Analysis
-
max time kernel
60s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-11-2024 19:05
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win10v2004-20241007-en
General
-
Target
setup_installer.exe
-
Size
4.8MB
-
MD5
ec02f21e9609989b9dc71c981be1b38d
-
SHA1
b06e15ef538626113b9a5cfbe70cb31480f2ca65
-
SHA256
ffb56fbf4fcddd75123912dc66dab62c57bb790bb3f66fbff5f247760755fd06
-
SHA512
20d8b49e3b770c92d084b319c6c1f0e4e643b42f0e9cb8b5d117344abce63607b30cbcdfb391ce7a82cf03aa0f4c20c419129d5394ecea4f40ed495bd3dbbd46
-
SSDEEP
98304:xyCvLUBsgTFOLElweJs9kAo4K25044DU6GxctGSswIm5W8Nneh:xDLUCgROol6kU0TGW3Leh
Malware Config
Extracted
nullmixer
http://sornx.xyz/
Extracted
privateloader
http://37.0.10.214/proxies.txt
http://37.0.10.244/server.txt
http://wfsdragon.ru/api/setStats.php
37.0.10.237
Extracted
redline
pub1
viacetequn.site:80
Signatures
-
CryptBot payload 4 IoCs
resource yara_rule behavioral3/memory/1752-251-0x0000000005EA0000-0x0000000005F43000-memory.dmp family_cryptbot behavioral3/memory/1752-255-0x0000000005EA0000-0x0000000005F43000-memory.dmp family_cryptbot behavioral3/memory/1752-254-0x0000000005EA0000-0x0000000005F43000-memory.dmp family_cryptbot behavioral3/memory/1752-253-0x0000000005EA0000-0x0000000005F43000-memory.dmp family_cryptbot -
Cryptbot family
-
Nullmixer family
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral3/memory/696-175-0x0000000004A60000-0x0000000004A82000-memory.dmp family_redline behavioral3/memory/696-183-0x0000000004DD0000-0x0000000004DF0000-memory.dmp family_redline -
Redline family
-
SectopRAT payload 2 IoCs
resource yara_rule behavioral3/memory/696-175-0x0000000004A60000-0x0000000004A82000-memory.dmp family_sectoprat behavioral3/memory/696-183-0x0000000004DD0000-0x0000000004DF0000-memory.dmp family_sectoprat -
Sectoprat family
-
Vidar family
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral3/memory/1160-239-0x0000000000400000-0x0000000002402000-memory.dmp family_vidar -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 592 powershell.exe -
resource yara_rule behavioral3/files/0x00070000000174b4-45.dat aspack_v212_v242 behavioral3/files/0x000700000001707f-47.dat aspack_v212_v242 behavioral3/files/0x0007000000017570-53.dat aspack_v212_v242 -
Executes dropped EXE 14 IoCs
pid Process 2752 setup_install.exe 1876 Mon14585024febb5.exe 2304 Mon1469355885.exe 1160 Mon14f40f9f7773345d.exe 696 Mon14095335954ba1f.exe 1192 Mon14365bf6c89d2abf.exe 476 Mon14541c639b30ce5.exe 1380 Mon141f1ef356ba1.exe 2624 Mon14585024febb5.exe 2040 Mon1467890ab07c10e.exe 2660 Mon14b0530bbd5cb.exe 692 Mon1467890ab07c10e.exe 1716 Prendero.exe.com 1752 Prendero.exe.com -
Loads dropped DLL 47 IoCs
pid Process 2280 setup_installer.exe 2280 setup_installer.exe 2280 setup_installer.exe 2752 setup_install.exe 2752 setup_install.exe 2752 setup_install.exe 2752 setup_install.exe 2752 setup_install.exe 2752 setup_install.exe 2752 setup_install.exe 2752 setup_install.exe 1756 cmd.exe 1756 cmd.exe 1876 Mon14585024febb5.exe 1876 Mon14585024febb5.exe 2892 cmd.exe 2892 cmd.exe 2552 cmd.exe 2552 cmd.exe 2304 Mon1469355885.exe 2304 Mon1469355885.exe 1056 cmd.exe 2928 cmd.exe 2928 cmd.exe 1160 Mon14f40f9f7773345d.exe 1160 Mon14f40f9f7773345d.exe 2872 cmd.exe 2916 cmd.exe 696 Mon14095335954ba1f.exe 696 Mon14095335954ba1f.exe 1876 Mon14585024febb5.exe 1192 Mon14365bf6c89d2abf.exe 1192 Mon14365bf6c89d2abf.exe 1640 cmd.exe 1692 WerFault.exe 1692 WerFault.exe 2660 Mon14b0530bbd5cb.exe 2660 Mon14b0530bbd5cb.exe 2624 Mon14585024febb5.exe 2624 Mon14585024febb5.exe 1488 cmd.exe 1692 WerFault.exe 1716 Prendero.exe.com 2560 WerFault.exe 2560 WerFault.exe 2560 WerFault.exe 2560 WerFault.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" Mon14b0530bbd5cb.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 1692 2304 WerFault.exe 46 2560 1160 WerFault.exe 45 -
