C COpY /Y "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx_123_400.exe" RXaoSBVaB48N.EXE &&STArt rXAOSBVaB48N.eXe -pxPQlPgRn5on8guKmOCBOu43B3pp &IF ""== "" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx_123_400.exe") do taskkill -f /iM "%~NxU"
        10⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f /iM "sfx_123_400.exe"
        11⤵
        Kills process with taskkill
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\RXaoSBVaB48N.EXE
        
        rXAOSBVaB48N.eXe -pxPQlPgRn5on8guKmOCBOu43B3pp
        11⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCRIpt: ClOSe ( CreateObjECT ("wScRipT.shELL" ).RUN( "cMd.Exe /C COpY /Y ""C:\Users\Admin\AppData\Local\Temp\RXaoSBVaB48N.EXE"" RXaoSBVaB48N.EXE && STArt rXAOSBVaB48N.eXe -pxPQlPgRn5on8guKmOCBOu43B3pp & IF ""-pxPQlPgRn5on8guKmOCBOu43B3pp "" == """" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\RXaoSBVaB48N.EXE"") do taskkill -f /iM ""%~NxU"" " , 0, true ) )
        12⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C COpY /Y "C:\Users\Admin\AppData\Local\Temp\RXaoSBVaB48N.EXE" RXaoSBVaB48N.EXE &&STArt rXAOSBVaB48N.eXe -pxPQlPgRn5on8guKmOCBOu43B3pp &IF "-pxPQlPgRn5on8guKmOCBOu43B3pp "== "" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\RXaoSBVaB48N.EXE") do taskkill -f /iM "%~NxU"
        13⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBscRiPt: cLosE ( creAteobJeCt("wscRipt.SHELl" ). ruN ( "C:\Windows\system32\cmd.exe /c ecHO pBhbW%RAndOM%TnnNS> aG7MmI.P & echo | sET /p = ""MZ"" > uOH8GEC.Q2E& cOpy /B /Y UOH8GEc.Q2e+ MGVIEEBN.0q +J5RzO_.K +5UOzIXT.U1 +Z9GHFgs.rZ + GfJk.jd + DzxbB.S +aG7MmI.P yiPcZyP.u_M &stArT rundll32 .\yiPCZyP.U_M,VaJzNs " , 0, tRUe ))
        12⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ecHO pBhbW%RAndOM%TnnNS> aG7MmI.P & echo | sET /p = "MZ" > uOH8GEC.Q2E& cOpy /B /Y UOH8GEc.Q2e+ MGVIEEBN.0q +J5RzO_.K +5UOzIXT.U1+Z9GHFgs.rZ+ GfJk.jd +DzxbB.S +aG7MmI.P yiPcZyP.u_M &stArT rundll32 .\yiPCZyP.U_M,VaJzNs
        13⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 .\yiPCZyP.U_M,VaJzNs
        14⤵
        
        PID:5688
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed171b4c251d7.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D9FE597\Wed171b4c251d7.exe
        
        Wed171b4c251d7.exe
        7⤵
        Executes dropped EXE
        
        PID:1768
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed17f6f9bbb339c2.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D9FE597\Wed17f6f9bbb339c2.exe
        
        Wed17f6f9bbb339c2.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D9FE597\Wed17f6f9bbb339c2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS4D9FE597\Wed17f6f9bbb339c2.exe" -u
        8⤵
        Executes dropped EXE
        
        PID:3224
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        6⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4840
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 584
        6⤵
        Program crash
        
        PID:1928

C:\Users\Admin\AppData\Local\Temp\7zS4D9FE597\Wed1744842952dc03a.exe
Wed1744842952dc03a.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3692 -ip 3692
1⤵
PID:4532

