Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-05-2024 21:00
Static task
static1
Behavioral task
behavioral1
Sample
036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exe
Resource
win11-20240419-en
General
-
Target
036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exe
-
Size
915KB
-
MD5
8e38e8ecd481eb08ceaa4ae363251311
-
SHA1
8c2a06c4c7b52cb9cd01c414732597e9289b3ad4
-
SHA256
036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40
-
SHA512
c02a7be29b8012778a9028b67d71384e0a6a60857f880bf858099aef5a41a21c0068cfd2ff4116176493c28938d5e799ca18738a6e29335c3423f895305d016f
-
SSDEEP
24576:7tASL4DpnNBcMxDlxTWTn6WHmTSHMLir8/dp97A:f4DpnNBcMTxTyYSY1P7A
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
5.42.65.115:40551
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4820-1-0x0000000000400000-0x0000000000452000-memory.dmp family_redline -
XMRig Miner payload 16 IoCs
Processes:
resource yara_rule behavioral2/memory/4000-112-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4000-111-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4000-117-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4000-118-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4000-116-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4000-115-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4000-114-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4000-119-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4000-120-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4000-121-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4000-123-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4000-122-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4000-124-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4000-126-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4000-127-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4000-125-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 404 powershell.exe 2240 powershell.exe -
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
Processes:
filename.exeupdater.exedescription ioc process File created C:\Windows\system32\drivers\etc\hosts filename.exe File created C:\Windows\system32\drivers\etc\hosts updater.exe -
Executes dropped EXE 2 IoCs
Processes:
filename.exeupdater.exepid process 3888 filename.exe 1812 updater.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4000-107-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-106-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-110-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-112-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-111-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-109-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-108-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-117-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-118-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-116-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-115-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-114-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-119-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-120-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-121-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-123-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-122-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-124-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-126-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-127-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4000-125-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 4 IoCs
Processes:
filename.exepowershell.exeupdater.exedescription ioc process File opened for modification C:\Windows\system32\MRT.exe filename.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe updater.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exeupdater.exedescription pid process target process PID 2920 set thread context of 4820 2920 036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exe RegAsm.exe PID 1812 set thread context of 4404 1812 updater.exe conhost.exe PID 1812 set thread context of 4000 1812 updater.exe explorer.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1708 sc.exe 4768 sc.exe 2380 sc.exe 4816 sc.exe 4020 sc.exe 4860 sc.exe 748 sc.exe 1800 sc.exe 1120 sc.exe 4724 sc.exe 2672 sc.exe 1376 sc.exe 2612 sc.exe 4292 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2168 2920 WerFault.exe 036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe -
Processes:
RegAsm.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
RegAsm.exefilename.exepowershell.exeupdater.exepowershell.exeexplorer.exepid process 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 3888 filename.exe 404 powershell.exe 404 powershell.exe 3888 filename.exe 3888 filename.exe 3888 filename.exe 3888 filename.exe 3888 filename.exe 3888 filename.exe 3888 filename.exe 3888 filename.exe 3888 filename.exe 3888 filename.exe 3888 filename.exe 3888 filename.exe 3888 filename.exe 3888 filename.exe 1812 updater.exe 2240 powershell.exe 2240 powershell.exe 1812 updater.exe 1812 updater.exe 1812 updater.exe 1812 updater.exe 1812 updater.exe 1812 updater.exe 1812 updater.exe 1812 updater.exe 1812 updater.exe 1812 updater.exe 1812 updater.exe 1812 updater.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