System Location Discovery: System Language Discovery 1 TTPs 27 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14f40f9f7773345d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14365bf6c89d2abf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14585024febb5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14095335954ba1f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14585024febb5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Prendero.exe.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon1469355885.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14b0530bbd5cb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Prendero.exe.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 784 PING.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Prendero.exe.com Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Prendero.exe.com -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Mon14f40f9f7773345d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Mon14f40f9f7773345d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Mon14f40f9f7773345d.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 784 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 592 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 592 powershell.exe Token: SeDebugPrivilege 476 Mon14541c639b30ce5.exe Token: SeDebugPrivilege 1380 Mon141f1ef356ba1.exe Token: SeDebugPrivilege 696 Mon14095335954ba1f.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 1716 Prendero.exe.com 1716 Prendero.exe.com 1716 Prendero.exe.com 1752 Prendero.exe.com 1752 Prendero.exe.com 1752 Prendero.exe.com 1752 Prendero.exe.com 1752 Prendero.exe.com -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 1716 Prendero.exe.com 1716 Prendero.exe.com 1716 Prendero.exe.com 1752 Prendero.exe.com 1752 Prendero.exe.com 1752 Prendero.exe.com -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2752 2280 setup_installer.exe 31 PID 2280 wrote to memory of 2752 2280 setup_installer.exe 31 PID 2280 wrote to memory of 2752 2280 setup_installer.exe 31 PID 2280 wrote to memory of 2752 2280 setup_installer.exe 31 PID 2280 wrote to memory of 2752 2280 setup_installer.exe 31 PID 2280 wrote to memory of 2752 2280 setup_installer.exe 31 PID 2280 wrote to memory of 2752 2280 setup_installer.exe 31 PID 2752 wrote to memory of 1228 2752 setup_install.exe 33 PID 2752 wrote to memory of 1228 2752 setup_install.exe 33 PID 2752 wrote to memory of 1228 2752 setup_install.exe 33 PID 2752 wrote to memory of 1228 2752 setup_install.exe 33 PID 2752 wrote to memory of 1228 2752 setup_install.exe 33 PID 2752 wrote to memory of 1228 2752 setup_install.exe 33 PID 2752 wrote to memory of 1228 2752 setup_install.exe 33 PID 2752 wrote to memory of 1756 2752 setup_install.exe 34 PID 2752 wrote to memory of 1756 2752 setup_install.exe 34 PID 2752 wrote to memory of 1756 2752 setup_install.exe 34 PID 2752 wrote to memory of 1756 2752 setup_install.exe 34 PID 2752 wrote to memory of 1756 2752 setup_install.exe 34 PID 2752 wrote to memory of 1756 2752 setup_install.exe 34 PID 2752 wrote to memory of 1756 2752 setup_install.exe 34 PID 2752 wrote to memory of 2552 2752 setup_install.exe 35 PID 2752 wrote to memory of 2552 2752 