Analysis
-
max time kernel
74s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-11-2020 16:19
Static task
static1
Behavioral task
behavioral1
Sample
6d01213c51ed2570b263b28fa4b9f320.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6d01213c51ed2570b263b28fa4b9f320.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
6d01213c51ed2570b263b28fa4b9f320.exe
-
Size
1.1MB
-
MD5
6d01213c51ed2570b263b28fa4b9f320
-
SHA1
aa5aa4142ff6de7e5560424d252c2bf234f14651
-
SHA256
b99d5d0e6ebfd38c47b999a704cb2558797ed6b149356075036a0de57fbca261
-
SHA512
0ca8354473740c4f6212159f98571eaf3041ea895a3e067b52c9b5e380c948cc5df0fa18171674c35afd5f0bdeb75e676b41a548be1a3e05ed5f7906a8365766
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
C2
agentttt.ac.ug:6970
agentpurple.ac.ug:6970
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
aes_key
16dw6EDbQkYZp5BTs7cmLUicVtOA4UQr
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
agentttt.ac.ug,agentpurple.ac.ug
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6970
-
version
0.5.7B
aes.plain
Extracted
Family
azorult
C2
http://195.245.112.115/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Contains code to disable Windows Defender 6 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/3128-80-0x0000000000400000-0x000000000040C000-memory.dmp disable_win_def behavioral2/memory/3128-81-0x000000000040616E-mapping.dmp disable_win_def behavioral2/memory/3924-102-0x0000000000400000-0x0000000000408000-memory.dmp disable_win_def behavioral2/memory/3924-103-0x0000000000403BEE-mapping.dmp disable_win_def behavioral2/files/0x000200000001ab5d-113.dat disable_win_def behavioral2/files/0x000200000001ab5d-112.dat disable_win_def -
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Async RAT payload 2 IoCs
resource yara_rule behavioral2/memory/3156-71-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/3156-72-0x000000000040C76E-mapping.dmp asyncrat -
ModiLoader First Stage 1 IoCs
resource yara_rule behavioral2/memory/4032-153-0x0000000004AA0000-0x0000000004AFC000-memory.dmp modiloader_stage1 -
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/4032-212-0x0000000005500000-0x000000000554D000-memory.dmp modiloader_stage2 -
ServiceHost packer 45 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/2512-235-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-237-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-239-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-241-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-243-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-245-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-247-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-249-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-251-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-253-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-255-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-257-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-259-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-261-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-263-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-265-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-267-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-269-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-271-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-273-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-275-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-277-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-279-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