RegAsm.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exedescription pid process Token: SeDebugPrivilege 4820 RegAsm.exe Token: SeDebugPrivilege 404 powershell.exe Token: SeShutdownPrivilege 3156 powercfg.exe Token: SeCreatePagefilePrivilege 3156 powercfg.exe Token: SeShutdownPrivilege 4504 powercfg.exe Token: SeCreatePagefilePrivilege 4504 powercfg.exe Token: SeShutdownPrivilege 2780 powercfg.exe Token: SeCreatePagefilePrivilege 2780 powercfg.exe Token: SeShutdownPrivilege 3588 powercfg.exe Token: SeCreatePagefilePrivilege 3588 powercfg.exe Token: SeDebugPrivilege 2240 powershell.exe Token: SeShutdownPrivilege 2408 powercfg.exe Token: SeCreatePagefilePrivilege 2408 powercfg.exe Token: SeShutdownPrivilege 4072 powercfg.exe Token: SeCreatePagefilePrivilege 4072 powercfg.exe Token: SeShutdownPrivilege 4092 powercfg.exe Token: SeCreatePagefilePrivilege 4092 powercfg.exe Token: SeShutdownPrivilege 2388 powercfg.exe Token: SeCreatePagefilePrivilege 2388 powercfg.exe Token: SeLockMemoryPrivilege 4000 explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exeRegAsm.execmd.execmd.exeupdater.exedescription pid process target process PID 2920 wrote to memory of 4820 2920 036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exe RegAsm.exe PID 2920 wrote to memory of 4820 2920 036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exe RegAsm.exe PID 2920 wrote to memory of 4820 2920 036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exe RegAsm.exe PID 2920 wrote to memory of 4820 2920 036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exe RegAsm.exe PID 2920 wrote to memory of 4820 2920 036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exe RegAsm.exe PID 2920 wrote to memory of 4820 2920 036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exe RegAsm.exe PID 2920 wrote to memory of 4820 2920 036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exe RegAsm.exe PID 2920 wrote to memory of 4820 2920 036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exe RegAsm.exe PID 4820 wrote to memory of 3888 4820 RegAsm.exe filename.exe PID 4820 wrote to memory of 3888 4820 RegAsm.exe filename.exe PID 1488 wrote to memory of 4476 1488 cmd.exe wusa.exe PID 1488 wrote to memory of 4476 1488 cmd.exe wusa.exe PID 4812 wrote to memory of 1888 4812 cmd.exe wusa.exe PID 4812 wrote to memory of 1888 4812 cmd.exe wusa.exe PID 1812 wrote to memory of 4404 1812 updater.exe conhost.exe PID 1812 wrote to memory of 4404 1812 updater.exe conhost.exe PID 1812 wrote to memory of 4404 1812 updater.exe conhost.exe PID 1812 wrote to memory of 4404 1812 updater.exe conhost.exe PID 1812 wrote to memory of 4404 1812 updater.exe conhost.exe PID 1812 wrote to memory of 4404 1812 updater.exe conhost.exe PID 1812 wrote to memory of 4404 1812 updater.exe conhost.exe PID 1812 wrote to memory of 4404 1812 updater.exe conhost.exe PID 1812 wrote to memory of 4404 1812 updater.exe conhost.exe PID 1812 wrote to memory of 4000 1812 updater.exe explorer.exe PID 1812 wrote to memory of 4000 1812 updater.exe explorer.exe PID 1812 wrote to memory of 4000 1812 updater.exe explorer.exe PID 1812 wrote to memory of 4000 1812 updater.exe explorer.exe PID 1812 wrote to memory of 4000 1812 updater.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exe"C:\Users\Admin\AppData\Local\Temp\036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\filename.exe"C:\Users\Admin\AppData\Local\Temp\filename.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3888 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:404 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵PID:4476
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
PID:1120 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
PID:4816 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
PID:4020 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
PID:4860 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
PID:4724 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:3156 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:4504 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:3588 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:2780 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
PID:748 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"4⤵
- Launches sc.exe
PID:1708 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
PID:4768 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
PID:2672 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 2842⤵
- Program crash
PID:2168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2920 -ip 29201⤵PID:1192
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1888
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2612 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1376 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2380 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1800 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4292 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:4092 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2388 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:4072 -
