dcrat | ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97

General

Target

ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
Size

283KB
MD5

1f130569a8373dfae4f387d4757769cf
SHA1

038f27c37ade7fcb97745e149b65258a7a1ea295
SHA256

ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97
SHA512

7401da486a4141efe362f3ba80299f3305e05866e7a04cad8a40107fe6a83765e4616af4ef6f6f40b605135cd34a3c48dedc6023ee32facfb8b4984f29cfa7b3

Score

10^/10

dcrat diamondfox botnet discovery infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
botnet stealer diamondfox

DiamondFox payload 3 IoCs

Detects DiamondFox payload in file/memory.

Processes:

resource	yara_rule
behavioral2/memory/2880-123-0x0000000000400000-0x0000000000435000-memory.dmp	diamondfox
behavioral2/memory/2880-124-0x0000000000401000-mapping.dmp	diamondfox
behavioral2/memory/2880-125-0x0000000000400000-0x0000000000435000-memory.dmp	diamondfox

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/1940-134-0x0000000000400000-0x000000000047C000-memory.dmp	WebBrowserPassView
behavioral2/memory/1940-135-0x00000000004466F4-mapping.dmp	WebBrowserPassView
behavioral2/memory/1940-136-0x0000000000400000-0x000000000047C000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1940-134-0x0000000000400000-0x000000000047C000-memory.dmp	Nirsoft
behavioral2/memory/1940-135-0x00000000004466F4-mapping.dmp	Nirsoft
behavioral2/memory/1940-136-0x0000000000400000-0x000000000047C000-memory.dmp	Nirsoft

Drops startup file 2 IoCs

Processes:

ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

Processes:

ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exeed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe

description	pid	process	target process
PID 912 set thread context of 2880	912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 2880 set thread context of 1940	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes:

ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exeed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exeed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe

pid	process
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
1940	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
1940	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
1940	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
1940	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exewmic.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
Token: SeIncreaseQuotaPrivilege	2816	wmic.exe
Token: SeSecurityPrivilege	2816	wmic.exe
Token: SeTakeOwnershipPrivilege	2816	wmic.exe
Token: SeLoadDriverPrivilege	2816	wmic.exe
Token: SeSystemProfilePrivilege	2816	wmic.exe
Token: SeSystemtimePrivilege	2816	wmic.exe
Token: SeProfSingleProcessPrivilege	2816	wmic.exe
Token: SeIncBasePriorityPrivilege	2816	wmic.exe
Token: SeCreatePagefilePrivilege	2816	wmic.exe
Token: SeBackupPrivilege	2816	wmic.exe
Token: SeRestorePrivilege	2816	wmic.exe
Token: SeShutdownPrivilege	2816	wmic.exe
Token: SeDebugPrivilege	2816	wmic.exe
Token: SeSystemEnvironmentPrivilege	2816	wmic.exe
Token: SeRemoteShutdownPrivilege	2816	wmic.exe
Token: SeUndockPrivilege	2816	wmic.exe
Token: SeManageVolumePrivilege	2816	wmic.exe
Token: 33	2816	wmic.exe
Token: 34	2816	wmic.exe
Token: 35	2816	wmic.exe
Token: 36	2816	wmic.exe
Token: SeIncreaseQuotaPrivilege	2816	wmic.exe
Token: SeSecurityPrivilege	2816	wmic.exe
Token: SeTakeOwnershipPrivilege	2816	wmic.exe
Token: SeLoadDriverPrivilege	2816	wmic.exe
Token: SeSystemProfilePrivilege	2816	wmic.exe
Token: SeSystemtimePrivilege	2816	wmic.exe
Token: SeProfSingleProcessPrivilege	2816	wmic.exe
Token: SeIncBasePriorityPrivilege	2816	wmic.exe
Token: SeCreatePagefilePrivilege	2816	wmic.exe
Token: SeBackupPrivilege	2816	wmic.exe
Token: SeRestorePrivilege	2816	wmic.exe
Token: SeShutdownPrivilege	2816	wmic.exe
Token: SeDebugPrivilege	2816	wmic.exe
Token: SeSystemEnvironmentPrivilege	2816	wmic.exe
Token: SeRemoteShutdownPrivilege	2816	wmic.exe
Token: SeUndockPrivilege	2816	wmic.exe
Token: SeManageVolumePrivilege	2816	wmic.exe
Token: 33	2816	wmic.exe
Token: 34	2816	wmic.exe
Token: 35	2816	wmic.exe
Token: 36	2816	wmic.exe
Token: SeIncreaseQuotaPrivilege	2236	wmic.exe
Token: SeSecurityPrivilege	2236	wmic.exe
Token: SeTakeOwnershipPrivilege	2236	wmic.exe
Token: SeLoadDriverPrivilege	2236	wmic.exe
Token: SeSystemProfilePrivilege	2236	wmic.exe
Token: SeSystemtimePrivilege	2236	wmic.exe
Token: SeProfSingleProcessPrivilege	2236	wmic.exe
Token: SeIncBasePriorityPrivilege	2236	wmic.exe
Token: SeCreatePagefilePrivilege	2236	wmic.exe
Token: SeBackupPrivilege	2236	wmic.exe
Token: SeRestorePrivilege	2236	wmic.exe
Token: SeShutdownPrivilege	2236	wmic.exe
Token: SeDebugPrivilege	2236	wmic.exe
Token: SeSystemEnvironmentPrivilege	2236	wmic.exe
Token: SeRemoteShutdownPrivilege	2236	wmic.exe
Token: SeUndockPrivilege	2236	wmic.exe
Token: SeManageVolumePrivilege	2236	wmic.exe
Token: 33	2236	wmic.exe
Token: 34	2236	wmic.exe
Token: 35	2236	wmic.exe
Token: 36	2236	wmic.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exeed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe

description	pid	process	target process
PID 912 wrote to memory of 2880	912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 912 wrote to memory of 2880	912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 912 wrote to memory of 2880	912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 912 wrote to memory of 2880	912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 912 wrote to memory of 2880	912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 912 wrote to memory of 2880	912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 912 wrote to memory of 2880	912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 912 wrote to memory of 2880	912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 912 wrote to memory of 2880	912	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 2880 wrote to memory of 2816	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 2816	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 2816	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 2236	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 2236	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 2236	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 3916	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 3916	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 3916	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 2072	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 2072	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 2072	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 3852	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 3852	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 3852	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 1272	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 1272	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 1272	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 3548	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 3548	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 3548	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	wmic.exe
PID 2880 wrote to memory of 1940	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 2880 wrote to memory of 1940	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 2880 wrote to memory of 1940	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 2880 wrote to memory of 1940	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 2880 wrote to memory of 1940	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 2880 wrote to memory of 1940	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 2880 wrote to memory of 1940	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 2880 wrote to memory of 1940	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
PID 2880 wrote to memory of 1940	2880	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe	ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe

C:\Users\Admin\AppData\Local\Temp\ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
"C:\Users\Admin\AppData\Local\Temp\ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912

C:\Users\Admin\AppData\Local\Temp\ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
"C:\Users\Admin\AppData\Local\Temp\ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" /Node:localhost /Namespace:\\root\SecurityCenter2 path AntiVirusProduct get DisplayName /FORMAT:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" os get caption /FORMAT:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" path win32_VideoController get caption /FORMAT:List
3⤵
PID:3916

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" path win32_NetworkAdapterConfiguration where IPEnabled=1 get IPAddress /FORMAT:List
3⤵
PID:2072

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" LogicalDisk Where DriveType=4 get VolumeName /FORMAT:List
3⤵
PID:3852

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" path win32_PingStatus where address='vladisfoxlink.ru' get StatusCode /FORMAT:List
3⤵
PID:1272

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" path win32_PingStatus where address='vladisfoxlink.ru' get ResponseTime /FORMAT:List
3⤵
PID:3548

C:\Users\Admin\AppData\Local\Temp\ed5872028e073a00549aa0ffe151dc4d641eae83694c1fcc3dc545183c091d97.exe
/scomma "C:\Users\Admin\AppData\Local\Temp\1.log"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.log
MD5
4ab56e327e56a995c158a6116430835b

SHA1
bf39dbae7798cc8bd7d7073998b09652412b111b

SHA256
269c32926bf6faebe0581c23903f8dc8cef41ad46b333435d038b81d47f4785e

SHA512
37704769bf293cd6a9c0ccbec359fbb7278f163911d3f2ae27f6c9c3dece55be70c2c5695be953def5984b7eda05953b19581df236c44d5d269cf258e49ab4af

Download Submit
memory/912-121-0x0000000005A20000-0x0000000005A21000-memory.dmp

Filesize
4KB

Download
memory/912-117-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download
memory/912-118-0x0000000005650000-0x000000000568F000-memory.dmp

Filesize
252KB

Download
memory/912-119-0x0000000005980000-0x0000000005981000-memory.dmp

Filesize
4KB

Download
memory/912-120-0x00000000056E0000-0x0000000005BDE000-memory.dmp

Filesize
5.0MB

Download
memory/912-114-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/912-122-0x00000000056E0000-0x0000000005BDE000-memory.dmp

Filesize
5.0MB

Download
memory/912-116-0x0000000005BE0000-0x0000000005BE1000-memory.dmp

Filesize
4KB

Download
memory/912-126-0x0000000006670000-0x0000000006671000-memory.dmp

Filesize
4KB

Download
memory/1272-132-0x0000000000000000-mapping.dmp

Download
memory/1940-136-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1940-135-0x00000000004466F4-mapping.dmp

Download
memory/1940-134-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2072-130-0x0000000000000000-mapping.dmp

Download
memory/2236-128-0x0000000000000000-mapping.dmp

Download
memory/2816-127-0x0000000000000000-mapping.dmp

Download
memory/2880-125-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2880-124-0x0000000000401000-mapping.dmp

Download
memory/2880-123-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3548-133-0x0000000000000000-mapping.dmp

Download
memory/3852-131-0x0000000000000000-mapping.dmp

Download
memory/3916-129-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads