purelogstealer | 5a7757d1d3fb70c2e261e3e3a14a6c79d0451b3bd67b262059ca001f9c48b308

Analysis

max time kernel
203s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
26/04/2024, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EngineChromium.msi
Size 34.3MB
Sample240426-msdrmsef83
SHA256 5a7757d1d3fb70c2e261e3e3a14a6c79d0451b3bd67b262059ca001f9c48b308
MD5 a74cc7b62eaed6394bdc89f8ae24ae45
SHA1 c0bc2eb10ef1e9891a5f1587cf180a67ac3a72a6
SHA512 a8962c92d0ea8e24f3a98e6fd01c3eedf708dcd4ff54724cd7a4e35d673ccae3f21c1094834ae44486ad785f8905dc975fd31093cf9454f34a0eb85b5331ca9f
SSDEEP 786432:CUz141w/2wmggH4vdjpi6TeQHnjAGVRZ4U2XCUydEB6msg:CUZjXmggOdov8nkGVeXCUIEWg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

purelogstealer redline zgrat newhope2 discovery infostealer persistence rat stealer

Malware Config

Extracted

Family

redline

Botnet

newhope2

91.92.246.148:3362

Signatures

Detect ZGRat V1 35 IoCs

resource	yara_rule
behavioral4/memory/1184-135-0x0000000004E70000-0x0000000004F24000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-199-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-197-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-195-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-193-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-189-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-187-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-185-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-183-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-181-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-179-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-177-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-175-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-171-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-169-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-167-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-165-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-163-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-161-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-159-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-155-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-153-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-151-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-147-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-145-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-143-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-139-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-137-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-136-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-191-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-173-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-157-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-149-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/1184-141-0x0000000004E70000-0x0000000004F1D000-memory.dmp	family_zgrat_v1
behavioral4/memory/4972-1087-0x00000000051C0000-0x00000000052EA000-memory.dmp	family_zgrat_v1

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 2 IoCs

resource	yara_rule
behavioral4/files/0x001c00000002ab59-131.dat	family_purelog_stealer
behavioral4/memory/1184-132-0x0000000000320000-0x00000000003F4000-memory.dmp	family_purelog_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral4/memory/6128-1080-0x0000000000400000-0x0000000000454000-memory.dmp	family_redline

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3424	ICACLS.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	costcodeproresieres.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	costcodeprores.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1184 set thread context of 6128	1184	costcode.exe	100

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e576fd1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB86DE4B5230BA9FD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8EC519D6FB2F0CFD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7138.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\e576fd1.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A9CC28B9-1D51-4AC4-B983-3D5E9B4ED314}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE

Executes dropped EXE 4 IoCs

pid	Process
2484	costcodeproresieres.exe
4908	costcodeprores.exe
1184	costcode.exe
4972	probablyprogram.exe

Loads dropped DLL 1 IoCs

pid	Process
2312	MsiExec.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	6128	WerFault.exe	100

