redline | 6fe100707f04edd5edab46ab148ba902e609a418d6e29fe3dddda0a8a5bb2fd9

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
99e98c0d5122c38e1fc3885092111fff.exe
Size 630KB
Sample240213-xtsmashb64
SHA256 6fe100707f04edd5edab46ab148ba902e609a418d6e29fe3dddda0a8a5bb2fd9
MD5 99e98c0d5122c38e1fc3885092111fff
SHA1 93afab714d86aa97cc706a0726cf7bcec36cdf07
SHA512 bb09750d243928f396c1c330788d34c842b0dc5944e6ee40489531e818a92dfc958a97ccde8066058ddd2dd9767e4b8b6d4f1bba831942baa665a0d4b16f0cd9
SSDEEP 12288:ZClXHzC7b94xVEXTVp4D6Owv3cEShbRh+MPjCa7jhxTGUZWds/C8vifHyd+:EdoHP4DRx7V+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline sectoprat 29.08 infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

29.08

95.181.152.47:15089

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/3872-5-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/3872-5-0x0000000000400000-0x0000000000422000-memory.dmp	family_sectoprat
behavioral2/memory/2304-69-0x00000000052F0000-0x0000000005300000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 30 IoCs

description	pid	Process	procid_target
PID 1676 set thread context of 3872	1676	99e98c0d5122c38e1fc3885092111fff.exe	85
PID 1676 set thread context of 2380	1676	99e98c0d5122c38e1fc3885092111fff.exe	86
PID 1676 set thread context of 3524	1676	99e98c0d5122c38e1fc3885092111fff.exe	92
PID 1676 set thread context of 2548	1676	99e98c0d5122c38e1fc3885092111fff.exe	97
PID 1676 set thread context of 788	1676	99e98c0d5122c38e1fc3885092111fff.exe	98
PID 1676 set thread context of 4340	1676	99e98c0d5122c38e1fc3885092111fff.exe	99
PID 1676 set thread context of 1376	1676	99e98c0d5122c38e1fc3885092111fff.exe	100
PID 1676 set thread context of 1416	1676	99e98c0d5122c38e1fc3885092111fff.exe	101
PID 1676 set thread context of 4012	1676	99e98c0d5122c38e1fc3885092111fff.exe	104
PID 1676 set thread context of 2304	1676	99e98c0d5122c38e1fc3885092111fff.exe	105
PID 1676 set thread context of 2280	1676	99e98c0d5122c38e1fc3885092111fff.exe	106
PID 1676 set thread context of 4292	1676	99e98c0d5122c38e1fc3885092111fff.exe	113
PID 1676 set thread context of 600	1676	99e98c0d5122c38e1fc3885092111fff.exe	114
PID 1676 set thread context of 1868	1676	99e98c0d5122c38e1fc3885092111fff.exe	115
PID 1676 set thread context of 3968	1676	99e98c0d5122c38e1fc3885092111fff.exe	116
PID 1676 set thread context of 2860	1676	99e98c0d5122c38e1fc3885092111fff.exe	118
PID 1676 set thread context of 3880	1676	99e98c0d5122c38e1fc3885092111fff.exe	121
PID 1676 set thread context of 2916	1676	99e98c0d5122c38e1fc3885092111fff.exe	122
PID 1676 set thread context of 2572	1676	99e98c0d5122c38e1fc3885092111fff.exe	127
PID 1676 set thread context of 4212	1676	99e98c0d5122c38e1fc3885092111fff.exe	128
PID 1676 set thread context of 4848	1676	99e98c0d5122c38e1fc3885092111fff.exe	129
PID 1676 set thread context of 3088	1676	99e98c0d5122c38e1fc3885092111fff.exe	130
PID 1676 set thread context of 2476	1676	99e98c0d5122c38e1fc3885092111fff.exe	131
PID 1676 set thread context of 4180	1676	99e98c0d5122c38e1fc3885092111fff.exe	132
PID 1676 set thread context of 216	1676	99e98c0d5122c38e1fc3885092111fff.exe	135
PID 1676 set thread context of 4828	1676	99e98c0d5122c38e1fc3885092111fff.exe	136
PID 1676 set thread context of 2984	1676	99e98c0d5122c38e1fc3885092111fff.exe	137
PID 1676 set thread context of 5076	1676	99e98c0d5122c38e1fc3885092111fff.exe	139
PID 1676 set thread context of 404	1676	99e98c0d5122c38e1fc3885092111fff.exe	143
PID 1676 set thread context of 2940	1676	99e98c0d5122c38e1fc3885092111fff.exe	144

