redline | 27088c28c0f31bf50d35890675acb14a9da0b2bf574a03c79040e640bd1fbe96

Analysis

max time kernel
63s
max time network
65s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
15-12-2024 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

perm.exe
Size

4.6MB
MD5

cd15473be3b87cf2f089fe3a652d0d08
SHA1

5fecdc548d7c9e134940509d4b002dd36deda1ef
SHA256

27088c28c0f31bf50d35890675acb14a9da0b2bf574a03c79040e640bd1fbe96
SHA512

cdd2f2dbc59942999082bd62bd869b66bf80b525d7b7244cb6527540bb288a50844f6d078f21c319d6888d02efca5a73ed054c16a544958ef40e215a54336477
SSDEEP

98304:1d7m+ij9HD0+jCihNRkl/W6aG/wcKnfu8NUT6KM:u+y4ihkl/Wo/afHP9

Score

10^/10

redline sectoprat xworm discovery evasion execution infostealer rat trojan

Malware Config

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1204-3-0x0000000005A40000-0x0000000005AD4000-memory.dmp	family_xworm

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/1204-3-0x0000000005A40000-0x0000000005AD4000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1204-3-0x0000000005A40000-0x0000000005AD4000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	perm.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	perm.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	perm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	perm.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	perm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	perm.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3992	sc.exe
2268	sc.exe
3316	sc.exe
1120	sc.exe
4636	sc.exe
4092	sc.exe
3540	sc.exe
5112	sc.exe
3848	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 37 IoCs