-281-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-283-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-287-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-285-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-293-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-291-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-289-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-295-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-297-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-303-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-301-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-299-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-305-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-307-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-309-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-317-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-315-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-319-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-321-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-323-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-325-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2512-327-0x0000000000000000-mapping.dmp servicehost -
Executes dropped EXE 9 IoCs
pid Process 3372 axcjgfhwvvas.exe 3116 1RdiI043Xv.exe 4032 hgN08oxHXW.exe 3520 8k4ZdjKXIU.exe 2468 o4I9l466WN.exe 3156 1RdiI043Xv.exe 3128 8k4ZdjKXIU.exe 3924 o4I9l466WN.exe 3104 vbca4x3e.exe -
Loads dropped DLL 6 IoCs
pid Process 3352 6d01213c51ed2570b263b28fa4b9f320.exe 3352 6d01213c51ed2570b263b28fa4b9f320.exe 3352 6d01213c51ed2570b263b28fa4b9f320.exe 3352 6d01213c51ed2570b263b28fa4b9f320.exe 3352 6d01213c51ed2570b263b28fa4b9f320.exe 3352 6d01213c51ed2570b263b28fa4b9f320.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features o4I9l466WN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" o4I9l466WN.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\LocalLow\n9h9r91h8fna789q\desktop.ini 6d01213c51ed2570b263b28fa4b9f320.exe -
JavaScript code in executable 2 IoCs
resource yara_rule behavioral2/files/0x000100000001ab72-30.dat js behavioral2/files/0x000200000001ab77-433.dat js -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3980 set thread context of 3352 3980 6d01213c51ed2570b263b28fa4b9f320.exe 81 PID 3116 set thread context of 3156 3116 1RdiI043Xv.exe 89 PID 3520 set thread context of 3128 3520 8k4ZdjKXIU.exe 90 PID 2468 set thread context of 3924 2468 o4I9l466WN.exe 93 -
Delays execution with timeout.exe 1 IoCs
pid Process 3012 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 856 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 373 IoCs
pid Process 3980 6d01213c51ed2570b263b28fa4b9f320.exe 3980 6d01213c51ed2570b263b28fa4b9f320.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe 1160 powershell.exe 512 powershell.exe 512 powershell.exe 1160 powershell.exe 512 powershell.exe 1160 powershell.exe 3920 powershell.exe 1908 powershell.exe 2840 powershell.exe 2964 powershell.exe 2964 powershell.exe 504 powershell.exe 504 powershell.exe 1120 powershell.exe 1120 powershell.exe 4112 powershell.exe 4112 powershell.exe 4212 powershell.exe 4212 powershell.exe 4320 powershell.exe 4320 powershell.exe 3920 powershell.exe 3920 powershell.exe 1908 powershell.exe 1908 powershell.exe 4456 powershell.exe 4456 powershell.exe 2840 powershell.exe 2840 powershell.exe 4580 powershell.exe 4580 powershell.exe 1120 powershell.