Overview

overview

10

Static

static

3

比特浏览器.exe

windows7-x64

10

比特浏览器.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-08-2024 01:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    比特浏览器.exe

  • Size

    211.3MB

  • MD5

    c79082db79ec40577a87c4c93a6747ac

  • SHA1

    51570058151ea7671e233d260f5616dc0f703b06

  • SHA256

    dfd2425ceeb436caabd8f19864ae72c36a6f17cd08a0698a3170ce0e3cf55635

  • SHA512

    924849177814125a10b8ef00522178ce7f9e8ae5e29c15cca29d3ca3104a73b87d97cd84d9e17394cb597904dccea0a8dc749afa8ca0da213a92c30a89dbc44a

  • SSDEEP

    6291456:M0FPk2/cH+tri6Hqtpv/S/7wbGQYinBZHkZf:MomHdy/7wb/YGZEN

Score
10/10
rhadamanthysdiscoverystealer

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • Suspicious use of NtCreateUserProcessOtherParentProcess 19 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2716
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1116
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2592
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3508
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3528
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1132
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:224
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
          PID:1940
        • C:\Windows\SysWOW64\openwith.exe
          "C:\Windows\system32\openwith.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4740
        • C:\Windows\SysWOW64\openwith.exe
          "C:\Windows\system32\openwith.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1332
        • C:\Windows\SysWOW64\openwith.exe
          "C:\Windows\system32\openwith.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3828
        • C:\Windows\SysWOW64\openwith.exe
          "C:\Windows\system32\openwith.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4764
        • C:\Windows\SysWOW64\openwith.exe
          "C:\Windows\system32\openwith.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3956
        • C:\Windows\SysWOW64\openwith.exe
          "C:\Windows\system32\openwith.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2960
        • C:\Windows\SysWOW64\openwith.exe
          "C:\Windows\system32\openwith.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1188
        • C:\Windows\SysWOW64\openwith.exe
          "C:\Windows\system32\openwith.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1216
        • C:\Windows\SysWOW64\openwith.exe
          "C:\Windows\system32\openwith.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2200
        • C:\Windows\SysWOW64\openwith.exe
          "C:\Windows\system32\openwith.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1728
        • C:\Windows\SysWOW64\openwith.exe
          "C:\Windows\system32\openwith.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:4640
        • C:\Windows\SysWOW64\openwith.exe
          "C:\Windows\system32\openwith.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1768
      • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
        "C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe"
        1⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4500
        • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
          C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
          2⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1564
          • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
            C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
            3⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1572
            • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
              C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2152
              • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
                C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
                5⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4860
                • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
                  C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
                  6⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:1952
                  • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
                    C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
                    7⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:1768
                    • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
                      C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
                      8⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:3956
                      • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
                        C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
                        9⤵
                        • System Location Discovery: System Language Discovery
                        PID:4112
                        • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
                          C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
                          10⤵
                          • System Location Discovery: System Language Discovery
                          PID:2808
                          • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
                            C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
                            11⤵
                            • System Location Discovery: System Language Discovery
                            PID:2312
                            • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
                              C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
                              12⤵
                              • System Location Discovery: System Language Discovery
                              PID:2248
                              • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
                                C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
                                13⤵
                                • System Location Discovery: System Language Discovery
                                PID:4644
                                • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
                                  C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
                                  14⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3416
                                  • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
                                    C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
                                    15⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:548
                                    • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
                                      C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
                                      16⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5000
                                      • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
                                        C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
                                        17⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4328
                                        • C:\Users\Admin\AppData\Local\Temp\比特浏览器.exe
                                          C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
                                          18⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1684
                                        • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                                          "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
                                          18⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:532
                                        • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                                          "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
                                          18⤵
                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:640
                                      • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                                        "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
                                        17⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1492
                                      • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                                        "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
                                        17⤵
                                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:4896
                                    • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                                      "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
                                      16⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2744
                                    • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                                      "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
                                      16⤵
                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:4188
                                  • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                                    "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
                                    15⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3652
                                  • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                                    "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
                                    15⤵
                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                    • Executes dropped EXE
                                    PID:1176
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 348
                                      16⤵
                                      • Program crash
                                      PID:2028
                                • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                                  "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
                                  14⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3972
                                • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                                  "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
                                  14⤵
                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                  • Executes dropped EXE
                                  PID:3284
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 344
                                    15⤵
                                    • Program crash
                                    PID:3956
                              • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                                "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
                                13⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1708
                              • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                                "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
                                13⤵
                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:1196
                            • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                              "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
                              12⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3316
                            • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                              "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
                              12⤵
                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1600
                          • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                            "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
                            11⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1360
                          • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                            "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
                            11⤵
                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1912
                        • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                          "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
                          10⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2520
                        • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                          "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
                          10⤵
                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2404
                      • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                        "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
                        9⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2960
                      • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                        "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
                        9⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4116
                    • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                      "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3452
                    • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                      "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
                      8⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3268
                  • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                    "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2900
                  • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                    "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
                    7⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3628
                • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                  "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2636
                • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                  "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
                  6⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4908
              • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                PID:1800
              • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
                "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
                5⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4920
            • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
              "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4352
            • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
              "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
              4⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4444
          • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
            "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1468
          • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
            "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
            3⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3728
        • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
          "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\config.ini"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:1952
        • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
          "C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe" "C:\Users\Admin\AppData\Local\Temp\bit_config.ini"
          2⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:452
      • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
        C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe "C:\Users\Admin\AppData\Local\Temp\config.ini"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:440
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3284 -ip 3284
        1⤵
          PID:4576
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1176 -ip 1176
          1⤵
            PID:5116