evasion

pid	Process
4648	taskkill.exe
2176	taskkill.exe
3248	taskkill.exe
896	taskkill.exe
3448	taskkill.exe
3716	taskkill.exe
548	taskkill.exe
2748	taskkill.exe
1032	taskkill.exe
936	taskkill.exe
2484	taskkill.exe
2988	taskkill.exe
956	taskkill.exe
1920	taskkill.exe
4924	taskkill.exe
2592	taskkill.exe
3224	taskkill.exe
2724	taskkill.exe
3812	taskkill.exe
4776	taskkill.exe
4268	taskkill.exe
3288	taskkill.exe
3112	taskkill.exe
2964	taskkill.exe
3108	taskkill.exe
1676	taskkill.exe
1068	taskkill.exe
4072	taskkill.exe
3768	taskkill.exe
4120	taskkill.exe
4516	taskkill.exe
2848	taskkill.exe
4272	taskkill.exe
4300	taskkill.exe
4908	taskkill.exe
3668	taskkill.exe
2224	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1204	perm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe
Token: SeIncBasePriorityPrivilege	1204	perm.exe
Token: 33	1204	perm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2016	1204	perm.exe	83
PID 1204 wrote to memory of 2016	1204	perm.exe	83
PID 1204 wrote to memory of 2016	1204	perm.exe	83
PID 2016 wrote to memory of 3716	2016	cmd.exe	85
PID 2016 wrote to memory of 3716	2016	cmd.exe	85
PID 2016 wrote to memory of 3716	2016	cmd.exe	85
PID 1204 wrote to memory of 2848	1204	perm.exe	86
PID 1204 wrote to memory of 2848	1204	perm.exe	86
PID 1204 wrote to memory of 2848	1204	perm.exe	86
PID 2848 wrote to memory of 4072	2848	cmd.exe	88
PID 2848 wrote to memory of 4072	2848	cmd.exe	88
PID 2848 wrote to memory of 4072	2848	cmd.exe	88
PID 1204 wrote to memory of 4844	1204	perm.exe	89
PID 1204 wrote to memory of 4844	1204	perm.exe	89
PID 1204 wrote to memory of 4844	1204	perm.exe	89
PID 4844 wrote to memory of 4272	4844	cmd.exe	91
PID 4844 wrote to memory of 4272	4844	cmd.exe	91
PID 4844 wrote to memory of 4272	4844	cmd.exe	91
PID 1204 wrote to memory of 2408	1204	perm.exe	92
PID 1204 wrote to memory of 2408	1204	perm.exe	92
PID 1204 wrote to memory of 2408	1204	perm.exe	92
PID 2408 wrote to memory of 1920	2408	cmd.exe	94
PID 2408 wrote to memory of 1920	2408	cmd.exe	94
PID 2408 wrote to memory of 1920	2408	cmd.exe	94
PID 1204 wrote to memory of 4336	1204	perm.exe	95
PID 1204 wrote to memory of 4336	1204	perm.exe	95
PID 1204 wrote to memory of 4336	1204	perm.exe	95
PID 4336 wrote to memory of 4776	4336	cmd.exe	97
PID 4336 wrote to memory of 4776	4336	cmd.exe	97
PID 4336 wrote to memory of 4776	4336	cmd.exe	97
PID 1204 wrote to memory of 3420	1204	perm.exe	98
PID 1204 wrote to memory of 3420	1204	perm.exe	98
PID 1204 wrote to memory of 3420	1204	perm.exe	98
PID 3420 wrote to memory of 2964	3420	cmd.exe	174
PID 3420 wrote to memory of 2964	3420	cmd.exe	174
PID 3420 wrote to memory of 2964	3420	cmd.exe	174
PID 1204 wrote to memory of 3120	1204	perm.exe	101
PID 1204 wrote to memory of 3120	1204	perm.exe	101
PID 1204 wrote to memory of 3120	1204	perm.exe	101
PID 3120 wrote to memory of 3316	3120	cmd.exe	177
PID 3120 wrote to memory of 3316	3120	cmd.exe	177
PID 3120 wrote to memory of 3316	3120	cmd.exe	177
PID 1204 wrote to memory of 2680	1204	perm.exe	104
PID 1204 wrote to memory of 2680	1204	perm.exe	104
PID 1204 wrote to memory of 2680	1204	perm.exe	104
PID 2680 wrote to memory of 548	2680	cmd.exe	106
PID 2680 wrote to memory of 548	2680	cmd.exe	106
PID 2680 wrote to memory of 548	2680	cmd.exe	106
PID 1204 wrote to memory of 3112	1204	perm.exe	184
PID 1204 wrote to memory of 3112	1204	perm.exe	184
PID 1204 wrote to memory of 3112	1204	perm.exe	184
PID 3112 wrote to memory of 4268	3112	cmd.exe	109
PID 3112 wrote to memory of 4268	3112	cmd.exe	109
PID 3112 wrote to memory of 4268	3112	cmd.exe	109
PID 1204 wrote to memory of 2652	1204	perm.exe	188
PID 1204 wrote to memory of 2652	1204	perm.exe	188
PID 1204 wrote to memory of 2652	1204	perm.exe	188
PID 2652 wrote to memory of 4648	2652	cmd.exe	112
PID 2652 wrote to memory of 4648	2652	cmd.exe	112
PID 2652 wrote to memory of 4648	2652	cmd.exe	112
PID 1204 wrote to memory of 3644	1204	perm.exe	113
PID 1204 wrote to memory of 3644	1204	perm.exe	113
PID 1204 wrote to memory of 3644	1204	perm.exe	113
PID 3644 wrote to memory of 2176	3644	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\perm.exe
"C:\Users\Admin\AppData\Local\Temp\perm.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Kills process with taskkill
    PID:3716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /f /im Ida64.exe >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Ida64.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /f /im OllyDbg.exe >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im OllyDbg.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /f /im Dbg64.exe >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Dbg64.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /f /im Dbg32.exe >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Dbg32.exe
    3⤵
    - Kills process with taskkill
    PID:2964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\SysWOW64\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3316
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:524
- - C:\Windows\SysWOW64\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2748
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq x64dbg*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq x64dbg*" /IM * /F /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq x32dbg*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3164
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq x32dbg*" /IM * /F /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq ollydbg*" /IM * /F /T >nul 2>&1
  2⤵
  PID:956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq ollydbg*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  PID:3448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:3028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:668
- - C:\Windows\SysWOW64\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c sc stop HTTPDebuggerProSdk >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3856
- - C:\Windows\SysWOW64\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c sc stop KProcessHacker3 >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4572
- - C:\Windows\SysWOW64\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c sc stop KProcessHacker2 >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4432
- - C:\Windows\SysWOW64\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c sc stop KProcessHacker1 >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:412
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:4092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c sc stop wireshark >nul 2>&1
  2⤵
  PID:2124
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3316
- - C:\Windows\SysWOW64\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1624
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  PID:2596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:400
- - C:\Windows\SysWOW64\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:4564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq x64dbg*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq x64dbg*" /IM * /F /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq x32dbg*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq x32dbg*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq ollydbg*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq ollydbg*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /FI "IMAGENAME eq die*" /IM * /F /T >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "IMAGENAME eq die*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /f /im HTTPDebugger.exe >nul 2>&1
  2⤵
  PID:1636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im HTTPDebugger.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c taskkill /f /im FolderChangesView.exe >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4344
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FolderChangesView.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-0-0x000000007533E000-0x000000007533F000-memory.dmp

Filesize
4KB

Download
memory/1204-1-0x0000000000B60000-0x0000000000FFE000-memory.dmp

Filesize
4.6MB

Download
memory/1204-2-0x0000000075330000-0x0000000075AE1000-memory.dmp

Filesize
7.7MB

Download
memory/1204-3-0x0000000005A40000-0x0000000005AD4000-memory.dmp

Filesize
592KB

Download
memory/1204-4-0x0000000005D40000-0x0000000005DA6000-memory.dmp

Filesize
408KB

Download
memory/1204-5-0x0000000006360000-0x0000000006906000-memory.dmp

Filesize
5.6MB

Download
memory/1204-6-0x000000007533E000-0x000000007533F000-memory.dmp

Filesize
4KB

Download
memory/1204-7-0x0000000075330000-0x0000000075AE1000-memory.dmp

Filesize
7.7MB

Download