azorult | e688db3d0be7a10fa8ddd79918265cac9ef0949d7d07072f82aff9ae43d6fadb

Analysis

max time kernel
143s
max time network
125s
platform
windows10_x64
resource
win10-en-20211014
submitted
02-11-2021 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d4043e95026d07137c5ea2205fcb854.exe
Size

1.3MB
MD5

1d4043e95026d07137c5ea2205fcb854
SHA1

719bd3259af48728d946ffd535d291a25d6a9eef
SHA256

e688db3d0be7a10fa8ddd79918265cac9ef0949d7d07072f82aff9ae43d6fadb
SHA512

8150c5a465e2efb4dd887885343695f52d43346e32c8977f836e2238afca2c6492cd8d6d68bd2add61b0c8e34e951583490f7b5108a2b581b6c45de3be2fcc61

Score

10^/10

azorult oski raccoon 32365171a31c4583d6e3b7aad1690e41cefc38eb collection discovery infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

oski

colonna.ac.ug

Extracted

Family

raccoon

Botnet

32365171a31c4583d6e3b7aad1690e41cefc38eb

Attributes

url4cnc
http://telegalive.top/brikitiki
http://toptelete.top/brikitiki
http://telegraf.top/brikitiki
https://t.me/brikitiki

rc4.plain

Extracted

Family

azorult

http://195.245.112.115/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3420 created 792 3420 WerFault.exe 1d4043e95026d07137c5ea2205fcb854.exe
Downloads MZ/PE file
Executes dropped EXE 8 IoCs

Processes:

cdvcxsdme.exevbndfgame.execdvcxsdme.exevbndfgame.execc.exepm.execc.exeaspnet_compiler.exe

pid process

2100 cdvcxsdme.exe
3012 vbndfgame.exe
1120 cdvcxsdme.exe
1404 vbndfgame.exe
1908 cc.exe
1960 pm.exe
3784 cc.exe
4072 aspnet_compiler.exe
Loads dropped DLL 8 IoCs

Processes:

vbndfgame.execdvcxsdme.exe

pid process

1404 vbndfgame.exe
1404 vbndfgame.exe
1404 vbndfgame.exe
1120 cdvcxsdme.exe
1120 cdvcxsdme.exe
1120 cdvcxsdme.exe
1120 cdvcxsdme.exe
1120 cdvcxsdme.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

description	pid	process	target process
PID 3420 created 792	3420	WerFault.exe	1d4043e95026d07137c5ea2205fcb854.exe

pid	process
2100	cdvcxsdme.exe
3012	vbndfgame.exe
1120	cdvcxsdme.exe
1404	vbndfgame.exe
1908	cc.exe
1960	pm.exe
3784	cc.exe
4072	aspnet_compiler.exe

pid	process
1404	vbndfgame.exe
1404	vbndfgame.exe
1404	vbndfgame.exe
1120	cdvcxsdme.exe
1120	cdvcxsdme.exe
1120	cdvcxsdme.exe
1120	cdvcxsdme.exe
1120	cdvcxsdme.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

cdvcxsdme.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	cdvcxsdme.exe
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	cdvcxsdme.exe
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cdvcxsdme.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

pm.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\winda = "\"C:\\Users\\Admin\\AppData\\Roaming\\winda.exe\""	pm.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 5 IoCs

Processes:

1d4043e95026d07137c5ea2205fcb854.execdvcxsdme.exevbndfgame.execc.exepm.exe

description	pid	process	target process
PID 2624 set thread context of 792	2624	1d4043e95026d07137c5ea2205fcb854.exe	1d4043e95026d07137c5ea2205fcb854.exe
PID 2100 set thread context of 1120	2100	cdvcxsdme.exe	cdvcxsdme.exe
PID 3012 set thread context of 1404	3012	vbndfgame.exe	vbndfgame.exe
PID 1908 set thread context of 3784	1908	cc.exe	cc.exe
PID 1960 set thread context of 4072	1960	pm.exe	aspnet_compiler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3420 792 WerFault.exe 1d4043e95026d07137c5ea2205fcb854.exe

pid	pid_target	process	target process
3420	792	WerFault.exe	1d4043e95026d07137c5ea2205fcb854.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

vbndfgame.execdvcxsdme.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vbndfgame.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cdvcxsdme.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cdvcxsdme.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2756 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2968 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