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
            Filesize

            717B

            MD5

            822467b728b7a66b081c91795373789a

            SHA1

            d8f2f02e1eef62485a9feffd59ce837511749865

            SHA256

            af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

            SHA512

            bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
            Filesize

            192B

            MD5

            5d15703b4798e3d8ef0134defbe056af

            SHA1

            91d7b9149e9ea74497fcc3a625c69172fa70274c

            SHA256

            a7e6d583ded8689d4e7e9785a6d8fd4eb8027896812ac2e62ddaca4bf0be3866

            SHA512

            2a9bcb6acb264d7f0f33f2c86f9a7cf512ed1c6632ec5d21a181d45a5c58b870c2adb59b4a94423d164217a09892e6f9df12e10353aaa6a494682c126110393c

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bitAnquan.exe.log
            Filesize

            521B

            MD5

            82fd1c0a56b8af6ad97d973328281509

            SHA1

            5b4d01cb01d2e5e62dd3026de96dcf37f5713b89

            SHA256

            a57a4a3a9e484a52872a0c105ac939bf91e97033f4e40c21e5fd03f0bf8bc548

            SHA512

            3ced1456093d84e9617e630d06128da646b41720e873822c37cb40b4698919c4c543250ab9f191d73d6aac1109206655faa179dd781a578e1f778fe92b9a4b08

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\alien\core.dll
            Filesize

            25KB

            MD5

            24b6950afd8663a46246044e6b09add8

            SHA1

            6444dab57d93ce987c22da66b3706d5d7fc226da

            SHA256

            9aa3ca96a84eb5606694adb58776c9e926020ef184828b6f7e6f9b50498f7071

            SHA512

            e1967e7e8c3d64b61451254da281415edf9946a6c8a46006f39ae091609c65666c376934b1bdcbd2a7f73adea7aa68e557694f804bf3bc3ce7854fa527e91740

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\bitAnquan.exe
            Filesize

            14KB

            MD5

            426dfd5ece3b41970773031637cd5539

            SHA1

            d0fe14f8dab89aaddac8b1c89b1cee48396ec636

            SHA256

            737f08702f00e78dbe78acbeda63b73d04c1f8e741c5282a9aa1409369b6efa8

            SHA512

            5c66ea3360115d6dcc71f6d624a886f3c992c5d30338880b0ba48db77dd7fa744b60a3d65fed63427ebb3a8bcf9b204e9ba1521d8c9f0e804ce0db76befa8935

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\bit_config.ini
            Filesize

            636KB

            MD5

            e095e9f3c34c9da1b8742fbc7a33cccc

            SHA1

            f7a3d7b3f060cfc304e9ba9b72aed90378b283f7

            SHA256

            09de22cf50dd7c1a0631c44894d6d3e79868b79c0306c45ab31f3459f2bb6e12

            SHA512

            dabc60c82d49e5586d0c2c7d429cdaf80ddbc9603e0140bca572dde1fac99fba16d6258af3125dd62e26a8cdcc051adfaf9109daed3ba41e89760d65f726179d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\config.ini
            Filesize

            911KB

            MD5

            564d32c904a1938fccad3050ce41fdad

            SHA1

            49d68c8e18f1a68a972674761d8182b8849a145b

            SHA256

            cb32a871256e57f25edf35294aa294caaff7911857f2fb596df66a0ea132c0a3

            SHA512

            9baea700c92fd1faa874addd444b14f6d4658d5ea1e9cb7604156f43703daf7f78934d2c6c496095ab4e2a599b8f7028f9223d128735967895555931baec807d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\lua5.1.dll
            Filesize

            164KB

            MD5

            24a0d2ef5b931a2a13341a2503b1de80

            SHA1

            6201347d1ded92d365126a1225768e11c33ee818

            SHA256

            fbbe7ee073d0290ac13c98b92a8405ea04dcc6837b4144889885dd70679e933f

            SHA512

            5e06f88bb3920cef40a4941efb3b4d3012edf868cc3042f9dbc1989c76b410b4e2da12c20ae2fbcffe5525b43aeca8875e51167d0ce041864d546fdb2e1fecd2