setup_install.exe 35 PID 2752 wrote to memory of 2552 2752 setup_install.exe 35 PID 2752 wrote to memory of 2552 2752 setup_install.exe 35 PID 2752 wrote to memory of 2552 2752 setup_install.exe 35 PID 2752 wrote to memory of 2552 2752 setup_install.exe 35 PID 2752 wrote to memory of 2552 2752 setup_install.exe 35 PID 1756 wrote to memory of 1876 1756 cmd.exe 36 PID 1756 wrote to memory of 1876 1756 cmd.exe 36 PID 1756 wrote to memory of 1876 1756 cmd.exe 36 PID 1756 wrote to memory of 1876 1756 cmd.exe 36 PID 1756 wrote to memory of 1876 1756 cmd.exe 36 PID 1756 wrote to memory of 1876 1756 cmd.exe 36 PID 1756 wrote to memory of 1876 1756 cmd.exe 36 PID 2752 wrote to memory of 2856 2752 setup_install.exe 37 PID 2752 wrote to memory of 2856 2752 setup_install.exe 37 PID 2752 wrote to memory of 2856 2752 setup_install.exe 37 PID 2752 wrote to memory of 2856 2752 setup_install.exe 37 PID 2752 wrote to memory of 2856 2752 setup_install.exe 37 PID 2752 wrote to memory of 2856 2752 setup_install.exe 37 PID 2752 wrote to memory of 2856 2752 setup_install.exe 37 PID 2752 wrote to memory of 2892 2752 setup_install.exe 38 PID 2752 wrote to memory of 2892 2752 setup_install.exe 38 PID 2752 wrote to memory of 2892 2752 setup_install.exe 38 PID 2752 wrote to memory of 2892 2752 setup_install.exe 38 PID 2752 wrote to memory of 2892 2752 setup_install.exe 38 PID 2752 wrote to memory of 2892 2752 setup_install.exe 38 PID 2752 wrote to memory of 2892 2752 setup_install.exe 38 PID 2752 wrote to memory of 2928 2752 setup_install.exe 39 PID 2752 wrote to memory of 2928 2752 setup_install.exe 39 PID 2752 wrote to memory of 2928 2752 setup_install.exe 39 PID 2752 wrote to memory of 2928 2752 setup_install.exe 39 PID 2752 wrote to memory of 2928 2752 setup_install.exe 39 PID 2752 wrote to memory of 2928 2752 setup_install.exe 39 PID 2752 wrote to memory of 2928 2752 setup_install.exe 39 PID 2752 wrote to memory of 2916 2752 setup_install.exe 40 PID 2752 wrote to memory of 2916 2752 setup_install.exe 40 PID 2752 wrote to memory of 2916 2752 setup_install.exe 40 PID 2752 wrote to memory of 2916 2752 setup_install.exe 40 PID 2752 wrote to memory of 2916 2752 setup_install.exe 40 PID 2752 wrote to memory of 2916 2752 setup_install.exe 40 PID 2752 wrote to memory of 2916 2752 setup_install.exe 40 PID 2752 wrote to memory of 2872 2752 setup_install.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\7zS8E8294C6\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS8E8294C6\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- System Location Discovery: System Language Discovery
PID:1228 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:592
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14585024febb5.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\7zS8E8294C6\Mon14585024febb5.exeMon14585024febb5.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\7zS8E8294C6\Mon14585024febb5.exe"C:\Users\Admin\AppData\Local\Temp\7zS8E8294C6\Mon14585024febb5.exe" -a5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2624
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1469355885.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\7zS8E8294C6\Mon1469355885.exeMon1469355885.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2304 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 2725⤵
- Loads dropped DLL
- Program crash
PID:1692
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1467890ab07c10e.exe3⤵
- System Location Discovery: System Language Discovery
