redline | c8f091b7146475fa599e333d8cd5bf13c9d5b6bd9e23e329b1b471dd4c94563d

Analysis

max time kernel
114s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.exe
Size

622KB
MD5

3a57ccf14fe8795248e9dafbb3af1e1c
SHA1

bdce64edbbba8fb0bfb09448f6fb73705f1cbdbd
SHA256

c8f091b7146475fa599e333d8cd5bf13c9d5b6bd9e23e329b1b471dd4c94563d
SHA512

8f1900a560d45fc3e823ae75dd1a3187223f145eba9c78d1ee0a30e42d931d7f0821aba8c159bda6b8273ad72f40ece1e7e7125247a767559cf9b9e4da8c7570
SSDEEP

12288:+uuLmREaMFVpzZ9POQVAhABnTC5U3deVfJ4Xa4hcBsKrhbsDB1XEn0Uxj3jizdre:ZuLjaMFV8

Score

10^/10

redline @nmrzv88 infostealer

Malware Config

Extracted

Family

redline

Botnet

@nmrzv88

147.45.47.93:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/3940-8-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

Loads dropped DLL 1 IoCs

pid	Process
2236	main.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2236 set thread context of 3940	2236	main.exe	84

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133630783090011696"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1860	chrome.exe
1860	chrome.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5060	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeDebugPrivilege	2928	taskmgr.exe
Token: SeSystemProfilePrivilege	2928	taskmgr.exe
Token: SeCreateGlobalPrivilege	2928	taskmgr.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe
5060	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 3940	2236	main.exe	84
PID 2236 wrote to memory of 3940	2236	main.exe	84
PID 2236 wrote to memory of 3940	2236	main.exe	84
PID 2236 wrote to memory of 3940	2236	main.exe	84
PID 2236 wrote to memory of 3940	2236	main.exe	84
PID 2236 wrote to memory of 3940	2236	main.exe	84
PID 2236 wrote to memory of 3940	2236	main.exe	84
PID 2236 wrote to memory of 3940	2236	main.exe	84
PID 1860 wrote to memory of 3728	1860	chrome.exe	89
PID 1860 wrote to memory of 3728	1860	chrome.exe	89
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 3192	1860	chrome.exe	90
PID 1860 wrote to memory of 1504	1860	chrome.exe	91
PID 1860 wrote to memory of 1504	1860	chrome.exe	91
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92
PID 1860 wrote to memory of 976	1860	chrome.exe	92

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcfa2eab58,0x7ffcfa2eab68,0x7ffcfa2eab78
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=2024,i,3447616371743228869,10659368421027315040,131072 /prefetch:2
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 --field-trial-handle=2024,i,3447616371743228869,10659368421027315040,131072 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2304 --field-trial-handle=2024,i,3447616371743228869,10659368421027315040,131072 /prefetch:8
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=2024,i,3447616371743228869,10659368421027315040,131072 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=2024,i,3447616371743228869,10659368421027315040,131072 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4316 --field-trial-handle=2024,i,3447616371743228869,10659368421027315040,131072 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 --field-trial-handle=2024,i,3447616371743228869,10659368421027315040,131072 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=2024,i,3447616371743228869,10659368421027315040,131072 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4644 --field-trial-handle=2024,i,3447616371743228869,10659368421027315040,131072 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5008 --field-trial-handle=2024,i,3447616371743228869,10659368421027315040,131072 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5024 --field-trial-handle=2024,i,3447616371743228869,10659368421027315040,131072 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4776 --field-trial-handle=2024,i,3447616371743228869,10659368421027315040,131072 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4920 --field-trial-handle=2024,i,3447616371743228869,10659368421027315040,131072 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4784 --field-trial-handle=2024,i,3447616371743228869,10659368421027315040,131072 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3092 --field-trial-handle=2024,i,3447616371743228869,10659368421027315040,131072 /prefetch:1
  2⤵
  PID:4364