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeDebugPrivilege 3980 6d01213c51ed2570b263b28fa4b9f320.exe Token: SeDebugPrivilege 3116 1RdiI043Xv.exe Token: SeDebugPrivilege 3520 8k4ZdjKXIU.exe Token: SeDebugPrivilege 3128 8k4ZdjKXIU.exe Token: SeDebugPrivilege 2468 o4I9l466WN.exe Token: SeDebugPrivilege 856 taskkill.exe Token: SeDebugPrivilege 1160 powershell.exe Token: SeDebugPrivilege 512 powershell.exe Token: SeIncreaseQuotaPrivilege 512 powershell.exe Token: SeSecurityPrivilege 512 powershell.exe Token: SeTakeOwnershipPrivilege 512 powershell.exe Token: SeLoadDriverPrivilege 512 powershell.exe Token: SeSystemProfilePrivilege 512 powershell.exe Token: SeSystemtimePrivilege 512 powershell.exe Token: SeProfSingleProcessPrivilege 512 powershell.exe Token: SeIncBasePriorityPrivilege 512 powershell.exe Token: SeCreatePagefilePrivilege 512 powershell.exe Token: SeBackupPrivilege 512 powershell.exe Token: SeRestorePrivilege 512 powershell.exe Token: SeShutdownPrivilege 512 powershell.exe Token: SeDebugPrivilege 512 powershell.exe Token: SeSystemEnvironmentPrivilege 512 powershell.exe Token: SeRemoteShutdownPrivilege 512 powershell.exe Token: SeUndockPrivilege 512 powershell.exe Token: SeManageVolumePrivilege 512 powershell.exe Token: 33 512 powershell.exe Token: 34 512 powershell.exe Token: 35 512 powershell.exe Token: 36 512 powershell.exe Token: SeDebugPrivilege 3920 powershell.exe Token: SeDebugPrivilege 1908 powershell.exe Token: SeDebugPrivilege 2840 powershell.exe Token: SeDebugPrivilege 1120 powershell.exe Token: SeDebugPrivilege 2964 powershell.exe Token: SeDebugPrivilege 504 powershell.exe Token: SeDebugPrivilege 4112 powershell.exe Token: SeDebugPrivilege 4212 powershell.exe Token: SeDebugPrivilege 4320 powershell.exe Token: SeDebugPrivilege 4456 powershell.exe Token: SeDebugPrivilege 4580 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3128 8k4ZdjKXIU.exe 3128 8k4ZdjKXIU.exe -
Suspicious use of WriteProcessMemory 97 IoCs
description pid Process procid_target PID 3980 wrote to memory of 3372 3980 6d01213c51ed2570b263b28fa4b9f320.exe 79 PID 3980 wrote to memory of 3372 3980 6d01213c51ed2570b263b28fa4b9f320.exe 79 PID 3980 wrote to memory of 3372 3980 6d01213c51ed2570b263b28fa4b9f320.exe 79 PID 3980 wrote to memory of 3100 3980 6d01213c51ed2570b263b28fa4b9f320.exe 80 PID 3980 wrote to memory of 3100 3980 6d01213c51ed2570b263b28fa4b9f320.exe 80 PID 3980 wrote to memory of 3100 3980 6d01213c51ed2570b263b28fa4b9f320.exe 80 PID 3980 wrote to memory of 3352 3980 6d01213c51ed2570b263b28fa4b9f320.exe 81 PID 3980 wrote to memory of 3352 3980 6d01213c51ed2570b263b28fa4b9f320.exe 81 PID 3980 wrote to memory of 3352 3980 6d01213c51ed2570b263b28fa4b9f320.exe 81 PID 3980 wrote to memory of 3352 3980 6d01213c51ed2570b263b28fa4b9f320.exe 81 PID 3980 wrote to memory of 3352 3980 6d01213c51ed2570b263b28fa4b9f320.exe 81 PID 3980 wrote to memory of 3352 3980 6d01213c51ed2570b263b28fa4b9f320.exe 81 PID 3980 wrote to memory of 3352 3980 6d01213c51ed2570b263b28fa4b9f320.exe 81 PID 3980 wrote to memory of 3352 3980 6d01213c51ed2570b263b28fa4b9f320.exe 81 PID 3980 wrote to memory of 3352 3980 6d01213c51ed2570b263b28fa4b9f320.exe 81 PID 3352 wrote to memory of 3116 3352 6d01213c51ed2570b263b28fa4b9f320.exe 82 PID 3352 wrote to memory of 3116 3352 6d01213c51ed2570b263b28fa4b9f320.exe 82 PID 3352 wrote to memory of 3116 3352 6d01213c51ed2570b263b28fa4b9f320.exe 82 PID 3352 wrote to memory of 4032 3352 6d01213c51ed2570b263b28fa4b9f320.exe 83 PID 3352 wrote to memory of 4032 3352 6d01213c51ed2570b263b28fa4b9f320.exe 83 PID 3352 wrote to memory of 4032 3352 6d01213c51ed2570b263b28fa4b9f320.exe 83 PID 3352 