C:\Users\Admin\AppData\Local\Temp\is-0CVFS.tmp\Wed1714d285085.tmp
"C:\Users\Admin\AppData\Local\Temp\is-0CVFS.tmp\Wed1714d285085.tmp" /SL5="$C003C,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS4D9FE597\Wed1714d285085.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2896 -ip 2896
1⤵
PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2896 -ip 2896
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2896 -ip 2896
1⤵
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2896 -ip 2896
1⤵
PID:5496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2896 -ip 2896
1⤵
PID:5684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2896 -ip 2896
1⤵
PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2896 -ip 2896
1⤵
PID:5228

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" sET /p = "MZ" 1>uOH8GEC.Q2E"
1⤵
PID:5600

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo "
1⤵
PID:5400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2896 -ip 2896
1⤵
PID:5556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2896 -ip 2896
1⤵
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2896 -ip 2896
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2896 -ip 2896
1⤵
PID:5856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2896 -ip 2896
1⤵
PID:6132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2896 -ip 2896
1⤵
PID:5216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2896 -ip 2896
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2896 -ip 2896
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2896 -ip 2896
1⤵
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS4137D5D7\libwinpthread-1.dll
Size 69KB
SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
MD5 1e0d62c34ff2e649ebc5c372065732ee
SHA1 fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA512 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
SSDEEP 1536:xPCESXKWzkxTz8uLfdkWr2sUX8YNKykl1wwwwUXrMZE4cYdz:x6baWwxH8EzSHYZE4cYdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

libzip.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS4137D5D7\libzip.dll
Size 65KB
SHA256 e186cf97d768a139819278c4ce35e6df65adb2bdaee450409994d4c7c8d7c723
MD5 81d6f0a42171755753e3bc9b48f43c30
SHA1 b766d96e38e151a6a51d72e753fb92687e8f9d03
SHA512 461bf23b1ec98d97281fd55308d1384a3f471d0a4b2e68c2a81a98346db9edc3ca2b8dbeb68ae543796f73cc04900ec298554b7ff837db0241863a157b43cda1
SSDEEP 1536:xJXBgdJNQLbamrtAJeYQq1qQLclqDFGTiUjF:xJX2gmmZArx1awUTj
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup_install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4137D5D7\setup_install.exe
Size 381KB
SHA256 725bac92838088f3c97529b03055a53c43ce2cda5a9c462ba9aebc638910e402
MD5 9057f720086bda3f14e3c4e5a452df30
SHA1 705f16f39e30fb560719d354b6573eb6c7924261
SHA512 888f8332398250f465706f2dbe79cbecc83c1e18703e0f094b6fdd67e8371f145a1749f4be2b794a2fa60ab0d8827b806876c5faa6990cceca0fa446d8429dc2
SSDEEP 6144:fsREdwGKQeNIDcY5Y4ZgEZj8LSPgzx87os0WC/VGBL:ERYkLY5Y4hZj8eUsg/g
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup_install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4137D5D7\setup_install.exe
Size 136KB
SHA256 1fb0a34906114eb8d4a37f3213acb03e9a6243003d714d39c2af284c11830125
MD5 55e85e245204a34bb2684eadb54e1fb4
SHA1 b1b1d154e4962d365063ee690ad01e2dfc23b3b4
SHA512 7c31d72e28e5c6f279a8a47cce3caef31bcfb1f277e7791df7beb2813b7ba4316d6b0cdce9809ca1310119950319e19af1551c2203d52640381c1f0fe5c7143e
SSDEEP 3072:Hqq3zNlKREdNq3XGPlslS3uVmqpIDcY5YICeO2:fsREdwGKQeNIDcY5Yc
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup_install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4137D5D7\setup_install.exe
Size 207KB
SHA256 d85d7a76ba86caff907d2d29ed9b34ee6a71b2a9ff93199d8ff02e5bd3e9b531
MD5 da4e9190e47228912f68b068fa59f881
SHA1 77eb934a7919cc18e1f627bbf27bb8cf6ad65dbc
SHA512 bd1c57252402cd53d0cd5356bb7917b2bff41237d51e8adc1a9f585ad1f9d9d0d238edf831e1c6ced5298cb5210cd709fd5730ad7aa62cbeed459f97eb8840cf
SSDEEP 3072:Hqq3zNlKREdNq3XGPlslS3uVmqpIDcY5YICeO24Ef411CXZg4OEIKje:fsREdwGKQeNIDcY5Y4ZgEZje
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/440-183-0x0000000000780000-0x0000000000781000-memory.dmp

