Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-11-2024 17:56

General

  • Target

    ba66c7a46a35c1b38aa76a199ae19a65674786771b153e0fadc62fcd28367396.exe

  • Size

    902KB

  • MD5

    e6ae2071837c90e79a7f4c6e8e778f0f

  • SHA1

    b340afd00d6feb4da15b9b10446417e51d3f7082

  • SHA256

    ba66c7a46a35c1b38aa76a199ae19a65674786771b153e0fadc62fcd28367396

  • SHA512

    6e1662cc172d0001fb2de054eaff5dc8c9ba041cbec00a42d8311c92958e1b4690454262106ac26d0eed85863e2142dc5d4161a98c7cbabbcb6b083e7d02b59c

  • SSDEEP

    24576:pAT8QE+kEVNpJc7Y/sDZ0239GhjS9knREHXsW02E7zS:pAI+/NpJc7Y60EGhjSmE3sW02E7zS

Malware Config

Extracted

Family

redline

Botnet

nam3

C2

103.89.90.61:34589

Attributes
  • auth_value

    64b900120bbceaa6a9c60e9079492895

Extracted

Family

vidar

C2

https://t.me/albaniaestates

https://c.im/@banza4ker

http://62.204.41.126:80

Extracted

Family

redline

Botnet

4

C2

31.41.244.134:11643

Attributes
  • auth_value

    a516b2d034ecd34338f12b50347fbd92

Extracted

Family

redline

Botnet

@tag12312341

C2

62.204.41.144:14096

Attributes
  • auth_value

    71466795417275fac01979e57016e277

Extracted

Family

redline

Botnet

5076357887

C2

195.54.170.157:16525

Attributes
  • auth_value

    0dfaff60271d374d0c206d19883e06f3

Extracted

Family

raccoon

Botnet

afb5c633c4650f69312baef49db9dfa4

C2

http://193.56.146.177

Attributes
  • user_agent

    mozzzzzzzzzzz

xor.plain

Extracted

Family

raccoon

Botnet

76426c3f362f5a47a469f0e9d8bc3eef

C2

http://45.95.11.158/

Attributes
  • user_agent

    mozzzzzzzzzzz

xor.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon family
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 8 IoCs
  • Redline family
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in Program Files directory 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ba66c7a46a35c1b38aa76a199ae19a65674786771b153e0fadc62fcd28367396.exe
    "C:\Users\Admin\AppData\Local\Temp\ba66c7a46a35c1b38aa76a199ae19a65674786771b153e0fadc62fcd28367396.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:400
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AbtZ4
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:264
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84c8a46f8,0x7ff84c8a4708,0x7ff84c8a4718
        3⤵
          PID:3144
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
          3⤵
            PID:2160
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2632
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
            3⤵
              PID:3952
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
              3⤵
                PID:2996
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
                3⤵
                  PID:4660
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
                  3⤵
                    PID:5136
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
                    3⤵
                      PID:5228
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:1
                      3⤵
                        PID:5692
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
                        3⤵
                          PID:5868
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
                          3⤵
                            PID:6088
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
                            3⤵
                              PID:5364
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
                              3⤵
                                PID:704
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
                                3⤵
                                  PID:5644
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6812 /prefetch:8
                                  3⤵
                                    PID:4236
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6812 /prefetch:8
                                    3⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:6500
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
                                    3⤵
                                      PID:6708
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
                                      3⤵
                                        PID:6716
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13307281885642987897,16272462460590233822,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3080 /prefetch:2
                                        3⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1748
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RyjC4
                                      2⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4892
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff84c8a46f8,0x7ff84c8a4708,0x7ff84c8a4718
                                        3⤵
                                          PID:536
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10287455655757063044,10689409604031218833,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
                                          3⤵
                                            PID:1504
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,10287455655757063044,10689409604031218833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
                                            3⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1756
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A4aK4
                                          2⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4452
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84c8a46f8,0x7ff84c8a4708,0x7ff84c8a4718
                                            3⤵
                                              PID:1472
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,7205511970578622828,15496594358104382682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
                                              3⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5284
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RLtX4
                                            2⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:2640
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84c8a46f8,0x7ff84c8a4708,0x7ff84c8a4718
                                              3⤵
                                                PID:2620
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1496,241846042168380454,1542757985303034533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 /prefetch:3
                                                3⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:5276
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1naEL4
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4552
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff84c8a46f8,0x7ff84c8a4708,0x7ff84c8a4718
                                                3⤵
                                                  PID:4184
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,14686821510169139949,10589875003604167838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
                                                  3⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:5676
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RCgX4
                                                2⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:5056
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff84c8a46f8,0x7ff84c8a4708,0x7ff84c8a4718
                                                  3⤵
                                                    PID:3056
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1nhGL4
                                                  2⤵
                                                    PID:4988
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84c8a46f8,0x7ff84c8a4708,0x7ff84c8a4718
                                                      3⤵
                                                        PID:5084
                                                    • C:\Program Files (x86)\Company\NewProduct\F0geI.exe
                                                      "C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4028
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 768
                                                        3⤵
                                                        • Program crash
                                                        PID:4080
                                                    • C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
                                                      "C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3504
                                                    • C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
                                                      "C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5144
                                                    • C:\Program Files (x86)\Company\NewProduct\nuplat.exe
                                                      "C:\Program Files (x86)\Company\NewProduct\nuplat.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5596
                                                    • C:\Program Files (x86)\Company\NewProduct\real.exe
                                                      "C:\Program Files (x86)\Company\NewProduct\real.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5920
                                                    • C:\Program Files (x86)\Company\NewProduct\safert44.exe
                                                      "C:\Program Files (x86)\Company\NewProduct\safert44.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:6100
                                                    • C:\Program Files (x86)\Company\NewProduct\tag.exe
                                                      "C:\Program Files (x86)\Company\NewProduct\tag.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5220
                                                    • C:\Program Files (x86)\Company\NewProduct\jshainx.exe
                                                      "C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5588
                                                    • C:\Program Files (x86)\Company\NewProduct\me.exe
                                                      "C:\Program Files (x86)\Company\NewProduct\me.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5864
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:380
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:6036
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4028 -ip 4028
                                                        1⤵
                                                          PID:2524