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d35e07e9a716e6840000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d35e07e90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d35e07e9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd35e07e9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d35e07e900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4188	msiexec.exe
4188	msiexec.exe
3316	powershell.exe
3316	powershell.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	688	msiexec.exe
Token: SeIncreaseQuotaPrivilege	688	msiexec.exe
Token: SeSecurityPrivilege	4188	msiexec.exe
Token: SeCreateTokenPrivilege	688	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	688	msiexec.exe
Token: SeLockMemoryPrivilege	688	msiexec.exe
Token: SeIncreaseQuotaPrivilege	688	msiexec.exe
Token: SeMachineAccountPrivilege	688	msiexec.exe
Token: SeTcbPrivilege	688	msiexec.exe
Token: SeSecurityPrivilege	688	msiexec.exe
Token: SeTakeOwnershipPrivilege	688	msiexec.exe
Token: SeLoadDriverPrivilege	688	msiexec.exe
Token: SeSystemProfilePrivilege	688	msiexec.exe
Token: SeSystemtimePrivilege	688	msiexec.exe
Token: SeProfSingleProcessPrivilege	688	msiexec.exe
Token: SeIncBasePriorityPrivilege	688	msiexec.exe
Token: SeCreatePagefilePrivilege	688	msiexec.exe
Token: SeCreatePermanentPrivilege	688	msiexec.exe
Token: SeBackupPrivilege	688	msiexec.exe
Token: SeRestorePrivilege	688	msiexec.exe
Token: SeShutdownPrivilege	688	msiexec.exe
Token: SeDebugPrivilege	688	msiexec.exe
Token: SeAuditPrivilege	688	msiexec.exe
Token: SeSystemEnvironmentPrivilege	688	msiexec.exe
Token: SeChangeNotifyPrivilege	688	msiexec.exe
Token: SeRemoteShutdownPrivilege	688	msiexec.exe
Token: SeUndockPrivilege	688	msiexec.exe
Token: SeSyncAgentPrivilege	688	msiexec.exe
Token: SeEnableDelegationPrivilege	688	msiexec.exe
Token: SeManageVolumePrivilege	688	msiexec.exe
Token: SeImpersonatePrivilege	688	msiexec.exe
Token: SeCreateGlobalPrivilege	688	msiexec.exe
Token: SeBackupPrivilege	2660	vssvc.exe
Token: SeRestorePrivilege	2660	vssvc.exe
Token: SeAuditPrivilege	2660	vssvc.exe
Token: SeBackupPrivilege	4188	msiexec.exe
Token: SeRestorePrivilege	4188	msiexec.exe
Token: SeRestorePrivilege	4188	msiexec.exe
Token: SeTakeOwnershipPrivilege	4188	msiexec.exe
Token: SeRestorePrivilege	4188	msiexec.exe
Token: SeTakeOwnershipPrivilege	4188	msiexec.exe
Token: SeDebugPrivilege	3316	powershell.exe
Token: SeDebugPrivilege	1184	costcode.exe
Token: SeBackupPrivilege	2284	srtasks.exe
Token: SeRestorePrivilege	2284	srtasks.exe
Token: SeSecurityPrivilege	2284	srtasks.exe
Token: SeTakeOwnershipPrivilege	2284	srtasks.exe
Token: SeBackupPrivilege	2284	srtasks.exe
Token: SeRestorePrivilege	2284	srtasks.exe
Token: SeSecurityPrivilege	2284	srtasks.exe
Token: SeTakeOwnershipPrivilege	2284	srtasks.exe
Token: SeDebugPrivilege	4972	probablyprogram.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
688	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2484	costcodeproresieres.exe
4412	cmd.exe
4908	costcodeprores.exe
1184	costcode.exe
6128	MSBuild.exe
4972	probablyprogram.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 2284	4188	msiexec.exe	86
PID 4188 wrote to memory of 2284	4188	msiexec.exe	86
PID 4188 wrote to memory of 2312	4188	msiexec.exe	88
PID 4188 wrote to memory of 2312	4188	msiexec.exe	88
PID 4188 wrote to memory of 2312	4188	msiexec.exe	88
PID 2312 wrote to memory of 3424	2312	MsiExec.exe	89
PID 2312 wrote to memory of 3424	2312	MsiExec.exe	89
PID 2312 wrote to memory of 3424	2312	MsiExec.exe	89
PID 2312 wrote to memory of 2260	2312	MsiExec.exe	91
PID 2312 wrote to memory of 2260	2312	MsiExec.exe	91
PID 2312 wrote to memory of 2260	2312	MsiExec.exe	91
PID 2312 wrote to memory of 2484	2312	MsiExec.exe	93
PID 2312 wrote to memory of 2484	2312	MsiExec.exe	93
PID 2312 wrote to memory of 2484	2312	MsiExec.exe	93
PID 2484 wrote to memory of 4412	2484	costcodeproresieres.exe	94
PID 2484 wrote to memory of 4412	2484	costcodeproresieres.exe	94
PID 2484 wrote to memory of 4412	2484	costcodeproresieres.exe	94
PID 4412 wrote to memory of 3316	4412	cmd.exe	96
PID 4412 wrote to memory of 3316	4412	cmd.exe	96
PID 4412 wrote to memory of 3316	4412	cmd.exe	96
PID 2484 wrote to memory of 4908	2484	costcodeproresieres.exe	97
PID 2484 wrote to memory of 4908	2484	costcodeproresieres.exe	97
PID 4908 wrote to memory of 1184	4908	costcodeprores.exe	98
PID 4908 wrote to memory of 1184	4908	costcodeprores.exe	98
PID 4908 wrote to memory of 1184	4908	costcodeprores.exe	98
PID 1184 wrote to memory of 6128	1184	costcode.exe	100
PID 1184 wrote to memory of 6128	1184	costcode.exe	100
PID 1184 wrote to memory of 6128	1184	costcode.exe	100
PID 1184 wrote to memory of 6128	1184	costcode.exe	100
PID 1184 wrote to memory of 6128	1184	costcode.exe	100
PID 1184 wrote to memory of 6128	1184	costcode.exe	100
PID 1184 wrote to memory of 6128	1184	costcode.exe	100
PID 1184 wrote to memory of 6128	1184	costcode.exe	100
PID 4908 wrote to memory of 4972	4908	costcodeprores.exe	102
PID 4908 wrote to memory of 4972	4908	costcodeprores.exe	102
PID 4908 wrote to memory of 4972	4908	costcodeprores.exe	102