892 taskkill.exe

pid	process
2756	schtasks.exe

pid	process
2968	timeout.exe

pid	process
892	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

cc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	cc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	cc.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

cdvcxsdme.exepm.exeWerFault.exe

pid	process
1120	cdvcxsdme.exe
1120	cdvcxsdme.exe
1960	pm.exe
3420	WerFault.exe
3420	WerFault.exe
3420	WerFault.exe
3420	WerFault.exe
3420	WerFault.exe
3420	WerFault.exe
3420	WerFault.exe
3420	WerFault.exe
3420	WerFault.exe
3420	WerFault.exe
3420	WerFault.exe
3420	WerFault.exe
3420	WerFault.exe
1960	pm.exe
1960	pm.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

1d4043e95026d07137c5ea2205fcb854.execdvcxsdme.exevbndfgame.exe

pid process

2624 1d4043e95026d07137c5ea2205fcb854.exe
2100 cdvcxsdme.exe
3012 vbndfgame.exe

pid	process
2624	1d4043e95026d07137c5ea2205fcb854.exe
2100	cdvcxsdme.exe
3012	vbndfgame.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

taskkill.exepm.exeWerFault.exeaspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	892	taskkill.exe
Token: SeDebugPrivilege	1960	pm.exe
Token: SeRestorePrivilege	3420	WerFault.exe
Token: SeBackupPrivilege	3420	WerFault.exe
Token: SeDebugPrivilege	3420	WerFault.exe
Token: SeDebugPrivilege	4072	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

1d4043e95026d07137c5ea2205fcb854.execdvcxsdme.exevbndfgame.exe

pid process

2624 1d4043e95026d07137c5ea2205fcb854.exe
2100 cdvcxsdme.exe
3012 vbndfgame.exe

pid	process
2624	1d4043e95026d07137c5ea2205fcb854.exe
2100	cdvcxsdme.exe
3012	vbndfgame.exe

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

1d4043e95026d07137c5ea2205fcb854.execdvcxsdme.exevbndfgame.exevbndfgame.execmd.execdvcxsdme.execmd.execc.execc.exepm.exe