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Program Files (x86)\Company\NewProduct\F0geI.exe

                                                          Filesize

                                                          339KB

                                                          MD5

                                                          501e0f6fa90340e3d7ff26f276cd582e

                                                          SHA1

                                                          1bce4a6153f71719e786f8f612fbfcd23d3e130a

                                                          SHA256

                                                          f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

                                                          SHA512

                                                          dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

                                                        • C:\Program Files (x86)\Company\NewProduct\jshainx.exe

                                                          Filesize

                                                          107KB

                                                          MD5

                                                          2647a5be31a41a39bf2497125018dbce

                                                          SHA1

                                                          a1ac856b9d6556f5bb3370f0342914eb7cbb8840

                                                          SHA256

                                                          84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

                                                          SHA512

                                                          68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

                                                        • C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe

                                                          Filesize

                                                          491KB

                                                          MD5

                                                          681d98300c552b8c470466d9e8328c8a

                                                          SHA1

                                                          d15f4a432a2abce96ba9ba74443e566c1ffb933f

                                                          SHA256

                                                          8bbc892aedc1424ca5c66677b465c826f867515a3fea28821d015edcee71c912

                                                          SHA512

                                                          b909975d0212d5a5a0cb2e2809ee02224aac729cb761be97a8e3be4ee0a1d7470946da8cf725953c1b2d71fb5fc9dc3c26fd74bce5db5cc0e91a106f8bded887

                                                        • C:\Program Files (x86)\Company\NewProduct\me.exe

                                                          Filesize

                                                          286KB

                                                          MD5

                                                          29f986a025ca64b6e5fbc50fcefc8743

                                                          SHA1

                                                          4930311ffe1eac17a468c454d2ac37532b79c454

                                                          SHA256

                                                          766033bd59297068c74324bfffca88887a4f02588bac347e277644011fb6b090

                                                          SHA512

                                                          7af798f1480c18952597699189eff78d2ac638b40bffbc651954807b81d667207dd6d4ad073a787d40a423a15361d625f49b556109f998d2c56fa66d71c7268a

                                                        • C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe

                                                          Filesize

                                                          107KB

                                                          MD5

                                                          bbd8ea73b7626e0ca5b91d355df39b7f

                                                          SHA1

                                                          66e298653beb7f652eb44922010910ced6242879

                                                          SHA256

                                                          1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

                                                          SHA512

                                                          625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

                                                        • C:\Program Files (x86)\Company\NewProduct\nuplat.exe

                                                          Filesize

                                                          287KB

                                                          MD5

                                                          17c42a0dad379448ee1e6b21c85e5ac9

                                                          SHA1

                                                          2fec7fbb4a47092f9c17cd5ebb509a6403cb6d69

                                                          SHA256

                                                          e080161f57d4eaaad9173b63219ba5a9c2c595324a6b3ffe96783db40839807b

                                                          SHA512

                                                          5ddfe9af625c54e417452fe582041cdd373b52d4ededbcba71a88050fd834bc8af822257f7ad606e89db3fde15be98f58c1d8ff139dac71d81a23f669617a189

                                                        • C:\Program Files (x86)\Company\NewProduct\real.exe

                                                          Filesize

                                                          286KB

                                                          MD5

                                                          8a370815d8a47020150efa559ffdf736

                                                          SHA1

                                                          ba9d8df8f484b8da51161a0e29fd29e5001cff5d

                                                          SHA256

                                                          975457ed5ae0174f06cc093d4f9edcf75d88118cbbac5a1e76ad7bc7c679cd58

                                                          SHA512

                                                          d2eb60e220f64e76ebed2b051cc14f3a2da29707d8b2eb52fb41760800f11eafeb8bb3f1f8edcfca693a791aa60e56e263063f2b72abe4ad8784061feee6f7bf

                                                        • C:\Program Files (x86)\Company\NewProduct\safert44.exe

                                                          Filesize

                                                          244KB

                                                          MD5

                                                          dbe947674ea388b565ae135a09cc6638

                                                          SHA1

                                                          ae8e1c69bd1035a92b7e06baad5e387de3a70572

                                                          SHA256

                                                          86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709

                                                          SHA512

                                                          67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

                                                        • C:\Program Files (x86)\Company\NewProduct\tag.exe

                                                          Filesize

                                                          107KB

                                                          MD5

                                                          2ebc22860c7d9d308c018f0ffb5116ff

                                                          SHA1

                                                          78791a83f7161e58f9b7df45f9be618e9daea4cd

                                                          SHA256

                                                          8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

                                                          SHA512

                                                          d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          e443ee4336fcf13c698b8ab5f3c173d0

                                                          SHA1

                                                          9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

                                                          SHA256

                                                          79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

                                                          SHA512

                                                          cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          56a4f78e21616a6e19da57228569489b

                                                          SHA1

                                                          21bfabbfc294d5f2aa1da825c5590d760483bc76

                                                          SHA256

                                                          d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

                                                          SHA512

                                                          c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\77eaf71e-f945-4174-988c-3d8da4d9fed2.tmp

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          3215ed82bd4685b89e132daa503ed303

                                                          SHA1

                                                          de36d542437e7f43882738ae10fa3eaacbe8bddf

                                                          SHA256

                                                          e699d98fc1403ea059e3e3aa439a1ffbe93a0e4feb11eaa4de4851928cc3d21b

                                                          SHA512

                                                          f45eaee3ff2727c66c94301ab15ccbbde5c4c55f66415304206a3074c5652e8fae3d0cb8eee79b280e76f6d4ba48fccdd5d2bdfd6c36a6c7ab5cee1aee7e91a7

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                          Filesize

                                                          180B

                                                          MD5

                                                          4bc8a3540a546cfe044e0ed1a0a22a95

                                                          SHA1

                                                          5387f78f1816dee5393bfca1fffe49cede5f59c1

                                                          SHA256

                                                          f90fcadf34fbec9cabd9bcfdea0a63a1938aef5ea4c1f7b313e77f5d3f5bbdca

                                                          SHA512

                                                          e75437d833a3073132beed8280d30e4bb99b32e94d8671528aec53f39231c30476afb9067791e4eb9f1258611c167bfe98b09986d1877ca3ed96ea37b8bceecf

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          01580bd33f0b2ba1a73bb9c630c85b09

                                                          SHA1

                                                          b85422c54e85e4268dda4448efd0cde407f95b6b

                                                          SHA256

                                                          502d1299a9e85e1803f8dc5afb278a8d4a8e232aff22567747875e183e87171d

                                                          SHA512

                                                          1d489fb14fbd06667a164320c63e3d25ac5529f9a4f228746f2bcb10c240a671e1c979b40b391324a1e2a6a31b00fbdde046083474a31b9f32c6cab1ad5b4458

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

                                                          Filesize

                                                          16B

                                                          MD5

                                                          6752a1d65b201c13b62ea44016eb221f

                                                          SHA1

                                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                          SHA256

                                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                          SHA512

                                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                          Filesize