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4960	2280	WerFault.exe	106

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2280	99e98c0d5122c38e1fc3885092111fff.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 3872	1676	99e98c0d5122c38e1fc3885092111fff.exe	85
PID 1676 wrote to memory of 3872	1676	99e98c0d5122c38e1fc3885092111fff.exe	85
PID 1676 wrote to memory of 3872	1676	99e98c0d5122c38e1fc3885092111fff.exe	85
PID 1676 wrote to memory of 3872	1676	99e98c0d5122c38e1fc3885092111fff.exe	85
PID 1676 wrote to memory of 3872	1676	99e98c0d5122c38e1fc3885092111fff.exe	85
PID 1676 wrote to memory of 3872	1676	99e98c0d5122c38e1fc3885092111fff.exe	85
PID 1676 wrote to memory of 3872	1676	99e98c0d5122c38e1fc3885092111fff.exe	85
PID 1676 wrote to memory of 3872	1676	99e98c0d5122c38e1fc3885092111fff.exe	85
PID 1676 wrote to memory of 2380	1676	99e98c0d5122c38e1fc3885092111fff.exe	86
PID 1676 wrote to memory of 2380	1676	99e98c0d5122c38e1fc3885092111fff.exe	86
PID 1676 wrote to memory of 2380	1676	99e98c0d5122c38e1fc3885092111fff.exe	86
PID 1676 wrote to memory of 2380	1676	99e98c0d5122c38e1fc3885092111fff.exe	86
PID 1676 wrote to memory of 2380	1676	99e98c0d5122c38e1fc3885092111fff.exe	86
PID 1676 wrote to memory of 2380	1676	99e98c0d5122c38e1fc3885092111fff.exe	86
PID 1676 wrote to memory of 2380	1676	99e98c0d5122c38e1fc3885092111fff.exe	86
PID 1676 wrote to memory of 2380	1676	99e98c0d5122c38e1fc3885092111fff.exe	86
PID 1676 wrote to memory of 1288	1676	99e98c0d5122c38e1fc3885092111fff.exe	89
PID 1676 wrote to memory of 1288	1676	99e98c0d5122c38e1fc3885092111fff.exe	89
PID 1676 wrote to memory of 1288	1676	99e98c0d5122c38e1fc3885092111fff.exe	89
PID 1676 wrote to memory of 3524	1676	99e98c0d5122c38e1fc3885092111fff.exe	92
PID 1676 wrote to memory of 3524	1676	99e98c0d5122c38e1fc3885092111fff.exe	92
PID 1676 wrote to memory of 3524	1676	99e98c0d5122c38e1fc3885092111fff.exe	92
PID 1676 wrote to memory of 3524	1676	99e98c0d5122c38e1fc3885092111fff.exe	92
PID 1676 wrote to memory of 3524	1676	99e98c0d5122c38e1fc3885092111fff.exe	92
PID 1676 wrote to memory of 3524	1676	99e98c0d5122c38e1fc3885092111fff.exe	92
PID 1676 wrote to memory of 3524	1676	99e98c0d5122c38e1fc3885092111fff.exe	92
PID 1676 wrote to memory of 3524	1676	99e98c0d5122c38e1fc3885092111fff.exe	92
PID 1676 wrote to memory of 1892	1676	99e98c0d5122c38e1fc3885092111fff.exe	94
PID 1676 wrote to memory of 1892	1676	99e98c0d5122c38e1fc3885092111fff.exe	94
PID 1676 wrote to memory of 1892	1676	99e98c0d5122c38e1fc3885092111fff.exe	94
PID 1676 wrote to memory of 2548	1676	99e98c0d5122c38e1fc3885092111fff.exe	97