description	pid	process	target process
PID 2624 wrote to memory of 2100	2624	1d4043e95026d07137c5ea2205fcb854.exe	cdvcxsdme.exe
PID 2624 wrote to memory of 2100	2624	1d4043e95026d07137c5ea2205fcb854.exe	cdvcxsdme.exe
PID 2624 wrote to memory of 2100	2624	1d4043e95026d07137c5ea2205fcb854.exe	cdvcxsdme.exe
PID 2624 wrote to memory of 3012	2624	1d4043e95026d07137c5ea2205fcb854.exe	vbndfgame.exe
PID 2624 wrote to memory of 3012	2624	1d4043e95026d07137c5ea2205fcb854.exe	vbndfgame.exe
PID 2624 wrote to memory of 3012	2624	1d4043e95026d07137c5ea2205fcb854.exe	vbndfgame.exe
PID 2624 wrote to memory of 792	2624	1d4043e95026d07137c5ea2205fcb854.exe	1d4043e95026d07137c5ea2205fcb854.exe
PID 2624 wrote to memory of 792	2624	1d4043e95026d07137c5ea2205fcb854.exe	1d4043e95026d07137c5ea2205fcb854.exe
PID 2624 wrote to memory of 792	2624	1d4043e95026d07137c5ea2205fcb854.exe	1d4043e95026d07137c5ea2205fcb854.exe
PID 2624 wrote to memory of 792	2624	1d4043e95026d07137c5ea2205fcb854.exe	1d4043e95026d07137c5ea2205fcb854.exe
PID 2100 wrote to memory of 1120	2100	cdvcxsdme.exe	cdvcxsdme.exe
PID 2100 wrote to memory of 1120	2100	cdvcxsdme.exe	cdvcxsdme.exe
PID 2100 wrote to memory of 1120	2100	cdvcxsdme.exe	cdvcxsdme.exe
PID 2100 wrote to memory of 1120	2100	cdvcxsdme.exe	cdvcxsdme.exe
PID 3012 wrote to memory of 1404	3012	vbndfgame.exe	vbndfgame.exe
PID 3012 wrote to memory of 1404	3012	vbndfgame.exe	vbndfgame.exe
PID 3012 wrote to memory of 1404	3012	vbndfgame.exe	vbndfgame.exe
PID 3012 wrote to memory of 1404	3012	vbndfgame.exe	vbndfgame.exe
PID 1404 wrote to memory of 3588	1404	vbndfgame.exe	cmd.exe
PID 1404 wrote to memory of 3588	1404	vbndfgame.exe	cmd.exe
PID 1404 wrote to memory of 3588	1404	vbndfgame.exe	cmd.exe
PID 3588 wrote to memory of 892	3588	cmd.exe	taskkill.exe
PID 3588 wrote to memory of 892	3588	cmd.exe	taskkill.exe
PID 3588 wrote to memory of 892	3588	cmd.exe	taskkill.exe
PID 1120 wrote to memory of 1908	1120	cdvcxsdme.exe	cc.exe
PID 1120 wrote to memory of 1908	1120	cdvcxsdme.exe	cc.exe
PID 1120 wrote to memory of 1908	1120	cdvcxsdme.exe	cc.exe
PID 1120 wrote to memory of 1960	1120	cdvcxsdme.exe	pm.exe
PID 1120 wrote to memory of 1960	1120	cdvcxsdme.exe	pm.exe
PID 1120 wrote to memory of 2996	1120	cdvcxsdme.exe	cmd.exe
PID 1120 wrote to memory of 2996	1120	cdvcxsdme.exe	cmd.exe
PID 1120 wrote to memory of 2996	1120	cdvcxsdme.exe	cmd.exe
PID 2996 wrote to memory of 2968	2996	cmd.exe	timeout.exe
PID 2996 wrote to memory of 2968	2996	cmd.exe	timeout.exe
PID 2996 wrote to memory of 2968	2996	cmd.exe	timeout.exe
PID 1908 wrote to memory of 3784	1908	cc.exe	cc.exe
PID 1908 wrote to memory of 3784	1908	cc.exe	cc.exe
PID 1908 wrote to memory of 3784	1908	cc.exe	cc.exe
PID 1908 wrote to memory of 3784	1908	cc.exe	cc.exe
PID 1908 wrote to memory of 3784	1908	cc.exe	cc.exe
PID 3784 wrote to memory of 2756	3784	cc.exe	schtasks.exe
PID 3784 wrote to memory of 2756	3784	cc.exe	schtasks.exe
PID 3784 wrote to memory of 2756	3784	cc.exe	schtasks.exe
PID 1960 wrote to memory of 4072	1960	pm.exe	aspnet_compiler.exe
PID 1960 wrote to memory of 4072	1960	pm.exe	aspnet_compiler.exe
PID 1960 wrote to memory of 4072	1960	pm.exe	aspnet_compiler.exe
PID 1960 wrote to memory of 4072	1960	pm.exe	aspnet_compiler.exe
PID 1960 wrote to memory of 4072	1960	pm.exe	aspnet_compiler.exe
PID 1960 wrote to memory of 4072	1960	pm.exe	aspnet_compiler.exe

outlook_office_path 1 IoCs

Processes:

cdvcxsdme.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cdvcxsdme.exe

outlook_win_path 1 IoCs

Processes:

cdvcxsdme.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	cdvcxsdme.exe

C:\Users\Admin\AppData\Local\Temp\1d4043e95026d07137c5ea2205fcb854.exe
"C:\Users\Admin\AppData\Local\Temp\1d4043e95026d07137c5ea2205fcb854.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624

C:\Users\Admin\AppData\Local\Temp\cdvcxsdme.exe
"C:\Users\Admin\AppData\Local\Temp\cdvcxsdme.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100

C:\Users\Admin\AppData\Local\Temp\cdvcxsdme.exe
"C:\Users\Admin\AppData\Local\Temp\cdvcxsdme.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1120

C:\Users\Admin\AppData\Local\Temp\cc.exe
"C:\Users\Admin\AppData\Local\Temp\cc.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1908

C:\Users\Admin\AppData\Local\Temp\cc.exe
C:\Users\Admin\AppData\Local\Temp\cc.exe
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
6⤵
- Creates scheduled task(s)
PID:2756

C:\Users\Admin\AppData\Local\Temp\pm.exe
"C:\Users\Admin\AppData\Local\Temp\pm.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960

C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe
C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "cdvcxsdme.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\SysWOW64\timeout.exe
C:\Windows\system32\timeout.exe 3
5⤵
- Delays execution with timeout.exe
PID:2968

C:\Users\Admin\AppData\Local\Temp\vbndfgame.exe
"C:\Users\Admin\AppData\Local\Temp\vbndfgame.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012

C:\Users\Admin\AppData\Local\Temp\vbndfgame.exe
"C:\Users\Admin\AppData\Local\Temp\vbndfgame.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /pid 1404 & erase C:\Users\Admin\AppData\Local\Temp\vbndfgame.exe & RD /S /Q C:\\ProgramData\\874842480062497\\* & exit
4⤵
- Suspicious use of WriteProcessMemory
PID:3588

C:\Windows\SysWOW64\taskkill.exe
taskkill /pid 1404
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Users\Admin\AppData\Local\Temp\1d4043e95026d07137c5ea2205fcb854.exe
"C:\Users\Admin\AppData\Local\Temp\1d4043e95026d07137c5ea2205fcb854.exe"
2⤵
PID:792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 1212
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3420

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe
MD5
843969865a92a4e82c26a2fa75ca4026

SHA1
c1046b49bc93cb3b37cebe1388d0b72bb66ab2e7

SHA256
3bd221cdc9867ee90ba3633f2266f298b4cb4fac98c70a0f208ce4afb6748637

SHA512
b9b30b9a69b5c7d536fe5d3c7d4615b2d9eec8410d20727c1ad17ba36c2876cb9ddbfe77353101fd80d92653724a176cd7f20c85cfaf69c6b74e95cf7de7440a

Download Submit
C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe
MD5
843969865a92a4e82c26a2fa75ca4026

SHA1
c1046b49bc93cb3b37cebe1388d0b72bb66ab2e7

SHA256
3bd221cdc9867ee90ba3633f2266f298b4cb4fac98c70a0f208ce4afb6748637

SHA512
b9b30b9a69b5c7d536fe5d3c7d4615b2d9eec8410d20727c1ad17ba36c2876cb9ddbfe77353101fd80d92653724a176cd7f20c85cfaf69c6b74e95cf7de7440a

Download Submit
C:\Users\Admin\AppData\Local\Temp\cc.exe
MD5
857f6017b36866f5e47a835608b6377c

SHA1
bf46cd2d2ea1f64a1a44743f3e0b5a8de3efc75b

SHA256
214dc633d8cda71fa724675e530ef5e8b554389ee07268d4bcc54d44c6b1cc81

SHA512
70e6f6192aa47885fcfa56bd27f76211b4cabc40a3c267a54affdf548b7d417ac4b54bbcf547db27ee686970b61f8128b908bb29cccd5e7efa96bd9b6278d475

Download Submit
C:\Users\Admin\AppData\Local\Temp\cc.exe
MD5
857f6017b36866f5e47a835608b6377c

