Analysis
-
max time kernel
297s -
max time network
266s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-09-2024 05:02
Static task
static1
Behavioral task
behavioral1
Sample
331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe
Resource
win10-20240404-en
General
-
Target
331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe
-
Size
1.8MB
-
MD5
db13ad885e5bc6e6425d95a59c5e1387
-
SHA1
1b7a0440aa97eb0ecc339dd2c71a299c658bb55f
-
SHA256
331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872
-
SHA512
83edefe3c5e7828a78b0a3bb58a9dee8030466a127bd594dc2060db2f637f17ba6222bea2836bbc44a5c61094be6ba0858ff63fb965dbd97123ff1ee37e5a49a
-
SSDEEP
49152:ZeuWMvW9TU4A1QTQNgYHBn5pVIyz4aWy40UX3CzO9enl:uK31RRHBLj4Vy41Hnq
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
redline
LiveTraffic
95.179.250.45:26212
Extracted
redline
@CLOUDYTTEAM
65.21.18.51:45580
Extracted
stealc
default2
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
stealc
default
http://91.202.233.158
-
url_path
/e96ea2db21fa9a1b.php
Extracted
redline
bundle
185.215.113.67:15206
Extracted
cryptbot
sevtv17sb.top
analforeverlovyu.top
-
url_path
/v1/upload.php
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1924-50-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/1924-49-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/1924-48-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/1924-43-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/1924-46-0x0000000000400000-0x0000000000452000-memory.dmp family_redline C:\Users\Admin\AppData\Roaming\dw7Dr5tUtQ.exe family_redline behavioral1/memory/1436-114-0x0000000000FE0000-0x0000000001032000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe family_redline behavioral1/memory/1440-368-0x0000000000BB0000-0x0000000000C02000-memory.dmp family_redline -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exeaxplong.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
axplong.exe331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe -
Executes dropped EXE 23 IoCs
Processes:
axplong.exegold.execrypteda.exeYCaBymIoW3.exedw7Dr5tUtQ.exeNework.exeHkbsse.exestealc_default2.exejoffer2.exeSеtup.exeneedmoney.exepenis.exesvchost015.exebundle.exeacentric.exeRMS1.exefilename.exeservice123.exeservice123.exeservice123.exeservice123.exeservice123.exeservice123.exepid process 2552 axplong.exe 1192 gold.exe 2368 crypteda.exe 960 YCaBymIoW3.exe 1436 dw7Dr5tUtQ.exe 1732 Nework.exe 760 Hkbsse.exe 1060 stealc_default2.exe 236 joffer2.exe 2848 Sеtup.exe 2804 needmoney.exe 2988 penis.exe 2072 svchost015.exe 1440 bundle.exe 2892 acentric.exe 2844 RMS1.exe 5488 filename.exe 5556 service123.exe 5660 service123.exe 6016 service123.exe 844 service123.exe 3572 service123.exe 4312 service123.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
axplong.exe331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine 331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe -
Loads dropped DLL 37 IoCs
Processes:
331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exeaxplong.exeRegAsm.exeNework.exeHkbsse.exestealc_default2.exeneedmoney.exebundle.exejoffer2.exeSеtup.exeservice123.exeWerFault.exeservice123.exeservice123.exeservice123.exeservice123.exepid process 1868 331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe 2552 axplong.exe 2552 axplong.exe 2232 RegAsm.exe 2232 RegAsm.exe 2552 axplong.exe 1732 Nework.exe 2552 axplong.exe 2552 axplong.exe 760 Hkbsse.exe 760 Hkbsse.exe 1060 stealc_default2.exe 1060 stealc_default2.exe 2552 axplong.exe 2552 axplong.exe 2552 axplong.exe 2552 axplong.exe 2552 axplong.exe 2804 needmoney.exe 2552 axplong.exe 2552 axplong.exe 2552 axplong.exe 1440 bundle.exe 236 joffer2.exe 236 joffer2.exe 2848 Sеtup.exe 2848 Sеtup.exe 5660 service123.exe 5728 WerFault.exe 5728 WerFault.exe 5728 WerFault.exe 5728 WerFault.exe 5728 WerFault.exe 6016 service123.exe 844 service123.exe 3572 service123.exe 4312 service123.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