                                                          10KB

                                                          MD5

                                                          af1b9ace734fb2129b421b1564252c4a

                                                          SHA1

                                                          9f0d1862368e92a41ac35182c7fcd75783abe415

                                                          SHA256

                                                          304474187f1d1aa096caf143987062396ae16865e4baa002c22c37f27f94090f

                                                          SHA512

                                                          20d8bad38ed23a7798237d9953fef3fe36be635d7e2b15ed266f86ba1a7fdc7f77eb7ac78cc71e588d75d21dbb2ae7c3acff3de0ebe25615b3eefd58a971fae6

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          465adaf24433bfcbc5d8903816863db0

                                                          SHA1

                                                          ab5c30cfb96f6664560dc8c5f4061a45c8870996

                                                          SHA256

                                                          92dbfd3eb968bc13bc8d71038f81de84c953d855005e1214cf5ffe382bf949d8

                                                          SHA512

                                                          af892b6e17ddea59896c60d74030e5bcc4e6e1263c13ec99b3bdbeb0d815b8de8354d5065ca0f914de59dbd526e5fe7225839c5cb318a7a0c40a520641217eb3

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          21245ba6ea0f671d9dad146172656afa

                                                          SHA1

                                                          689f22a0d521f569e0e0afebe548e550a51e8ac3

                                                          SHA256

                                                          96364bffa3543268fed2188aa65ed47b5b8f69f7aec13a3be5f28c64de5ac2c4

                                                          SHA512

                                                          fb52db591bd29c9b48ec93d21b1009539020318c8c9c919326586cb98e462759ea61abf40bfd0c1abedd1d6ebcf2546c0b10be8d260772768d986f31a6feabaf

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          b96c711be050d3989b7d19d1696325a6

                                                          SHA1

                                                          61fb68d5e5823be9cb481cf3d1598008031ebade

                                                          SHA256

                                                          1cc352072c2b1a47f302568eaccd4d85b92af9812d114603f553a2b140439d24

                                                          SHA512

                                                          40a6d3753d561a679d47e0748cd59e4ef8a96035a816846f0e66a77d59bc21844c839c7307e5e8e5a2b214127ee94bc72d78ae2e2d49b616d28d5aa26d2c5deb

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          476cc79546eeba566c94deed7b03aea7

                                                          SHA1

                                                          bab3cc2b5563a0ed5a00c8c646e851c483f377af

                                                          SHA256

                                                          e77e8a36141c2d5e5805381cfbbcf8bee62394728622a131b0e706fd17e3809a

                                                          SHA512

                                                          cb9a483f87aca0457955e49c83caa7b9b8def723e6673ee495fcd12dc86330252c55043e10a0a1181407ff92e89f4e9a4e21193059bda73065fdf1447b06e6d7

                                                        • memory/400-237-0x0000000000400000-0x0000000000433000-memory.dmp

                                                          Filesize

                                                          204KB

                                                        • memory/3504-258-0x0000000000400000-0x0000000000482000-memory.dmp

                                                          Filesize

                                                          520KB

                                                        • memory/4028-310-0x0000000000400000-0x000000000046E000-memory.dmp

                                                          Filesize

                                                          440KB

                                                        • memory/5144-228-0x0000000005E90000-0x0000000005ECC000-memory.dmp

                                                          Filesize

                                                          240KB

                                                        • memory/5144-213-0x0000000006A60000-0x0000000006B6A000-memory.dmp

                                                          Filesize

                                                          1.0MB

                                                        • memory/5144-234-0x0000000006000000-0x000000000604C000-memory.dmp

                                                          Filesize

                                                          304KB

                                                        • memory/5144-206-0x0000000006270000-0x0000000006282000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/5144-194-0x0000000006330000-0x0000000006948000-memory.dmp

                                                          Filesize

                                                          6.1MB

                                                        • memory/5144-155-0x0000000000EE0000-0x0000000000F00000-memory.dmp

                                                          Filesize

                                                          128KB

                                                        • memory/5220-215-0x0000000000E70000-0x0000000000E90000-memory.dmp

                                                          Filesize

                                                          128KB

                                                        • memory/5588-231-0x0000000000490000-0x00000000004B0000-memory.dmp

                                                          Filesize

                                                          128KB

                                                        • memory/6100-222-0x0000000004850000-0x0000000004856000-memory.dmp

                                                          Filesize

                                                          24KB

                                                        • memory/6100-205-0x0000000000160000-0x00000000001A4000-memory.dmp

                                                          Filesize

                                                          272KB