SHA1
bf46cd2d2ea1f64a1a44743f3e0b5a8de3efc75b

SHA256
214dc633d8cda71fa724675e530ef5e8b554389ee07268d4bcc54d44c6b1cc81

SHA512
70e6f6192aa47885fcfa56bd27f76211b4cabc40a3c267a54affdf548b7d417ac4b54bbcf547db27ee686970b61f8128b908bb29cccd5e7efa96bd9b6278d475

Download Submit
C:\Users\Admin\AppData\Local\Temp\cc.exe
MD5
857f6017b36866f5e47a835608b6377c

SHA1
bf46cd2d2ea1f64a1a44743f3e0b5a8de3efc75b

SHA256
214dc633d8cda71fa724675e530ef5e8b554389ee07268d4bcc54d44c6b1cc81

SHA512
70e6f6192aa47885fcfa56bd27f76211b4cabc40a3c267a54affdf548b7d417ac4b54bbcf547db27ee686970b61f8128b908bb29cccd5e7efa96bd9b6278d475

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdvcxsdme.exe
MD5
4e3ce87e384ee87adeab302cf1cc954d

SHA1
3802a320194794b2d1b23f75244f12898e67e756

SHA256
d4ff533cf4e83a677480d564c5dcb10387f8ab9a5440660edadfa8be93154b79

SHA512
59fe8ac8b070fd292c84f68ec371de3d060b1070bd95abef5ffc17499e32e2e715a4d4c103ad2dcf7670a511d49f1dc976d5725bbeca9d9c46cfa914c1ffd8bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdvcxsdme.exe
MD5
4e3ce87e384ee87adeab302cf1cc954d

SHA1
3802a320194794b2d1b23f75244f12898e67e756

SHA256
d4ff533cf4e83a677480d564c5dcb10387f8ab9a5440660edadfa8be93154b79

SHA512
59fe8ac8b070fd292c84f68ec371de3d060b1070bd95abef5ffc17499e32e2e715a4d4c103ad2dcf7670a511d49f1dc976d5725bbeca9d9c46cfa914c1ffd8bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdvcxsdme.exe
MD5
4e3ce87e384ee87adeab302cf1cc954d

SHA1
3802a320194794b2d1b23f75244f12898e67e756

SHA256
d4ff533cf4e83a677480d564c5dcb10387f8ab9a5440660edadfa8be93154b79

SHA512
59fe8ac8b070fd292c84f68ec371de3d060b1070bd95abef5ffc17499e32e2e715a4d4c103ad2dcf7670a511d49f1dc976d5725bbeca9d9c46cfa914c1ffd8bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\pm.exe
MD5
6e789104f391b73b1aa11d4b75176b58

SHA1
876e0d07c8c3e729e2af2e4cf3b447e467f114df

SHA256
35235fda554c446f3081ddbbaf1f18be2300a3830c1943cb93e53becb83d84e9

SHA512
efac7eb794d7b6cfcc97b668f26053247959dc863673b3114bc1696f72fcaf6c4e36725c575a5503a48a0e9b6e691b612811f0377a45c8c85aaf2715e6440d0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\pm.exe
MD5
6e789104f391b73b1aa11d4b75176b58

SHA1
876e0d07c8c3e729e2af2e4cf3b447e467f114df

SHA256
35235fda554c446f3081ddbbaf1f18be2300a3830c1943cb93e53becb83d84e9

SHA512
efac7eb794d7b6cfcc97b668f26053247959dc863673b3114bc1696f72fcaf6c4e36725c575a5503a48a0e9b6e691b612811f0377a45c8c85aaf2715e6440d0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbndfgame.exe
MD5
00c219e3b4b1cd75c6f7887e5cc2dad0

SHA1
267bfa515e571c316e4246ac946fc1ccf7c20ccf

SHA256
91fafc30aa5730cf5f8a49037ba7d4ae8aaa6b2c6638310d78fdaacb0d9e1e2a

SHA512
68dbd067b5a53bf9f5eca4ae734d5a6769652a1125fdf97df4df5e2e58cdd2ba46c707f4b08202de63e4a84fa9e19298da93fd025e6950a869023b75db050751

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbndfgame.exe
MD5
00c219e3b4b1cd75c6f7887e5cc2dad0