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4616

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2928

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5048

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5060
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\System32\drivers\etc\hosts
  2⤵
  PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf73f46f8,0x7ffcf73f4708,0x7ffcf73f4718
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4330164441252407339,685747942876765888,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4330164441252407339,685747942876765888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4330164441252407339,685747942876765888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4330164441252407339,685747942876765888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4330164441252407339,685747942876765888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4330164441252407339,685747942876765888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4330164441252407339,685747942876765888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8ba239df-a2a8-44be-ac9f-0762cf125091.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
811B

MD5
8ae061b5c3600e003824c3074a1ed3a6

SHA1
0b9d7e886323b0a0fc818cc0f918a9a680de45ee

SHA256
18e1c0673903df44ead68d1156d95cb543c21773a4888033cbb7d82e7de9d70b

SHA512
250bde3887afd843ff4ea1620f46352d4d617662f84337242cc5513eaa0c761fb78c1d68dbde4f1ce0090f3be46766a6fe7df6509ac3b07b8ac02bd19b6993fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
3078fcd933061e4a80e9002c0884ea2b

SHA1
813ece9e68abad1e1d0cfe6c30b0023a95f19ce3

SHA256
b0de45a6ebb8f981cac417aa30cc97dfca4ce558b43d18730a1ba298dc59995b

SHA512
50708d92f7d9dcf36ef0911fab7f057fdf096eb3d5a0cfa22d7ce34f8b4ac493a49dc79fd1e554ebd4907a7c75d0cefb85565c4f2f4f5999f57471c8d9dfe566

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
c49d488d575254456125528a4a620b80

SHA1
b14fecb2a594abd19660e73ff7f73e751e06db89

SHA256
cc5f77399f692b1bc3f019c961d5d0c9262920fa6b842de09e57d9daa8c2be34

SHA512
0bfb849de9096ef3f5828667f3be0b9066c9e92669fa76a2097645e495e96f3fcd966de4491cd3fd23b677fd6a4f781d96514dde485b58d51d518c16398ae942

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
a5620e1299206835e7a737e64f928fac

SHA1
f1ba0bf5cd6dc28939c4903e149487b6aa946242

SHA256
6b56e08ada528733af20c9e863cc026a3ee0eb33ba0aec59cf9d1d2cb2f833e4

SHA512
b52f8e8511e1ad17b8e68debe25e271f5a25a869424fc0bd6a62733d2e63b2d5253273a208c885e621ecc6647aaaef79dedafd31c79beceaf3d9bee644ec9609

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
8677d91bb2d31b26641e6c545371f404

SHA1
26b981d0e3562e541c013636e43b073581682c8e

SHA256
4ce42a520062f22795ea718aaea02e98aa6f20b82ce3468e532272143e3a9cba

SHA512
4ac8c90b14a0e1be4570033d3f81db9c145cace9484501d7a4458f1a875de59db46559ad67733f11af7e740d2bc5d27668d953aab259b2eb71ee9bd5a359fb3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
68304b8372f89e3fae4e0ead3b4c5202

SHA1
e4d5b37b4488f8667b932fb3a95789e87f37f9a0

SHA256
7f38bbd29bbbc182cbcbf30ef3c4ef51ac3cc8b5e516087010c5c5868911f6c8

SHA512
35de31a2ba459a66967d64fd1b07c021740f7aa275e297a3e0893a1f87d7e828e20434148181cd1beeefc7775f7fc9a29f51267549c514690230feb9e76df6c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7a0871a66983612f2a884e7763e6a4a

SHA1
7d3a6fa2f115d81783473d77cb9b3720c766cd6c

SHA256
4ef29c97a0559ca20169084769a769598910c3d23d940410d9f1a783a10a8d40

SHA512
dee5bd8f48826fe9408a26673bc40cc874bda601eca3056bd2e921ef23cc1b11a45f17a67bb513259aaf49234cd054a98aab871884ea3b7e5511ab8fdfc40d2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e030a5d6-d9d6-485c-8864-558fab6a81af.tmp