acentric.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update" acentric.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exeaxplong.exepid process 1868 331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe 2552 axplong.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
gold.execrypteda.exeneedmoney.exedescription pid process target process PID 1192 set thread context of 1924 1192 gold.exe RegAsm.exe PID 2368 set thread context of 2232 2368 crypteda.exe RegAsm.exe PID 2804 set thread context of 2072 2804 needmoney.exe svchost015.exe -
Drops file in Windows directory 2 IoCs
Processes:
331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exeNework.exedescription ioc process File created C:\Windows\Tasks\axplong.job 331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe File created C:\Windows\Tasks\Hkbsse.job Nework.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Nework.exeHkbsse.exestealc_default2.exebundle.exeacentric.exeSеtup.exeschtasks.exegold.exeRegAsm.exeYCaBymIoW3.exedw7Dr5tUtQ.exeneedmoney.exepenis.exeschtasks.exeaxplong.exeRegAsm.execrypteda.exesvchost015.exefilename.exe331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exejoffer2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nework.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkbsse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stealc_default2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bundle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acentric.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sеtup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gold.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCaBymIoW3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw7Dr5tUtQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language needmoney.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language penis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crypteda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost015.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language filename.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language joffer2.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
joffer2.exeSеtup.exestealc_default2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 joffer2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString joffer2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Sеtup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Sеtup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 stealc_default2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString stealc_default2.exe -
Processes:
RegAsm.exeYCaBymIoW3.exebundle.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 YCaBymIoW3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000020000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 YCaBymIoW3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 YCaBymIoW3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 190000000100000010000000dbd91ea86008fd8536f2b37529666c7b0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 YCaBymIoW3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 bundle.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 bundle.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5684 schtasks.exe 5576 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exeaxplong.exeYCaBymIoW3.exeRegAsm.exestealc_default2.exedw7Dr5tUtQ.exepenis.exebundle.exeRMS1.exepid process 1868 331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe 2552 axplong.exe 960 YCaBymIoW3.exe 1924 RegAsm.exe 1924 RegAsm.exe 1924 RegAsm.exe 1060 stealc_default2.exe 1436 dw7Dr5tUtQ.exe 1436 dw7Dr5tUtQ.exe 1436 dw7Dr5tUtQ.exe 1060 stealc_default2.exe 2988 penis.exe 1440 bundle.exe 1440 bundle.exe 1440 bundle.exe 2844 RMS1.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
YCaBymIoW3.exeRegAsm.exedw7Dr5tUtQ.exepenis.exeRMS1.exebundle.exeacentric.exedescription pid process Token: SeDebugPrivilege 960 YCaBymIoW3.exe Token: SeBackupPrivilege 960 YCaBymIoW3.exe Token: SeSecurityPrivilege 960 YCaBymIoW3.exe Token: SeSecurityPrivilege 960 YCaBymIoW3.exe Token: SeSecurityPrivilege 960 YCaBymIoW3.exe Token: SeSecurityPrivilege 960 YCaBymIoW3.exe Token: SeDebugPrivilege 1924 RegAsm.exe Token: SeDebugPrivilege 1436 dw7Dr5tUtQ.exe Token: SeDebugPrivilege 2988 penis.exe Token: SeBackupPrivilege 2988 penis.exe Token: SeSecurityPrivilege 2988 penis.exe Token: SeSecurityPrivilege 2988 penis.exe Token: SeSecurityPrivilege 2988 penis.exe Token: SeSecurityPrivilege 2988 penis.exe Token: SeDebugPrivilege 2844 RMS1.exe Token: SeDebugPrivilege 1440 bundle.exe Token: SeDebugPrivilege 2892 acentric.exe Token: SeDebugPrivilege 2844 RMS1.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exeNework.exepid process 1868 331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe 1732 Nework.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exeaxplong.exegold.execrypteda.exeRegAsm.exeNework.exeHkbsse.exedescription pid process target process PID 1868 wrote to memory of 2552 1868 331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe axplong.exe PID 1868 wrote to memory of 2552 1868 331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe axplong.exe PID 1868 wrote to memory of 2552 1868 331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe axplong.exe PID 1868 wrote to memory of 2552 1868 331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe axplong.exe PID 2552 wrote to memory of 1192 2552 axplong.exe gold.exe PID 2552 wrote to memory of 1192 2552 axplong.exe gold.exe PID 2552 wrote to memory of 1192 2552 axplong.exe gold.exe PID 2552 wrote to memory of 1192 2552 axplong.exe gold.exe PID 1192 wrote to memory of 1924 1192 gold.exe RegAsm.exe PID 1192 wrote to memory of 1924 1192 gold.exe RegAsm.exe PID 1192 wrote to memory of 1924 1192 gold.exe RegAsm.exe PID 1192 wrote to memory of 1924 1192 gold.exe RegAsm.exe PID 1192 wrote to memory of 1924 1192 gold.exe RegAsm.exe PID 1192 wrote to memory of 1924 1192 gold.exe RegAsm.exe PID 1192 wrote to memory of 1924 1192 gold.exe RegAsm.exe PID 1192 wrote to memory of 1924 1192 gold.exe RegAsm.exe PID 1192 wrote to memory of 1924 1192 gold.exe RegAsm.exe PID 1192 wrote to memory of 1924 1192 gold.exe RegAsm.exe PID 1192 wrote to memory of 1924 1192 gold.exe RegAsm.exe PID 1192 wrote to memory of 1924 1192 gold.exe RegAsm.exe PID 2552 wrote to memory of 2368 2552 axplong.exe crypteda.exe PID 2552 wrote to memory of 2368 2552 axplong.exe crypteda.exe PID 2552 wrote to memory of 2368 2552 axplong.exe crypteda.exe PID 2552 wrote to memory of 2368 2552 axplong.exe crypteda.exe PID 2368 wrote to memory of 2232 2368 crypteda.exe RegAsm.exe PID 2368 wrote to memory of 2232 2368 crypteda.exe RegAsm.exe PID 2368 wrote to memory of 2232 2368 crypteda.exe RegAsm.exe PID 2368 wrote to memory of 2232 2368 crypteda.exe RegAsm.exe PID 2368 wrote to memory of 2232 2368 crypteda.exe RegAsm.exe PID 2368 wrote to memory of 2232 2368 crypteda.exe RegAsm.exe PID 2368 wrote to memory of 2232 2368 crypteda.exe RegAsm.exe PID 2368 wrote to memory of 2232 2368 crypteda.exe RegAsm.exe PID 2368 wrote to memory of 2232 2368 crypteda.exe RegAsm.exe PID 2368 wrote to memory of 2232 2368 crypteda.exe RegAsm.exe PID 2368 wrote to memory of 2232 2368 crypteda.exe RegAsm.exe PID 2368 wrote to memory of 2232 2368 crypteda.exe RegAsm.exe PID 2368 wrote to memory of 2232 2368 crypteda.exe RegAsm.exe PID 2368 wrote to memory of 2232 2368 crypteda.exe RegAsm.exe PID 2232 wrote to memory of 960 2232 RegAsm.exe YCaBymIoW3.exe PID 2232 wrote to memory of 960 2232 RegAsm.exe YCaBymIoW3.exe PID 2232 wrote to memory of 960 2232 RegAsm.exe YCaBymIoW3.exe PID 2232 wrote to memory of 960 2232 RegAsm.exe YCaBymIoW3.exe PID 2232 wrote to memory of 1436 2232 RegAsm.exe dw7Dr5tUtQ.exe PID 2232 wrote to memory of 1436 2232 RegAsm.exe dw7Dr5tUtQ.exe PID 2232 wrote to memory of 1436 2232 RegAsm.exe dw7Dr5tUtQ.exe PID 2232 wrote to memory of 1436 2232 RegAsm.exe dw7Dr5tUtQ.exe PID 2552 wrote to memory of 1732 2552 axplong.exe Nework.exe PID 2552 wrote to memory of 1732 2552 axplong.exe Nework.exe PID 2552 wrote to memory of 1732 2552 axplong.exe Nework.exe PID 2552 wrote to memory of 1732 2552 axplong.exe Nework.exe PID 1732 wrote to memory of 760 1732 Nework.exe Hkbsse.exe PID 1732 wrote to memory of 760 1732 Nework.exe Hkbsse.exe PID 1732 wrote to memory of 760 1732 Nework.exe Hkbsse.exe PID 1732 wrote to memory of 760 1732 Nework.exe Hkbsse.exe PID 2552 wrote to memory of 1060 2552 axplong.exe stealc_default2.exe PID 2552 wrote to memory of 1060 2552 axplong.exe stealc_default2.exe PID 2552 wrote to memory of 1060 2552 axplong.exe stealc_default2.exe PID 2552 wrote to memory of 1060 2552 axplong.exe stealc_default2.exe PID 760 wrote to memory of 236 760 Hkbsse.exe joffer2.exe PID 760 wrote to memory of 236 760 Hkbsse.exe joffer2.exe PID 760 wrote to memory of 236 760 Hkbsse.exe joffer2.exe PID 760 wrote to memory of 236 760 Hkbsse.exe joffer2.exe PID 2552 wrote to memory of 2848 2552 axplong.exe Sеtup.exe PID 2552 wrote to memory of 2848 2552 axplong.exe Sеtup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe"C:\Users\Admin\AppData\Local\Temp\331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Roaming\YCaBymIoW3.exe"C:\Users\Admin\AppData\Roaming\YCaBymIoW3.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960 -
C:\Users\Admin\AppData\Roaming\dw7Dr5tUtQ.exe"C:\Users\Admin\AppData\Roaming\dw7Dr5tUtQ.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe"C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:236 -
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"6⤵
- Executes dropped EXE
PID:5556 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5660 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\filename.exe"C:\Users\Admin\AppData\Local\Temp\filename.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe"C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe"C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2844 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2844 -s 6044⤵
- Loads dropped DLL
PID:5728
-
C:\Windows\system32\taskeng.exetaskeng.exe {795613FA-2D57-4382-8759-4CE3CC64CFD2} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]1⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4312
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576117679af263f571acaff8f51ac7273
SHA14bd63fe90cb5d01f9384d7395cfd393801403ae1
SHA256777bac385212cebd7cfb7bdfd0e3d9e189d2c4b3e98153a0d4d37ff250233e06
SHA51283c294ca5f26e3137f48e8666878c0266f64f1c974cfb04248be38fe997af6bef8c7898ae13a63572a34c960deac0e048bad703b1a24c615835f108307b82634
-
Filesize
313KB
MD52d647cf43622ed10b6d733bb5f048fc3
SHA16b9c5f77a9ef064a23e5018178f982570cbc64c6
SHA25641426dd54fcabbf30a68b2aa11aa4f61f3862bea83109d3e3c50cfebed1359e6
SHA51262400f1e9646268f0326aab5b95efacb0303f4c5879cccf0cbb24d1f66d0db40d0fdfebb09ba785b5dfd54df2d32e8aab48c1f5f333956b606112de68635ac3a
-
Filesize
1.1MB
MD58e74497aff3b9d2ddb7e7f819dfc69ba
SHA11d18154c206083ead2d30995ce2847cbeb6cdbc1
SHA256d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66
SHA5129aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97
-
Filesize
416KB
MD5f5d7b79ee6b6da6b50e536030bcc3b59
SHA1751b555a8eede96d55395290f60adc43b28ba5e2
SHA2562f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
-
Filesize
6.3MB
MD55f1dffeff8714e88b493506256db8f8a
SHA1d554da350b41da8556ce83ed851b975d2325a3d2
SHA256e372a2d6ea5d76b0ffbccfa5b6574b910826fb5b5998e8e5cc4dcd49f6dffff0
SHA5124bf57a4af1514111e301f8a1c8f3e2c145d078ba45a94edb71af6b1f9ca6dcfb3bd35d5114936f5c97ab4b1561b7b5afd4bfcc6d37b2f39b3aca0c96e0b28960
-
Filesize
187KB
MD57a02aa17200aeac25a375f290a4b4c95
SHA17cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6
-
Filesize
6.3MB
MD545b55d1e5d2bf60cc572f541ae6fa7d1
SHA12329f56147a299bcdbf20520e626cc8253e49a8d
SHA256039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8
SHA5125483964e050b2be073d3cf966b6dd6271556d4adfb420fb9ecf81f42f27cd06727016292dceb9a282f9fdcb451507309d1a78f58dd5d84e3022c0ea20c58dbe2
-
Filesize
3.6MB
MD57e6a519688246fe1180f35fe0d25d370
SHA18e8719ac897dfef7305311dc216f570af40709af
SHA25632a927e9b33371b82bae9f02b5ebf07c19ae5a3a7e3c0cd3fcbee7cfff7f257a
SHA512a751e911eb254749a3c8c98740f455a5be32ce1af94dc90eba8fc677d6d7379303f80247748dfcfe9c8570edb3488a5af97fa7ff29c815bec6824dd491e27972
-
Filesize
402KB
MD562eab4110407c75c3f17b9d40a41462c
SHA1ee0e876f23db4fd5c9b7fc02b51d9ae9f2daa49e
SHA256e71efcdf203c7da30c32b3f42dc7f04587dc071a71d4e007d6b3424421da197c
SHA5120ec379ce8f1aa55648d53aa9dec014b8dcdf9782c6547caceaa9eb7c6e0780c35e6f7eec4789fa73258b78425f3314c8bf940d68e8fa925d437a2fdb49a396fd
-
Filesize
304KB
MD530daa686c1f31cc4833bd3d7283d8cdc
SHA170f74571fafe1b359cfe9ce739c3752e35d16cf5
SHA256504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822
SHA5129f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9
-
Filesize
454KB
MD537d198ad751d31a71acc9cb28ed0c64e
SHA18eb519b7a6df66d84c566605da9a0946717a921d
SHA2561ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde
SHA51260923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96
-
Filesize
1.4MB
MD503b1ed4c105e5f473357dad1df17cf98
SHA1faf5046ff19eafd3a59dcf85be30496f90b5b6b1
SHA2566be5916900ffda93154db8c2c5dd28b9150f4c3aef74dbd4fd86390bc72845ba
SHA5123f6f8a12d000b913dc8240542be6a64f991dc0802313782d038b971219308e7d381d4d96c25d98ee1b05bca127a9bbc69e3bd54f1722d8381f8060bb506a9765
-
Filesize
1.8MB
MD5db13ad885e5bc6e6425d95a59c5e1387
SHA11b7a0440aa97eb0ecc339dd2c71a299c658bb55f
SHA256331160edb6288eac726c96a3f41e6a110f8d1978e10086f2fd69ec47c090a872
SHA51283edefe3c5e7828a78b0a3bb58a9dee8030466a127bd594dc2060db2f637f17ba6222bea2836bbc44a5c61094be6ba0858ff63fb965dbd97123ff1ee37e5a49a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
5.3MB
MD536a627b26fae167e6009b4950ff15805
SHA1f3cb255ab3a524ee05c8bab7b4c01c202906b801
SHA256a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a
SHA5122133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094
-
Filesize
300.0MB
MD54d4cab141394c0c233a167911d956123
SHA13de65d4b6a9b3f254b032750a9f484e1dff92454
SHA2568a739c03d8fa5f84f4b4ed636da73b6491d806d87cafe23baff3a62143eb5628
SHA512e0c50fe2ca6c5db61d13dc396963b2279fb66bb4e89c57dd3d7728363f2845b4cba362a39e5bd101b602170edfcd13e3082d0cdfba34287a07959cb02e8ffd7a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3290804112-2823094203-3137964600-1000\76b53b3ec448f7ccdda2063b15d2bfc3_94ea1d76-6d7e-4d9e-abc7-ef9a6a2a9269
Filesize2KB
MD59fec560e78863429f10952bcf3b8fc55
SHA1272a276b53c87946f4e472580b315b55a9c4a1e7
SHA2563049fd847ecf802628d18c96a9974455d4be1b99abb4e6f0858cdcacd0783894
SHA512511df0194eaeb16bb9ed62126aa80636d624a7919caac91b9338c7834e6be39977dd711a049aa19a4ba40e6c91bb8b0b2179f28f70358bc63c20b7519e86cee6
-
Filesize
304KB
MD530f46f4476cdc27691c7fdad1c255037
SHA1b53415af5d01f8500881c06867a49a5825172e36
SHA2563a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0
SHA512271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f
-
Filesize
2KB
MD58a5a77f0e91ce3dd2a4db28c1c9658b9
SHA1dd2a1360b38457fb0273cbde7694836ef6083d79
SHA256211bd08182c31551c928793dabff008ff34cc6d9b8f62ef06e1b67787fc25005
SHA51222101683b76a73fc2a4b59f93a25f5d491e1886ad1dbd163e9a6bcbd730b2ce69ddfe7b5a7df2280ff3ee0bbdeebc419248335fb675e78d9bae1a84fe9fa9431
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
2.9MB
MD5b826dd92d78ea2526e465a34324ebeea
SHA1bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA2567824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA5121ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17
-
Filesize
544KB
MD588367533c12315805c059e688e7cdfe9
SHA164a107adcbac381c10bd9c5271c2087b7aa369ec
SHA256c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9
SHA5127a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714