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4404
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Tmp53FC.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pz3gmbbx.e5j.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\filename.exeFilesize
5.1MB
MD53f7e36fa14bafefea46398ba14dd7e75
SHA1856e0d0bcfb5f69fc9cf389a87aad6261b984e2b
SHA256490a5522aeaf111abdbe2eaf8dec0ffd81a687c395dad12ddcb8a6616c7c7478
SHA5129e107931cb63ce707e292c559b19be032820ae394fb89eae6747f9ae7328f8257017b4c70ead2fe5a2dba4b3ca7e178ac98e1e09f275400671aa4890535baa0c
-
C:\Windows\system32\drivers\etc\hostsFilesize
3KB
MD52d29fd3ae57f422e2b2121141dc82253
SHA1c2464c857779c0ab4f5e766f5028fcc651a6c6b7
SHA25680a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4
SHA512077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68
-
memory/404-64-0x00007FF864A30000-0x00007FF8654F2000-memory.dmpFilesize
10.8MB
-
memory/404-50-0x00007FF864A33000-0x00007FF864A35000-memory.dmpFilesize
8KB
-
memory/404-59-0x00000243C59B0000-0x00000243C59D2000-memory.dmpFilesize
136KB
-
memory/404-60-0x00007FF864A30000-0x00007FF8654F2000-memory.dmpFilesize
10.8MB
-
memory/404-61-0x00007FF864A30000-0x00007FF8654F2000-memory.dmpFilesize
10.8MB
-
memory/2240-92-0x00000205B5410000-0x00000205B5416000-memory.dmpFilesize
24KB
-
memory/2240-88-0x00000205B52F0000-0x00000205B530C000-memory.dmpFilesize
112KB
-
memory/2240-87-0x00000205B52C0000-0x00000205B52CA000-memory.dmpFilesize
40KB
-
memory/2240-86-0x00000205B5200000-0x00000205B52B3000-memory.dmpFilesize
716KB
-
memory/2240-85-0x00000205B51E0000-0x00000205B51FC000-memory.dmpFilesize
112KB
-
memory/2240-89-0x00000205B52D0000-0x00000205B52DA000-memory.dmpFilesize
40KB
-
memory/2240-90-0x00000205B5430000-0x00000205B544A000-memory.dmpFilesize
104KB
-
memory/2240-91-0x00000205B52E0000-0x00000205B52E8000-memory.dmpFilesize
32KB
-
memory/2240-93-0x00000205B5420000-0x00000205B542A000-memory.dmpFilesize
40KB
-
memory/2920-0-0x0000000000DF0000-0x0000000000DF1000-memory.dmpFilesize
4KB
-
memory/2920-2-0x0000000000DF0000-0x0000000000DF1000-memory.dmpFilesize
4KB
-
memory/4000-111-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-116-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-125-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-127-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-126-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-124-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-122-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-123-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-121-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-120-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-119-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-114-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-115-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-118-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-117-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-108-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-109-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-112-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-110-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-113-0x0000000000710000-0x0000000000730000-memory.dmpFilesize
128KB
-
memory/4000-106-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4000-107-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4404-102-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4404-98-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4404-99-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4404-100-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4404-101-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4404-105-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4820-49-0x0000000074230000-0x00000000749E1000-memory.dmpFilesize
7.7MB
-
memory/4820-1-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4820-4-0x0000000005A30000-0x0000000005FD6000-memory.dmpFilesize
5.6MB
-
memory/4820-5-0x0000000005480000-0x0000000005512000-memory.dmpFilesize
584KB
-
memory/4820-6-0x0000000005430000-0x000000000543A000-memory.dmpFilesize
40KB
-
memory/4820-7-0x0000000074230000-0x00000000749E1000-memory.dmpFilesize
7.7MB
-
memory/4820-3-0x000000007423E000-0x000000007423F000-memory.dmpFilesize
4KB
-
memory/4820-22-0x00000000060E0000-0x0000000006156000-memory.dmpFilesize
472KB
-
memory/4820-23-0x0000000006710000-0x000000000672E000-memory.dmpFilesize
120KB
-
memory/4820-26-0x0000000006D50000-0x0000000007368000-memory.dmpFilesize
6.1MB
-
memory/4820-27-0x00000000068A0000-0x00000000069AA000-memory.dmpFilesize
1.0MB
-
memory/4820-28-0x00000000067E0000-0x00000000067F2000-memory.dmpFilesize
72KB
-
memory/4820-29-0x0000000006840000-0x000000000687C000-memory.dmpFilesize
240KB
-
memory/4820-30-0x00000000069B0000-0x00000000069FC000-memory.dmpFilesize
304KB
-
memory/4820-31-0x0000000006B00000-0x0000000006B66000-memory.dmpFilesize
408KB
-
memory/4820-34-0x0000000007940000-0x0000000007B02000-memory.dmpFilesize
1.8MB
-
memory/4820-35-0x0000000008040000-0x000000000856C000-memory.dmpFilesize
5.2MB
-
memory/4820-36-0x00000000078D0000-0x0000000007920000-memory.dmpFilesize
320KB