Filesize
8KB

MD5
1bd44e8c2150c28c65598203cec843e6

SHA1
7525df5b2665d59824acc4aae4c3d1477abe4016

SHA256
d3171f21f4e328a07eb24afdd9d1b75d83dacbb875b117aa44d8d8b61ef8d43d

SHA512
6c28bc46bc7c069e79f3824bf07b46778e6b7b2f6ed1c473f7fcb6bba783b1cf386987b7ff0e250f0f4b10b7e1e76235c1db547be0f9e18fcb458c269d6a1973

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp636D.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Roaming\d3d9.dll

Filesize
430KB

MD5
3b30bcf903659a7a6c7cc356ef690b85

SHA1
3a1c82feb87ee768677c9c86bcce3ec06b88c884

SHA256
afb74188254f2863f0896b680bc8d0435165237431bc98f1ea7ef933764dddf8

SHA512
1064554e8958646b03024457057fb2655947329d7d8dec858ffecaaf05dc693b4c0c97403d24a521b4afe7c6f35725aa73414ef19deac1dd7cbca4f8e36543b0

Download Submit
memory/2236-67-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/2236-0-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/2236-1-0x00000000003A0000-0x0000000000442000-memory.dmp

Filesize
648KB

Download
memory/2236-10-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/2928-81-0x00000270362C0000-0x00000270362C1000-memory.dmp

Filesize
4KB

Download
memory/2928-79-0x00000270362C0000-0x00000270362C1000-memory.dmp

Filesize
4KB

Download
memory/2928-78-0x00000270362C0000-0x00000270362C1000-memory.dmp

Filesize
4KB

Download
memory/2928-74-0x00000270362C0000-0x00000270362C1000-memory.dmp

Filesize
4KB

Download
memory/2928-73-0x00000270362C0000-0x00000270362C1000-memory.dmp

Filesize
4KB

Download
memory/2928-72-0x00000270362C0000-0x00000270362C1000-memory.dmp

Filesize
4KB

Download
memory/2928-84-0x00000270362C0000-0x00000270362C1000-memory.dmp

Filesize
4KB

Download
memory/2928-83-0x00000270362C0000-0x00000270362C1000-memory.dmp

Filesize
4KB

Download
memory/2928-82-0x00000270362C0000-0x00000270362C1000-memory.dmp

Filesize
4KB

Download
memory/2928-80-0x00000270362C0000-0x00000270362C1000-memory.dmp

Filesize
4KB

Download
memory/3940-15-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/3940-8-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3940-71-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/3940-38-0x0000000007520000-0x0000000007B38000-memory.dmp

Filesize
6.1MB

Download
memory/3940-33-0x0000000006B90000-0x0000000006BAE000-memory.dmp

Filesize
120KB

Download
memory/3940-32-0x0000000006510000-0x0000000006586000-memory.dmp

Filesize
472KB

Download
memory/3940-13-0x00000000057D0000-0x0000000005862000-memory.dmp

Filesize
584KB

Download
memory/3940-41-0x0000000007490000-0x00000000074CC000-memory.dmp

Filesize
240KB

Download
memory/3940-39-0x0000000008DA0000-0x0000000008EAA000-memory.dmp

Filesize
1.0MB

Download
memory/3940-11-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/3940-12-0x0000000005CE0000-0x0000000006284000-memory.dmp

Filesize
5.6MB

Download
memory/3940-40-0x0000000007370000-0x0000000007382000-memory.dmp

Filesize
72KB

Download
memory/3940-14-0x00000000057A0000-0x00000000057AA000-memory.dmp

Filesize
40KB

Download
memory/3940-42-0x00000000074D0000-0x000000000751C000-memory.dmp

Filesize
304KB

Download