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\EngineChromium.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:688

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8884AAE71833A29C0F66D11DB443DDF9
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-f3ef0f6a-2f43-4ccf-8f5a-9d927176bf4c\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:3424
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\MW-f3ef0f6a-2f43-4ccf-8f5a-9d927176bf4c\files\costcodeproresieres.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-f3ef0f6a-2f43-4ccf-8f5a-9d927176bf4c\files\costcodeproresieres.exe"
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c costcode.bat
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4412
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\costcodeprores.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\costcodeprores.exe
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\costcode.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\costcode.exe
        5⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1184
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:6128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6128 -s 788
        7⤵
        Program crash
        
        PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\probablyprogram.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\probablyprogram.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4972

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6128 -ip 6128
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

costcode.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\costcode.bat
Size 145B
SHA256 a6236e067a745bc082ab9b7ce0b4d7b39816efa191ea2c25baee7a334fa70a2b
MD5 aad2830f24f0808e7fe50b82acdfbdf9
SHA1 53d35b0dd209a10dd4cbf4394cbd3cd64bf758be
SHA512 4b30f274012064bac12fd88289f16a592328bec99557d1514f90bdc2402e9a790badd0fed116734fd6dc4654f2e7d0b681d9aff506781e7407a68312a983cd1f
MD5 SHA1 SHA512

Submit Download

costcodeprores.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\costcodeprores.exe
Size 42.0MB
SHA256 b32c0a94ae198325d5d78821ab0d526f2e5c6ac00638f5d6aff10d720874d35c
MD5 73bb756b945ac9734b3ea50d583b6da7
SHA1 6184d653cd6b0906267a1874d54d26892685af44
SHA512 8ee8dfee11c7d7415ae2990ad2a2b1067cf90921ed7873f87a151f32119b61fa24aa1ef7c2fb219bb01d3cb047d944c9cac453ba53cfec74184b3066782649fb
SSDEEP 786432:Z/exBF+Bj1Sn61q0NcF+Bj1Sn61q0NcF+Bj1Sn61q0NW:Z/E2BInN0NvBInN0NvBInN0NW
MD5 SHA1 SHA512 SSDEEP

Submit Download

costcode.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\costcode.exe
Size 838KB
SHA256 22df3ecc6bc24b47ca6afb25525bd0c247bdd18a105ae8fa3174176b4c1fcf9c
MD5 688dc2be58e652d1683cd909b92480ff
SHA1 1b0dfe0801762ef89daa2a5e7ff55cc7615b5f81
SHA512 fbf386421bbde29f763a1ad5e9f0d06dda308e5e58528a74ee67ea37f945dc77156b2e5e0522e0a64e6630ac16a555c353b92117217948fa432325f9202fb215
SSDEEP 12288:KdQl4yKAuCSEjhuJ9oDIzcnHYuzwf3tzbwQESM+rSW/Oi07gR2e:KdQlCFCSEkJzmYuiZbEOS6G7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

probablyprogram.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\probablyprogram.exe
Size 1.3MB
SHA256 fc8100e9dbce6a4338a569bf12bfc4497239a781cb7e6cd3f80949ee6675ca1f
MD5 f73d1e0fd9e1300a131861fb367ac7eb
SHA1 82543f273ad9d8ae93bbe3fd4a0063927c505a84
SHA512 e78bf7e274388742bdb7e42305f5290d03da3e51f0d8c355ee79e179c58b2d043efb652e3f35f90255559ffcf97f4a1b7e4f4d9604f7b33f1e404975ee6c8d20
SSDEEP 24576:Km3AYSG9T2uFvG0xqK4B2srUt8Tkj2bRY1F8Lk3FEmDi8HqPG:KwAYSG1vG0YK4IPXOnkVEwMG
MD5 SHA1 SHA512 SSDEEP