wrote to memory of 3520 3352 6d01213c51ed2570b263b28fa4b9f320.exe 84 PID 3352 wrote to memory of 3520 3352 6d01213c51ed2570b263b28fa4b9f320.exe 84 PID 3352 wrote to memory of 3520 3352 6d01213c51ed2570b263b28fa4b9f320.exe 84 PID 3352 wrote to memory of 2468 3352 6d01213c51ed2570b263b28fa4b9f320.exe 85 PID 3352 wrote to memory of 2468 3352 6d01213c51ed2570b263b28fa4b9f320.exe 85 PID 3352 wrote to memory of 2468 3352 6d01213c51ed2570b263b28fa4b9f320.exe 85 PID 3352 wrote to memory of 2492 3352 6d01213c51ed2570b263b28fa4b9f320.exe 86 PID 3352 wrote to memory of 2492 3352 6d01213c51ed2570b263b28fa4b9f320.exe 86 PID 3352 wrote to memory of 2492 3352 6d01213c51ed2570b263b28fa4b9f320.exe 86 PID 2492 wrote to memory of 3012 2492 cmd.exe 88 PID 2492 wrote to memory of 3012 2492 cmd.exe 88 PID 2492 wrote to memory of 3012 2492 cmd.exe 88 PID 3116 wrote to memory of 3156 3116 1RdiI043Xv.exe 89 PID 3116 wrote to memory of 3156 3116 1RdiI043Xv.exe 89 PID 3116 wrote to memory of 3156 3116 1RdiI043Xv.exe 89 PID 3116 wrote to memory of 3156 3116 1RdiI043Xv.exe 89 PID 3116 wrote to memory of 3156 3116 1RdiI043Xv.exe 89 PID 3116 wrote to memory of 3156 3116 1RdiI043Xv.exe 89 PID 3116 wrote to memory of 3156 3116 1RdiI043Xv.exe 89 PID 3116 wrote to memory of 3156 3116 1RdiI043Xv.exe 89 PID 3520 wrote to memory of 3128 3520 8k4ZdjKXIU.exe 90 PID 3520 wrote to memory of 3128 3520 8k4ZdjKXIU.exe 90 PID 3520 wrote to memory of 3128 3520 8k4ZdjKXIU.exe 90 PID 3520 wrote to memory of 3128 3520 8k4ZdjKXIU.exe 90 PID 3520 wrote to memory of 3128 3520 8k4ZdjKXIU.exe 90 PID 3520 wrote to memory of 3128 3520 8k4ZdjKXIU.exe 90 PID 3520 wrote to memory of 3128 3520 8k4ZdjKXIU.exe 90 PID 3520 wrote to memory of 3128 3520 8k4ZdjKXIU.exe 90 PID 3128 wrote to memory of 3252 3128 8k4ZdjKXIU.exe 91 PID 3128 wrote to memory of 3252 3128 8k4ZdjKXIU.exe 91 PID 3128 wrote to memory of 3252 3128 8k4ZdjKXIU.exe 91 PID 2468 wrote to memory of 3924 2468 o4I9l466WN.exe 93 PID 2468 wrote to memory of 3924 2468 o4I9l466WN.exe 93 PID 2468 wrote to memory of 3924 2468 o4I9l466WN.exe 93 PID 3492 wrote to memory of 1540 3492 DllHost.exe 94 PID 3492 wrote to memory of 1540 3492 DllHost.exe 94 PID 3492 wrote to memory of 1540 3492 DllHost.exe 94 PID 2468 wrote to memory of 3924 2468 o4I9l466WN.exe 93 PID 2468 wrote to memory of 3924 2468 o4I9l466WN.exe 93 PID 2468 wrote to memory of 3924 2468 o4I9l466WN.exe 93 PID 2468 wrote to memory of 3924 2468 o4I9l466WN.exe 93 PID 2468 wrote to memory of 3924 2468 o4I9l466WN.exe 93 PID 3924 wrote to memory of 1160 3924 o4I9l466WN.exe 96 PID 3924 wrote to memory of 1160 3924 o4I9l466WN.exe 96 PID 3924 wrote to memory of 1160 3924 o4I9l466WN.exe 96 PID 1540 wrote to memory of 3104 1540 cmd.exe 98 PID 1540 wrote to memory of 3104 1540 cmd.exe 98 PID 3492 wrote to memory of 856 3492 DllHost.exe 99 PID 3492 wrote to memory of 856 3492 DllHost.exe 99 PID 3492 wrote to memory of 856 3492 DllHost.exe 99 PID 3104 wrote to memory of 512 3104 vbca4x3e.exe 100 PID 3104 wrote to memory of 512 3104 vbca4x3e.exe 100 PID 3104 wrote to memory of 3920 3104 vbca4x3e.exe 105 PID 3104 wrote to memory of 3920 3104 vbca4x3e.exe 105 PID 3104 wrote to memory of 1908 3104 vbca4x3e.exe 107 PID 3104 wrote to memory of 1908 3104 vbca4x3e.exe 107 PID 3104 wrote to memory of 2840 3104 vbca4x3e.exe 109 PID 3104 wrote to memory of 2840 3104 vbca4x3e.exe 109 PID 3104 wrote to memory of 1120 3104 vbca4x3e.exe 111 PID 3104 wrote to memory of 1120 3104 vbca4x3e.exe 111 PID 3104 wrote to memory of 2964 3104 vbca4x3e.exe 113 PID 3104 wrote to memory of 2964 3104 