PID 1676 wrote to memory of 2548	1676	99e98c0d5122c38e1fc3885092111fff.exe	97
PID 1676 wrote to memory of 2548	1676	99e98c0d5122c38e1fc3885092111fff.exe	97
PID 1676 wrote to memory of 2548	1676	99e98c0d5122c38e1fc3885092111fff.exe	97
PID 1676 wrote to memory of 2548	1676	99e98c0d5122c38e1fc3885092111fff.exe	97
PID 1676 wrote to memory of 2548	1676	99e98c0d5122c38e1fc3885092111fff.exe	97
PID 1676 wrote to memory of 2548	1676	99e98c0d5122c38e1fc3885092111fff.exe	97
PID 1676 wrote to memory of 2548	1676	99e98c0d5122c38e1fc3885092111fff.exe	97
PID 1676 wrote to memory of 788	1676	99e98c0d5122c38e1fc3885092111fff.exe	98
PID 1676 wrote to memory of 788	1676	99e98c0d5122c38e1fc3885092111fff.exe	98
PID 1676 wrote to memory of 788	1676	99e98c0d5122c38e1fc3885092111fff.exe	98
PID 1676 wrote to memory of 788	1676	99e98c0d5122c38e1fc3885092111fff.exe	98
PID 1676 wrote to memory of 788	1676	99e98c0d5122c38e1fc3885092111fff.exe	98
PID 1676 wrote to memory of 788	1676	99e98c0d5122c38e1fc3885092111fff.exe	98
PID 1676 wrote to memory of 788	1676	99e98c0d5122c38e1fc3885092111fff.exe	98
PID 1676 wrote to memory of 788	1676	99e98c0d5122c38e1fc3885092111fff.exe	98
PID 1676 wrote to memory of 4340	1676	99e98c0d5122c38e1fc3885092111fff.exe	99
PID 1676 wrote to memory of 4340	1676	99e98c0d5122c38e1fc3885092111fff.exe	99
PID 1676 wrote to memory of 4340	1676	99e98c0d5122c38e1fc3885092111fff.exe	99
PID 1676 wrote to memory of 4340	1676	99e98c0d5122c38e1fc3885092111fff.exe	99
PID 1676 wrote to memory of 4340	1676	99e98c0d5122c38e1fc3885092111fff.exe	99
PID 1676 wrote to memory of 4340	1676	99e98c0d5122c38e1fc3885092111fff.exe	99
PID 1676 wrote to memory of 4340	1676	99e98c0d5122c38e1fc3885092111fff.exe	99
PID 1676 wrote to memory of 4340	1676	99e98c0d5122c38e1fc3885092111fff.exe	99
PID 1676 wrote to memory of 1376	1676	99e98c0d5122c38e1fc3885092111fff.exe	100
PID 1676 wrote to memory of 1376	1676	99e98c0d5122c38e1fc3885092111fff.exe	100
PID 1676 wrote to memory of 1376	1676	99e98c0d5122c38e1fc3885092111fff.exe	100
PID 1676 wrote to memory of 1376	1676	99e98c0d5122c38e1fc3885092111fff.exe	100
PID 1676 wrote to memory of 1376	1676	99e98c0d5122c38e1fc3885092111fff.exe	100
PID 1676 wrote to memory of 1376	1676	99e98c0d5122c38e1fc3885092111fff.exe	100
PID 1676 wrote to memory of 1376	1676	99e98c0d5122c38e1fc3885092111fff.exe	100
PID 1676 wrote to memory of 1376	1676	99e98c0d5122c38e1fc3885092111fff.exe	100
PID 1676 wrote to memory of 1416	1676	99e98c0d5122c38e1fc3885092111fff.exe	101
PID 1676 wrote to memory of 1416	1676	99e98c0d5122c38e1fc3885092111fff.exe	101