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsyC247.tmp\INetC.dll
            Filesize

            25KB

            MD5

            40d7eca32b2f4d29db98715dd45bfac5

            SHA1

            124df3f617f562e46095776454e1c0c7bb791cc7

            SHA256

            85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

            SHA512

            5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\比特浏览器 Setup 7.0.1.exe
            Filesize

            64.1MB

            MD5

            ab38851b35e6a58ac59ea42d8835fae0

            SHA1

            a16aea2c23dd89209f4f870c09f34fe05e69d0ee

            SHA256

            69826b8c4790c6714a00a16285c2ee93a81fa5286f1d1788f3ecdd008634fb31

            SHA512

            f36b2651b48638f8449083a1e1210ab5ab6c242ea270d9d1e7498977949436f191a725979955384251a20b2599b1b2a224c9799ff8c0f350a01ca31c99526fa2

            Download Submit

          • memory/224-228-0x0000000002BB0000-0x0000000002FB0000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/440-121-0x0000000005700000-0x000000000579C000-memory.dmp

            Filesize

            624KB

            Download

          • memory/440-122-0x00000000057B0000-0x0000000005816000-memory.dmp

            Filesize

            408KB

            Download

          • memory/452-50-0x00000000006D0000-0x00000000006D9000-memory.dmp

            Filesize

            36KB

            Download

          • memory/452-57-0x0000000076540000-0x0000000076755000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/452-54-0x00000000022C0000-0x00000000026C0000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/452-51-0x00000000022C0000-0x00000000026C0000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/452-48-0x00000000022C0000-0x00000000026C0000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/452-47-0x00000000006D0000-0x00000000006D9000-memory.dmp

            Filesize

            36KB

            Download

          • memory/452-52-0x00000000022C0000-0x00000000026C0000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/452-53-0x0000000000700000-0x0000000000728000-memory.dmp

            Filesize

            160KB

            Download

          • memory/452-55-0x00007FFAED170000-0x00007FFAED365000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/452-63-0x00000000022C0000-0x00000000026C0000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/1116-62-0x0000000002B40000-0x0000000002F40000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/1116-59-0x0000000000ED0000-0x0000000000ED9000-memory.dmp

            Filesize

            36KB

            Download

          • memory/1116-64-0x00007FFAED170000-0x00007FFAED365000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/1116-66-0x0000000076540000-0x0000000076755000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/1132-203-0x0000000002530000-0x0000000002930000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/1132-204-0x00007FFAED170000-0x00007FFAED365000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/1132-206-0x0000000076540000-0x0000000076755000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/1952-67-0x0000000005060000-0x0000000005067000-memory.dmp

            Filesize

            28KB

            Download

          • memory/1952-61-0x0000000002610000-0x0000000002632000-memory.dmp

            Filesize

            136KB

            Download

          • memory/1952-58-0x0000000002590000-0x00000000025F8000-memory.dmp

            Filesize

            416KB

            Download

          • memory/1952-49-0x00000000021E0000-0x0000000002219000-memory.dmp

            Filesize

            228KB

            Download

          • memory/2592-109-0x00007FFAED170000-0x00007FFAED365000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/2592-108-0x0000000002170000-0x0000000002570000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/2592-111-0x0000000076540000-0x0000000076755000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/3508-144-0x00000000025E0000-0x00000000029E0000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/3508-147-0x0000000076540000-0x0000000076755000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/3508-145-0x00007FFAED170000-0x00007FFAED365000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/3528-179-0x00007FFAED170000-0x00007FFAED365000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/3528-181-0x0000000076540000-0x0000000076755000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/3528-178-0x00000000020F0000-0x00000000024F0000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/3628-220-0x00007FFAED170000-0x00007FFAED365000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/3628-219-0x0000000002140000-0x0000000002540000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/3628-222-0x0000000076540000-0x0000000076755000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/3628-226-0x0000000002B80000-0x0000000002F80000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/3728-100-0x00000000021B0000-0x00000000025B0000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/3728-103-0x0000000076540000-0x0000000076755000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/3728-101-0x00007FFAED170000-0x00007FFAED365000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4444-137-0x00007FFAED170000-0x00007FFAED365000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4444-141-0x0000000076540000-0x0000000076755000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/4444-136-0x00000000021B0000-0x00000000025B0000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/4908-196-0x00007FFAED170000-0x00007FFAED365000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4908-200-0x0000000076540000-0x0000000076755000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/4908-195-0x0000000002110000-0x0000000002510000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/4920-171-0x00007FFAED170000-0x00007FFAED365000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4920-175-0x0000000076540000-0x0000000076755000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/4920-170-0x00000000020C0000-0x00000000024C0000-memory.dmp

            Filesize

            4.0MB

            Download