Download

memory/440-198-0x0000000000400000-0x0000000000516000-memory.dmp

Download

memory/1768-145-0x00007FFE7D550000-0x00007FFE7E011000-memory.dmp

Download

memory/1768-252-0x00000244A0D80000-0x00000244A0D90000-memory.dmp

Download

memory/1768-220-0x00000244A3980000-0x00000244A3A04000-memory.dmp

Download

memory/1768-281-0x00007FFE7D550000-0x00007FFE7E011000-memory.dmp

Download

memory/1768-132-0x0000024486630000-0x00000244867B8000-memory.dmp

Download

memory/1768-250-0x00000244A0D80000-0x00000244A0D90000-memory.dmp

Download

memory/1768-251-0x00000244A0D80000-0x00000244A0D90000-memory.dmp

Download

memory/1768-166-0x00000244A0D80000-0x00000244A0D90000-memory.dmp

Download

memory/1768-134-0x0000024488380000-0x0000024488390000-memory.dmp

Download

memory/2420-186-0x00007FFE7D550000-0x00007FFE7E011000-memory.dmp

Download

memory/2420-165-0x0000000002FF0000-0x0000000003000000-memory.dmp

Download

memory/2420-130-0x0000000000EE0000-0x0000000000EE8000-memory.dmp

Download

memory/2644-188-0x00007FFE7D550000-0x00007FFE7E011000-memory.dmp

Download

memory/2644-249-0x000000001BB10000-0x000000001BB20000-memory.dmp

Download

memory/2644-175-0x0000000000700000-0x000000000071A000-memory.dmp

Download

memory/2644-270-0x00007FFE7D550000-0x00007FFE7E011000-memory.dmp

Download

memory/2784-127-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2784-201-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2896-182-0x0000000000400000-0x00000000021D9000-memory.dmp

Download

memory/2896-172-0x00000000023E0000-0x00000000024E0000-memory.dmp

Download

memory/2896-176-0x0000000003EF0000-0x0000000003FC3000-memory.dmp

Download

memory/2896-205-0x0000000000400000-0x00000000021D9000-memory.dmp

Download

memory/3692-94-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/3692-104-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3692-262-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/3692-266-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/3692-268-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3692-267-0x000000006EB40000-0x000000006EB63000-memory.dmp

Download

memory/3692-265-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/3692-264-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/3692-189-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/3692-190-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/3692-95-0x00000000007F0000-0x000000000087F000-memory.dmp

Download

memory/3692-98-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/3692-191-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/3692-99-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3692-192-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/3692-193-0x000000006EB40000-0x000000006EB63000-memory.dmp

Download

memory/3692-194-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3692-100-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/3692-97-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/3692-96-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/3692-102-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3692-90-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/3692-103-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3692-105-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/3692-101-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3692-106-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/3736-187-0x000000001B9C0000-0x000000001B9D0000-memory.dmp