C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
"C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:3872
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:2380
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:1288
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:3524
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:1892
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:2548
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:788
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:4340
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:1376
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:1416
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:3144
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:4012
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:2304
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 12
    3⤵
    - Program crash
    PID:4960
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:2476
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:3332
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:1620
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:4292
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:600
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:1868
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:3968
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:3644
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:2860
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:2944
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:4108
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:3880
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:2916
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:1660
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:1332
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:228
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:3160
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:2572
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:4212
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:4848
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:3088
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:2476
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:4180
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:4316
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:3352
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:216
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:4828
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:2984
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:4408
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:5076
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:2324
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:4456
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:3544
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:404
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:2940
- C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  C:\Users\Admin\AppData\Local\Temp\99e98c0d5122c38e1fc3885092111fff.exe
  2⤵
  PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2280 -ip 2280
1⤵
PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/600-80-0x0000000005EB0000-0x0000000005EC0000-memory.dmp

Download

memory/600-77-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/600-67-0x0000000005EB0000-0x0000000005EC0000-memory.dmp

Download

memory/600-65-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/788-47-0x0000000004E70000-0x0000000004E80000-memory.dmp

Download

memory/788-29-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/788-45-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/788-31-0x0000000004E70000-0x0000000004E80000-memory.dmp

Download

memory/1376-37-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/1376-39-0x0000000005470000-0x0000000005480000-memory.dmp

Download

memory/1376-53-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/1376-55-0x0000000005470000-0x0000000005480000-memory.dmp

Download

memory/1416-42-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/1416-59-0x00000000054F0000-0x0000000005500000-memory.dmp

Download

memory/1416-56-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/1416-43-0x00000000054F0000-0x0000000005500000-memory.dmp

Download

memory/1676-20-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/1676-0-0x0000000000990000-0x0000000000A32000-memory.dmp

Download

memory/1676-22-0x0000000005570000-0x0000000005580000-memory.dmp

Download

memory/1676-3-0x0000000005570000-0x0000000005580000-memory.dmp

Download

memory/1676-4-0x0000000005350000-0x000000000536E000-memory.dmp

Download

memory/1676-2-0x00000000053A0000-0x0000000005416000-memory.dmp

Download

memory/1676-1-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/1868-70-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/1868-81-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/1868-82-0x0000000005840000-0x0000000005850000-memory.dmp

Download

memory/2304-52-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/2304-66-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/2304-69-0x00000000052F0000-0x0000000005300000-memory.dmp

Download

memory/2380-17-0x0000000004E60000-0x0000000004E70000-memory.dmp

Download

memory/2380-16-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/2380-28-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/2380-30-0x0000000004E60000-0x0000000004E70000-memory.dmp

Download

memory/2548-25-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/2548-41-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/2548-44-0x0000000005350000-0x0000000005360000-memory.dmp

Download

memory/2860-76-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/2860-78-0x00000000054E0000-0x00000000054F0000-memory.dmp

Download

memory/3524-38-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/3524-21-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/3524-19-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/3524-34-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/3872-24-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/3872-8-0x0000000006780000-0x0000000006D98000-memory.dmp

Download

memory/3872-5-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/3872-14-0x0000000005B20000-0x0000000005B6C000-memory.dmp

Download

memory/3872-13-0x0000000005AE0000-0x0000000005B1C000-memory.dmp

Download

memory/3872-12-0x00000000059C0000-0x00000000059D0000-memory.dmp

Download

memory/3872-7-0x0000000005BB0000-0x0000000006154000-memory.dmp

Download

memory/3872-9-0x0000000005770000-0x0000000005802000-memory.dmp

Download

memory/3872-6-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/3872-11-0x00000000059D0000-0x0000000005ADA000-memory.dmp

Download

memory/3872-26-0x00000000059C0000-0x00000000059D0000-memory.dmp

Download

memory/3872-10-0x0000000005730000-0x0000000005742000-memory.dmp

Download

memory/3968-73-0x0000000005450000-0x0000000005460000-memory.dmp

Download

memory/3968-72-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/4012-62-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/4012-48-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/4292-61-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/4292-74-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/4292-63-0x0000000005650000-0x0000000005660000-memory.dmp

Download

memory/4340-35-0x0000000005C70000-0x0000000005C80000-memory.dmp

Download

memory/4340-33-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/4340-51-0x0000000005C70000-0x0000000005C80000-memory.dmp

Download

memory/4340-49-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads