umbral | hxxps://gofile[.]io/d/dlnAjU

Resubmissions

25-10-2024 13:58

241025-q97yla1hjj 10

25-10-2024 13:55

241025-q8fsqa1gqm 3

Analysis

max time kernel
26s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-10-2024 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/dlnAjU

Score

10^/10

umbral discovery stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023cbf-66.dat	family_umbral
behavioral1/memory/5380-105-0x000001DE32860000-0x000001DE328A0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
5380	R3Dline.exe
5724	R3Dline.exe
5840	R3Dline.exe
1396	R3Dline.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
51	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 64305.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1848	msedge.exe
1848	msedge.exe
1004	msedge.exe
1004	msedge.exe
3576	identity_helper.exe
3576	identity_helper.exe
5220	msedge.exe
5220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5380	R3Dline.exe
Token: SeIncreaseQuotaPrivilege	5616	wmic.exe
Token: SeSecurityPrivilege	5616	wmic.exe
Token: SeTakeOwnershipPrivilege	5616	wmic.exe
Token: SeLoadDriverPrivilege	5616	wmic.exe
Token: SeSystemProfilePrivilege	5616	wmic.exe
Token: SeSystemtimePrivilege	5616	wmic.exe
Token: SeProfSingleProcessPrivilege	5616	wmic.exe
Token: SeIncBasePriorityPrivilege	5616	wmic.exe
Token: SeCreatePagefilePrivilege	5616	wmic.exe
Token: SeBackupPrivilege	5616	wmic.exe
Token: SeRestorePrivilege	5616	wmic.exe
Token: SeShutdownPrivilege	5616	wmic.exe
Token: SeDebugPrivilege	5616	wmic.exe
Token: SeSystemEnvironmentPrivilege	5616	wmic.exe
Token: SeRemoteShutdownPrivilege	5616	wmic.exe
Token: SeUndockPrivilege	5616	wmic.exe
Token: SeManageVolumePrivilege	5616	wmic.exe
Token: 33	5616	wmic.exe
Token: 34	5616	wmic.exe
Token: 35	5616	wmic.exe
Token: 36	5616	wmic.exe
Token: SeIncreaseQuotaPrivilege	5616	wmic.exe
Token: SeSecurityPrivilege	5616	wmic.exe
Token: SeTakeOwnershipPrivilege	5616	wmic.exe
Token: SeLoadDriverPrivilege	5616	wmic.exe
Token: SeSystemProfilePrivilege	5616	wmic.exe
Token: SeSystemtimePrivilege	5616	wmic.exe
Token: SeProfSingleProcessPrivilege	5616	wmic.exe
Token: SeIncBasePriorityPrivilege	5616	wmic.exe
Token: SeCreatePagefilePrivilege	5616	wmic.exe
Token: SeBackupPrivilege	5616	wmic.exe
Token: SeRestorePrivilege	5616	wmic.exe
Token: SeShutdownPrivilege	5616	wmic.exe
Token: SeDebugPrivilege	5616	wmic.exe
Token: SeSystemEnvironmentPrivilege	5616	wmic.exe
Token: SeRemoteShutdownPrivilege	5616	wmic.exe
Token: SeUndockPrivilege	5616	wmic.exe
Token: SeManageVolumePrivilege	5616	wmic.exe
Token: 33	5616	wmic.exe
Token: 34	5616	wmic.exe
Token: 35	5616	wmic.exe
Token: 36	5616	wmic.exe
Token: SeDebugPrivilege	5724	R3Dline.exe
Token: SeIncreaseQuotaPrivilege	5872	wmic.exe
Token: SeSecurityPrivilege	5872	wmic.exe
Token: SeTakeOwnershipPrivilege	5872	wmic.exe
Token: SeLoadDriverPrivilege	5872	wmic.exe
Token: SeSystemProfilePrivilege	5872	wmic.exe
Token: SeSystemtimePrivilege	5872	wmic.exe
Token: SeProfSingleProcessPrivilege	5872	wmic.exe
Token: SeIncBasePriorityPrivilege	5872	wmic.exe
Token: SeCreatePagefilePrivilege	5872	wmic.exe
Token: SeBackupPrivilege	5872	wmic.exe
Token: SeRestorePrivilege	5872	wmic.exe
Token: SeShutdownPrivilege	5872	wmic.exe
Token: SeDebugPrivilege	5872	wmic.exe
Token: SeSystemEnvironmentPrivilege	5872	wmic.exe
Token: SeRemoteShutdownPrivilege	5872	wmic.exe
Token: SeUndockPrivilege	5872	wmic.exe
Token: SeManageVolumePrivilege	5872	wmic.exe
Token: 33	5872	wmic.exe
Token: 34	5872	wmic.exe
Token: 35	5872	wmic.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 4800	1004	msedge.exe	86
PID 1004 wrote to memory of 4800	1004	msedge.exe	86
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 3116	1004	msedge.exe	87
PID 1004 wrote to memory of 1848	1004	msedge.exe	88
PID 1004 wrote to memory of 1848	1004	msedge.exe	88
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89
PID 1004 wrote to memory of 3848	1004	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/dlnAjU
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe56146f8,0x7fffe5614708,0x7fffe5614718
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,13775022500899112028,17417106818071711702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5220
- C:\Users\Admin\Downloads\R3Dline.exe
  "C:\Users\Admin\Downloads\R3Dline.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5380
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5616
- C:\Users\Admin\Downloads\R3Dline.exe
  "C:\Users\Admin\Downloads\R3Dline.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5724
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5872
- C:\Users\Admin\Downloads\R3Dline.exe
  "C:\Users\Admin\Downloads\R3Dline.exe"
  2⤵
  - Executes dropped EXE
  PID:5840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3912

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6040

C:\Users\Admin\Downloads\R3Dline.exe
"C:\Users\Admin\Downloads\R3Dline.exe"
1⤵
- Executes dropped EXE
PID:1396
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:5268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\R3Dline.exe.log

Filesize
1KB

MD5
8094b248fe3231e48995c2be32aeb08c

SHA1
2fe06e000ebec919bf982d033c5d1219c1f916b6

SHA256
136c30d964f4abbb5279bdc86d0e00578333782f15f05f0d2d050730dcb7a9bc

SHA512
bf27a3822008796370e2c506c910a40992b9240606ea1bc19f683b2fee86b81897660ac0cf8e746ca093dae9e408949e2e9002ded75678a69f020d3b0452801f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
dca151dff78a2dca0804b056d7e91a03

SHA1
ae6faf6f3153988bc0ab251ad0e364035ced9f62

SHA256
dcd552bfa4228dd2ca9ac8ba08635928d37f08a4748753abae8be6796429a285

SHA512
49dd4983024f8bfaa0dce3e49fadc1af35067a150654ac126f79065bff779afaf0618a167d03a7e119e8cf1e480aa8a454d297187e690607e4b59e2f219915c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3859e263c7fd80ab8a25ee71b01e7314

SHA1
ef4fe61d939998aebe5f59ca8b7ee5f1534f7789

SHA256
0f986745e7d39b0ff615371879d87fdc14f556912b5ff6cdb6a2283c35b9b09f

SHA512
6f00e77afa32efb20adbb4f6fb6fbb7aa0ddf2d13fde3bced36fc651e1c90080946f8a8b8f844d2b95400893e3af49a00d0f9b91c0731ae9b48915571d005f88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f6e90dd481fae8ad50ce1730555f1cd6

SHA1
0431da3350c987611dd5ea0616b32f67b3e37e06

SHA256
34745284ef4bfb31c26301c9ce7582125909c504aec9e22fb7ecfbbcf3f64a2a

SHA512
fd28e8de6060305c1ea9c6ff0d42f73f9976b666adc55a7328ae285cab827dcd3ba11a0646d5899c8bc7ff84be229d65cb5dc393aa22aab5890b3f9021f16ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
adb99340c5d53024938b5ae1842b1389

SHA1
f2307b61e1c5d85527d33377f0eb11800bbc787f

SHA256
a419f5a06f1b5c501c29567cd333fd022e7e2fe29c8192078a14a0b93c3be27f

SHA512
5708f54b331c1f95b9abd41c072acd8c39efc6ec22fdc2f4a95ee6cacd4e6bd26ad76ed6ebdc64d5d388a695b88ee1e1fdcc02f315849c495d2938b540c1899c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3d730f678e33fcf0f483050fe9af3ecd

SHA1
e6fe2c9e6f1b6c1ead23a3fe9b87a7042f7f2eb0

SHA256
e99e2300255a0f126829241547deb0fe573ac85fe41bca8494da741092e6856b

SHA512
c550261a275c65f82ac1f2ba26483f15238de39ba5ddc85e571378b9741064c1b5df54b84cf097795c6282141b84df53f09130f3aa9704d4ca5d7a755806390f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 64305.crdownload

Filesize
229KB

MD5
f82b822b5c535cf36ab9be584766543a

SHA1
3488159fa2bed3613beb77c37aa485e88929f538

SHA256
51a46c0928069f08fe8adb976d7b32afe14dafb238d8461f20607f25adc00766

SHA512
4845ea9f4dbadef52e9276ff5ddcbe1c2302e9df99078ac0dc3daff6b6ef14080d0fa4a6fb5ec1da7912d788276976716529d5b9ece2e885e458be8142656772

Download Submit
memory/5380-105-0x000001DE32860000-0x000001DE328A0000-memory.dmp

Filesize
256KB

Download