Submit Download

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-f3ef0f6a-2f43-4ccf-8f5a-9d927176bf4c\files.cab
Size 34.0MB
SHA256 3281204875c3905c97d5e918362f749a7c870e263709cf0413ea1dddb4bc9fda
MD5 39eadf22ac87b0b26ba46d10198aa230
SHA1 f91ecff4e43b492d562547c350fff560a72167de
SHA512 b15bc5fdc548e201d8eb57d5283c8e840d9c71ed34fc9b15373c6e4b84bf8d497705f5cbcadb1b93d84d1fb19de8373060f1ad613d9d13f7fb06290bf31bac02
SSDEEP 786432:+Uz141w/2wmggH4vdjpi6TeQHnjAGVRZ4U2XCUydEB6msg:+UZjXmggOdov8nkGVeXCUIEWg
MD5 SHA1 SHA512 SSDEEP

Submit Download

costcodeproresieres.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-f3ef0f6a-2f43-4ccf-8f5a-9d927176bf4c\files\costcodeproresieres.exe
Size 34.0MB
SHA256 b6f7b366ebeefbf492b25db56e67934f0f5c3d26391348277e58a0351d312301
MD5 13887aee1ef3f47ae357a139360e052f
SHA1 9c5c229bd23f1e82a9c627f192e661716b648090
SHA512 3f593db09613f5d2c3255b604bd74943b918bb66441c3eccc7df11408374d48e1cda0fedefdc3b3fa0b0e49aa9ac319d756e4630176a877b77486d70206491c9
SSDEEP 786432:kDBFyOiA8N/frahgE/Xt2NJPVmElqJbyvpvff6nRXVcR87:kDDX4/frDu9CNm4qJkff6RXn7
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-f3ef0f6a-2f43-4ccf-8f5a-9d927176bf4c\msiwrapper.ini
Size 1KB
SHA256 3c9cf148d35cf43fbfb24acca275ff85d7bccebf4565e54205aba1a81fabaea6
MD5 f7f7ee845bbbde9cd82a071549090c12
SHA1 cb06ebf9d1691309be564205acbfa1362ed85d3c
SHA512 6fbab779ed6284aea3efa7ce0f248eec3ce37ba3dff4ce91ce3338d15f8a7c1732629920b9ca255d94f446ff4ecfb5e70746b66540418ea796a666a048c3042e
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-f3ef0f6a-2f43-4ccf-8f5a-9d927176bf4c\msiwrapper.ini
Size 1KB
SHA256 94dda470533a8d4b7d2186e896bcf8430088c0919f91cb83d7811fe40815da08
MD5 37e6137a9967b2d5cc22f1be82a0e6d4
SHA1 fec6313a4d9bd58b19770b2719f4d74dbee6e690
SHA512 d9ad4e3226819409505615812bfc9f116a2c7e20b1390866c017e360568f7f74c1f12a55f2dc3ab8d22922ab74ed6aafb74b4afa521774605c8cb6beecf80ca7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_dqjt03k0.znq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dqjt03k0.znq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

MSI7138.tmp

Path C:\Windows\Installer\MSI7138.tmp
Size 208KB
SHA256 fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
MD5 0c8921bbcc37c6efd34faf44cf3b0cb5
SHA1 dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA512 ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
SSDEEP 3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 ec593591007835299a16b764ce45a6e7f2cc3e22825f7305dcf921d8be3d53df
MD5 3205005ddc1dfee2b4cf0198d8fb44ac
SHA1 36de654c1a07fae7eadf3e96f181006edcd1c221
SHA512 431815599dac2059c1fe98ccc08068829b283734140cd3fcde2b36c2c920addd5d22896f5e6bd351c8d94bdcb66b390a000f02c810bf806e0ad7dede3286abb3
SSDEEP 24576:/ZVmSp7CdoO/vvTLNWK+Rkn6/a3jwoEA2WJNXpE6DBa40WuCoB7nb3QN2N:Qq
MD5 SHA1 SHA512 SSDEEP