Download

memory/3736-131-0x0000000000CD0000-0x0000000000CFC000-memory.dmp

Download

memory/3736-137-0x0000000001390000-0x00000000013B0000-memory.dmp

Download

memory/3736-135-0x00007FFE7D550000-0x00007FFE7E011000-memory.dmp

Download

memory/3736-218-0x00007FFE7D550000-0x00007FFE7E011000-memory.dmp

Download

memory/4236-219-0x0000000003C50000-0x0000000003C60000-memory.dmp

Download

memory/4236-151-0x0000000003C30000-0x0000000003C56000-memory.dmp

Download

memory/4236-181-0x0000000003C50000-0x0000000003C60000-memory.dmp

Download

memory/4236-180-0x0000000072930000-0x00000000730E0000-memory.dmp

Download

memory/4236-179-0x0000000000400000-0x0000000001D9A000-memory.dmp

Download

memory/4236-177-0x00000000020D0000-0x00000000021D0000-memory.dmp

Download

memory/4236-178-0x0000000001F00000-0x0000000001F30000-memory.dmp

Download

memory/4236-221-0x00000000040A0000-0x00000000040DC000-memory.dmp

Download

memory/4236-224-0x0000000007170000-0x00000000071BC000-memory.dmp

Download

memory/4236-200-0x0000000006A40000-0x0000000007058000-memory.dmp

Download

memory/4236-184-0x0000000003C50000-0x0000000003C60000-memory.dmp

Download

memory/4236-202-0x0000000004080000-0x0000000004092000-memory.dmp

Download

memory/4236-203-0x0000000007060000-0x000000000716A000-memory.dmp

Download

memory/4236-174-0x0000000003D50000-0x0000000003D74000-memory.dmp

Download

memory/4236-185-0x0000000003C50000-0x0000000003C60000-memory.dmp

Download

memory/4236-169-0x0000000006490000-0x0000000006A34000-memory.dmp

Download

memory/4784-39-0x0000000061B80000-0x0000000061B98000-memory.dmp

Download

memory/4784-40-0x000000006EB40000-0x000000006EB63000-memory.dmp

Download

memory/4784-38-0x0000000061880000-0x00000000618B7000-memory.dmp

Download

memory/4784-29-0x0000000061880000-0x00000000618B7000-memory.dmp

Download

memory/4784-36-0x0000000000400000-0x00000000009B5000-memory.dmp

Download

memory/4784-31-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/4784-37-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/4784-27-0x0000000061880000-0x00000000618B7000-memory.dmp

Download

memory/4784-28-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/4784-30-0x0000000061880000-0x00000000618B7000-memory.dmp

Download

memory/4840-217-0x0000000005D30000-0x0000000005D96000-memory.dmp

Download

memory/4840-225-0x0000000005DA0000-0x00000000060F4000-memory.dmp

Download

memory/4840-144-0x00000000053E0000-0x0000000005A08000-memory.dmp

Download

memory/4840-157-0x0000000072930000-0x00000000730E0000-memory.dmp

Download

memory/4840-136-0x0000000002B20000-0x0000000002B56000-memory.dmp

Download

memory/4840-263-0x00000000061A0000-0x00000000061BE000-memory.dmp

Download

memory/4840-207-0x0000000005A10000-0x0000000005A76000-memory.dmp

Download

memory/4840-269-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Download

memory/4840-199-0x0000000005240000-0x0000000005262000-memory.dmp

Download

memory/4840-279-0x00000000066D0000-0x0000000006702000-memory.dmp

Download

memory/4840-278-0x000000007F6F0000-0x000000007F700000-memory.dmp

Download

memory/4840-291-0x00000000066B0000-0x00000000066CE000-memory.dmp

Download

memory/4840-280-0x000000006E220000-0x000000006E26C000-memory.dmp

Download

memory/4840-168-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Download

memory/5688-348-0x0000000002820000-0x0000000002B38000-memory.dmp

Download

memory/5688-353-0x0000000003650000-0x00000000036FF000-memory.dmp

Download

memory/5688-354-0x0000000003710000-0x00000000037AB000-memory.dmp

Download

memory/5688-355-0x0000000003710000-0x00000000037AB000-memory.dmp

Download

memory/5688-357-0x0000000003710000-0x00000000037AB000-memory.dmp

Download

memory/5688-360-0x0000000003710000-0x00000000037AB000-memory.dmp

Download

memory/5688-362-0x0000000002820000-0x0000000002B38000-memory.dmp

Download