vbca4x3e.exe 113 PID 3104 wrote to memory of 504 3104 vbca4x3e.exe 115 PID 3104 wrote to memory of 504 3104 vbca4x3e.exe 115 PID 3104 wrote to memory of 4112 3104 vbca4x3e.exe 117 PID 3104 wrote to memory of 4112 3104 vbca4x3e.exe 117 PID 3104 wrote to memory of 4212 3104 vbca4x3e.exe 119 PID 3104 wrote to memory of 4212 3104 vbca4x3e.exe 119 PID 3104 wrote to memory of 4320 3104 vbca4x3e.exe 121 PID 3104 wrote to memory of 4320 3104 vbca4x3e.exe 121 PID 3104 wrote to memory of 4456 3104 vbca4x3e.exe 123 PID 3104 wrote to memory of 4456 3104 vbca4x3e.exe 123 PID 3104 wrote to memory of 4580 3104 vbca4x3e.exe 125 PID 3104 wrote to memory of 4580 3104 vbca4x3e.exe 125 PID 3104 wrote to memory of 4680 3104 vbca4x3e.exe 127 PID 3104 wrote to memory of 4680 3104 vbca4x3e.exe 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d01213c51ed2570b263b28fa4b9f320.exe"C:\Users\Admin\AppData\Local\Temp\6d01213c51ed2570b263b28fa4b9f320.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\axcjgfhwvvas.exe"C:\Users\Admin\AppData\Local\Temp\axcjgfhwvvas.exe"2⤵
- Executes dropped EXE
PID:3372
-
-
C:\Users\Admin\AppData\Local\Temp\6d01213c51ed2570b263b28fa4b9f320.exe"{path}"2⤵PID:3100
-
-
C:\Users\Admin\AppData\Local\Temp\6d01213c51ed2570b263b28fa4b9f320.exe"{path}"2⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\1RdiI043Xv.exe"C:\Users\Admin\AppData\Local\Temp\1RdiI043Xv.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\1RdiI043Xv.exe"C:\Users\Admin\AppData\Local\Temp\1RdiI043Xv.exe"4⤵
- Executes dropped EXE
PID:3156
-
-
-
C:\Users\Admin\AppData\Local\Temp\hgN08oxHXW.exe"C:\Users\Admin\AppData\Local\Temp\hgN08oxHXW.exe"3⤵
- Executes dropped EXE
PID:4032
-
-
C:\Users\Admin\AppData\Local\Temp\8k4ZdjKXIU.exe"C:\Users\Admin\AppData\Local\Temp\8k4ZdjKXIU.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\8k4ZdjKXIU.exe"C:\Users\Admin\AppData\Local\Temp\8k4ZdjKXIU.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\windows\SysWOW64\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\gap112qz.inf5⤵PID:3252
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\o4I9l466WN.exe"C:\Users\Admin\AppData\Local\Temp\o4I9l466WN.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\o4I9l466WN.exe"C:\Users\Admin\AppData\Local\Temp\o4I9l466WN.exe"4⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\6d01213c51ed2570b263b28fa4b9f320.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:3012
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}1⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\cmd.execmd /c start C:\Windows\temp\vbca4x3e.exe2⤵PID:1540
-
C:\Windows\temp\vbca4x3e.exeC:\Windows\temp\vbca4x3e.exe3⤵
- Executes dropped EXE
PID:3104 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
- Suspicious use of AdjustPrivilegeToken
PID:512
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3920
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1120
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force4⤵
- Suspicious use of AdjustPrivilegeToken
PID:504
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 64⤵
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:4212
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 64⤵
- Suspicious use of AdjustPrivilegeToken
PID:4320
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 64⤵
- Suspicious use of AdjustPrivilegeToken
PID:4456
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4580
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 24⤵PID:4680
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cmstp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:856
-