Submit Download

{97a7b583-a7cd-484c-8221-95a42903e5bd}_OnDiskSnapshotProp

Path \??\Volume{e9075ed3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{97a7b583-a7cd-484c-8221-95a42903e5bd}_OnDiskSnapshotProp
Size 6KB
SHA256 b787fc91f5b531acb7b574c4891983e02010851093d9388d25504e4e10084df0
MD5 37a983c5991454d8653a8ea5ecf15dd2
SHA1 81881a914c865fe4a70cc0dc8ac086bf420c2fb0
SHA512 72bfac4cfcf222506cef33878c7f1e87ccc4284b3eebfd62133bd100f7e109e62ab10aaca890970de805525b1935ba7d65ceffc97422de806586a6a9f6b63635
SSDEEP 96:FIccvRKnpADD84LTHzbOHXOHBlBRQ78Sc9XE56tOSVQpu:Hab++mVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1184-137-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-191-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-1071-0x0000000005C00000-0x00000000061A6000-memory.dmp

Download

memory/1184-1070-0x0000000005180000-0x0000000005212000-memory.dmp

Download

memory/1184-1069-0x0000000005010000-0x000000000505C000-memory.dmp

Download

memory/1184-1068-0x0000000004FB0000-0x0000000004FFA000-memory.dmp

Download

memory/1184-141-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-149-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-157-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-173-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-136-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-139-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-143-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-145-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-147-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-151-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-153-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-155-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-132-0x0000000000320000-0x00000000003F4000-memory.dmp

Download

memory/1184-133-0x0000000004CD0000-0x0000000004D82000-memory.dmp

Download

memory/1184-134-0x0000000004DC0000-0x0000000004E72000-memory.dmp

Download

memory/1184-135-0x0000000004E70000-0x0000000004F24000-memory.dmp

Download

memory/1184-199-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-197-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-195-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-193-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-189-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-187-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-185-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-183-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-181-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-179-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-177-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-175-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-171-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-169-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-167-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-165-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-163-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-161-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/1184-159-0x0000000004E70000-0x0000000004F1D000-memory.dmp

Download

memory/3316-112-0x0000000007930000-0x000000000794A000-memory.dmp

Download

memory/3316-84-0x00000000058E0000-0x0000000005F0A000-memory.dmp

Download

memory/3316-119-0x0000000007C70000-0x0000000007C78000-memory.dmp

Download

memory/3316-118-0x0000000007C80000-0x0000000007C9A000-memory.dmp

Download

memory/3316-117-0x0000000007B80000-0x0000000007B95000-memory.dmp

Download

memory/3316-116-0x0000000007B70000-0x0000000007B7E000-memory.dmp

Download

memory/3316-115-0x0000000007B40000-0x0000000007B51000-memory.dmp

Download

memory/3316-87-0x00000000060B0000-0x0000000006116000-memory.dmp

Download

memory/3316-114-0x0000000007BC0000-0x0000000007C56000-memory.dmp

Download

memory/3316-97-0x00000000065D0000-0x00000000065EE000-memory.dmp

Download

memory/3316-113-0x00000000079B0000-0x00000000079BA000-memory.dmp

Download

memory/3316-109-0x0000000006BB0000-0x0000000006BCE000-memory.dmp

Download

memory/3316-96-0x0000000006120000-0x0000000006477000-memory.dmp

Download

memory/3316-110-0x00000000077E0000-0x0000000007884000-memory.dmp

Download

memory/3316-111-0x0000000007F70000-0x00000000085EA000-memory.dmp

Download

memory/3316-100-0x000000006F770000-0x000000006F7BC000-memory.dmp

Download

memory/3316-99-0x00000000075A0000-0x00000000075D4000-memory.dmp

Download

memory/3316-98-0x0000000006620000-0x000000000666C000-memory.dmp

Download

memory/3316-85-0x0000000005750000-0x0000000005772000-memory.dmp

Download

memory/3316-86-0x0000000006040000-0x00000000060A6000-memory.dmp

Download

memory/3316-83-0x0000000003150000-0x0000000003186000-memory.dmp

Download

memory/4972-1084-0x00000000003A0000-0x00000000004EA000-memory.dmp

Download

memory/4972-1085-0x0000000004E20000-0x0000000004F48000-memory.dmp

Download

memory/4972-1086-0x0000000005090000-0x00000000051B8000-memory.dmp

Download

memory/4972-1087-0x00000000051C0000-0x00000000052EA000-memory.dmp

Download

memory/4972-2020-0x0000000005380000-0x0000000005440000-memory.dmp

Download

memory/6128-1080-0x0000000000400000-0x0000000000454000-memory.dmp

Download