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\7zS8E8294C6\Mon1467890ab07c10e.exeMon1467890ab07c10e.exe4⤵
- Executes dropped EXE
PID:2040
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8E8294C6\Mon1467890ab07c10e.exe"C:\Users\Admin\AppData\Local\Temp\7zS8E8294C6\Mon1467890ab07c10e.exe"4⤵
- Executes dropped EXE
PID:692
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14f40f9f7773345d.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\7zS8E8294C6\Mon14f40f9f7773345d.exeMon14f40f9f7773345d.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:1160 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 9485⤵
- Loads dropped DLL
- Program crash
PID:2560
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14095335954ba1f.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\7zS8E8294C6\Mon14095335954ba1f.exeMon14095335954ba1f.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14365bf6c89d2abf.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\7zS8E8294C6\Mon14365bf6c89d2abf.exeMon14365bf6c89d2abf.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1192
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon141f1ef356ba1.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\7zS8E8294C6\Mon141f1ef356ba1.exeMon141f1ef356ba1.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1380
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14b0530bbd5cb.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\7zS8E8294C6\Mon14b0530bbd5cb.exeMon14b0530bbd5cb.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Windows\SysWOW64\dllhost.exedllhost.exe5⤵
- System Location Discovery: System Language Discovery
PID:2528
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Mummia.wmz5⤵
- System Location Discovery: System Language Discovery
PID:1644 -
C:\Windows\SysWOW64\cmd.execmd6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1488 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^utIhAQXzKFfZwKOfdWFWGYOHgvUbutPplngusOenUcoCKjfoSNGytadifqZtVmhGQyOCcHYBTuwlPjXeuMFabKtSouQdPYDxoCLEbNMlPtkXdusrrWXoUUouqWxgRHLUDGwhAaEzZcDzniBeO$" Pensavo.wmz7⤵
- System Location Discovery: System Language Discovery
PID:2216
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.comPrendero.exe.com z7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.com z8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1752
-
-
-
C:\Windows\SysWOW64\PING.EXEping KHBTHJFA -n 307⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:784
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14541c639b30ce5.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\7zS8E8294C6\Mon14541c639b30ce5.exeMon14541c639b30ce5.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:476
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD5d23c06e25b4bd295e821274472263572
SHA19ad295ec3853dc465ae77f9479f8c4f76e2748b8
SHA256f02c1351a8b3dc296cf815bb4cd2bcc2d25b3b9a258ab2ad95e8be3d9602322c
SHA512122b0ef44682f83651d81df622bbff5ad9fa0f5bbd6b925e35add9568825c0316c0f9921dac21cf92cb44658fc854f7829c01ae3b84aa0745929f8ef5e6ae1ae
-
Filesize
1.5MB
MD5df80b76857b74ae1b2ada8efb2a730ee
SHA15653be57533c6eb058fed4963a25a676488ef832
SHA2565545c43eb14b0519ab997673efa379343f98d2b6b1578d9fdeb369234789f9dd
SHA512060b04536003ce4a91e5847d487701eed7e093408e427198be552f0af37aee498929586f3a0110c78173873a28d95c6c0a4cdd01c7218274f5849a4730f9efdd
-
Filesize
8KB
MD5408f2c9252ad66429a8d5401f1833db3
SHA13829d2d03a728ecd59b38cc189525220a60c05db
SHA256890db580fac738971bc7c714735ff6f1f2ee31edccd7881044da3e98452af664
SHA512d4c89dfd928023b9f4380808b27e032342d2a85963b95bbed3191cc03b455dbc6f5ffecf29828a53b1d9011b3881f1cda9d15d269a2cbcbd4be5c993bcd9643b
-
Filesize
56KB
MD53263859df4866bf393d46f06f331a08f
SHA15b4665de13c9727a502f4d11afb800b075929d6c
SHA2569dcacda3913e30cafd92c909648b5bffde14b8e39e6adbfb15628006c0d4d3c2
SHA51258205110a017f5d73dd131fefb1e3bbbcc670ed0c645aeefebe5281579c7b1dceffa56671cd7b186554bdb81710e21018ed0d7088a27517dfc5e48d6d3578cf6
-
Filesize
900KB
MD50a0d22f1c9179a67d04166de0db02dbb
SHA1106e55bd898b5574f9bd33dac9f3c0b95cecd90d
SHA256a59457fbfaf3d1b2e17463d0ffd50680313b1905aff69f13694cfc3fffd5a4ac
SHA5128abf8dc0da25c0fdbaa1ca39db057db80b9a135728fed9cd0f45b0f06d5652cee8d309b92e7cb953c0c4e8b38ffa2427c33f4865f1eb985a621316f9eb187b8b
-
Filesize
272KB
MD5fa37623638231d4c2b671b04a021a984
SHA17a446ffddc37e4a6dafd3f45d3d7c34c26885ce6
SHA25626a9fde966bc459d278a1ce94d59cb95b1a152efb217164ca62fc15a15c68fbe
SHA512730ba1cc1d9febba94572669a424695c06f03ac478255a61202f68eab45d8cdc60b0c341c005fc0b48b9f2048c7ebdfeaec8e28cf8b040be345790c930f6588b
-
Filesize
1.3MB
MD512b8842dded9134ad0cae031c4f06530
SHA1c0ecd0ac8cf3e4851661f62fe283ecec0e6ca25e
SHA256abd87ec324df8d74245e1671f21e832b563eb8dc3c13b1688a9e85a2f809fe17
SHA512967d70105549641beaa3283c42143aac22e016c911f99ab1c7ef5b4eff2577790fc679a74af6d2df14e87c278762e2c39c96bbdeabeaa1b62fb9072f0baa1825
-
Filesize
609KB
MD53b2ca1aae0f3a277efde19ed66785e07
SHA1edfd0bb11c0baec2475149259c8a88a61a669de9
SHA256c65369fd8f5f8a6bcee8325879e912f7f5e5f37e40281077a4902668458887b1
SHA512191aa807ec2c9a663eef6439084fcc68cdba245d9924773d65f42286af1df31238931425de1c18a4b643c7cd9ac4e98e638994630af440b7a1556c1497c8bb25
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
40KB
MD568c80086dcbc54fe75102740ff1c4abf
SHA1867d6102d69c3d2f77ef0b3c9adcd96ed67f73fa
SHA2568f35906e2cb2a26a2209fd7bd79958bd1997a6ae5bff053930444d277b99940d
SHA5123985fe85edecaa0d48a9771eaea6ae6d3de716f2f844e1508ac41f9ee2d55abdfd170c541bdafb0bf09183a7f2a71510f4a03604ee633858157f985d7423cfae
-
Filesize
8KB
MD5e989a1093b0caf954b68e6cdd477fbf0
SHA13078894c24c74f99a98ccd8aea8d2c329e01277b
SHA2568584c157863e8eb363e566db3aabaef57618ffbaff428dd0f589d66d28d4f603
SHA5127a3d4a1c4e250a5c024924aa448edd2cb8ce4f4e1268c93326f9e4e9ee31ef90f14ae14577e0ffc936da5d8560fa6076ba540ed80bb8582c28c3e9f9a2fbdef9
-
Filesize
47KB
MD513ffc201a8472243b1d8bbde80296473
SHA1ac10719ab70a0d47abd5894058b157bd522b74d6
SHA2563cba7da1283e0a6bf98ee4679395790ed7bfc36abd6ba52210437151c38d2d2e
SHA51228009c9b45b0bcbb59b9746d6ba28e3088636b2407b388f217dd9656296704e57ce3c18470c1106ecaab24c83274537d1a34a6ade6f8e53355bcb8ab717e16e7
-
Filesize
8KB
MD5cbc7116c9c7b8b8baeb00509fa654731
SHA19b5aa28f14e5449ae7bf3190c6f8c1a80755b8dc
SHA2566bdc997dc426ce013e5e71c88b1b56c10aa082128f264eae929cf7c3f6120d23
SHA512b53d075c1955e6d181c36748250b18729cab202070e2129fde493af8b4c71ac0d511f33c8aa25120408422a9eb2b7f662d8807830fa6a52d5e106703ebd09b1f
-
Filesize
192KB
MD5ea5d2a70de26a3f2ce92d1b02b2f3052
SHA166045b40d6aebc6a2930c76c6d492fb5fc81426f
SHA2567abf7953b1532eec5dd50fb9098269a8cd7b65e9afc9d84031039ff9da63f909
SHA5121437877ea36bf59eb74eef0415f820507fa55bb07b17b59679454e02a99bf48884bfdd0706175a168a005ce9a672b0fbdc904da7a35242402567f06bf22d322b
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
2.1MB
MD5febbfc26db3b9b63c26a253d83685c61
SHA196efbac726821400049db0a1508566e0bce7ce1a
SHA25676b67dbf3cdf622e3266419e7acbbf9d7e3e22c1a3ef5eceec90ebda296b65ff
SHA512f14bf151bf40064f3ef9bee9671c7f5f3689a17bbfaa9319394f8b7178c82fdb29a133f48c8d0ad3ae89b63733667ff695d762dc031659a01714d823320b556c