SHA1
267bfa515e571c316e4246ac946fc1ccf7c20ccf

SHA256
91fafc30aa5730cf5f8a49037ba7d4ae8aaa6b2c6638310d78fdaacb0d9e1e2a

SHA512
68dbd067b5a53bf9f5eca4ae734d5a6769652a1125fdf97df4df5e2e58cdd2ba46c707f4b08202de63e4a84fa9e19298da93fd025e6950a869023b75db050751

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbndfgame.exe
MD5
00c219e3b4b1cd75c6f7887e5cc2dad0

SHA1
267bfa515e571c316e4246ac946fc1ccf7c20ccf

SHA256
91fafc30aa5730cf5f8a49037ba7d4ae8aaa6b2c6638310d78fdaacb0d9e1e2a

SHA512
68dbd067b5a53bf9f5eca4ae734d5a6769652a1125fdf97df4df5e2e58cdd2ba46c707f4b08202de63e4a84fa9e19298da93fd025e6950a869023b75db050751

Download Submit
\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
\ProgramData\sqlite3.dll
MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
\Users\Admin\AppData\Local\Temp\1508CF4E\mozglue.dll
MD5
9e682f1eb98a9d41468fc3e50f907635

SHA1
85e0ceca36f657ddf6547aa0744f0855a27527ee

SHA256
830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d

SHA512
230230722d61ac1089fabf3f2decfa04f9296498f8e2a2a49b1527797dca67b5a11ab8656f04087acadf873fa8976400d57c77c404eba4aff89d92b9986f32ed

Download Submit
\Users\Admin\AppData\Local\Temp\1508CF4E\msvcp140.dll
MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
\Users\Admin\AppData\Local\Temp\1508CF4E\nss3.dll
MD5
556ea09421a0f74d31c4c0a89a70dc23

SHA1
f739ba9b548ee64b13eb434a3130406d23f836e3

SHA256
f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb

SHA512
2481fc80dffa8922569552c3c3ebaef8d0341b80427447a14b291ec39ea62ab9c05a75e85eef5ea7f857488cab1463c18586f9b076e2958c5a314e459045ede2

Download Submit
\Users\Admin\AppData\Local\Temp\1508CF4E\vcruntime140.dll
MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
\Users\Admin\AppData\Local\Temp\1508CF4E\vcruntime140.dll
MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
memory/792-130-0x000000000043E9BE-mapping.dmp

Download
memory/792-141-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/792-142-0x00000000004A0000-0x000000000054E000-memory.dmp

Filesize
696KB

Download
memory/892-153-0x0000000000000000-mapping.dmp

Download
memory/1120-136-0x0000000000430000-0x000000000057A000-memory.dmp

Filesize
1.3MB

Download
memory/1120-131-0x000000000041A684-mapping.dmp

Download
memory/1120-143-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1404-133-0x0000000000417A8B-mapping.dmp

Download
memory/1404-138-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1404-139-0x0000000000440000-0x00000000004EE000-memory.dmp

Filesize
696KB

Download
memory/1908-158-0x00000000022E1000-0x00000000022F5000-memory.dmp

Filesize
80KB

Download
memory/1908-154-0x0000000000000000-mapping.dmp

Download
memory/1908-157-0x00000000004F0000-0x000000000059E000-memory.dmp

Filesize
696KB

Download
memory/1960-173-0x000000001C360000-0x000000001C3D8000-memory.dmp

Filesize
480KB

Download
memory/1960-180-0x000000001C3F2000-0x000000001C3F4000-memory.dmp

Filesize
8KB

Download
memory/1960-181-0x000000001C3F4000-0x000000001C3F5000-memory.dmp

Filesize
4KB

Download
memory/1960-166-0x000000001C3F0000-0x000000001C3F2000-memory.dmp

Filesize
8KB

Download
memory/1960-172-0x000000001C400000-0x000000001C4AD000-memory.dmp

Filesize
692KB

Download
memory/1960-159-0x0000000000000000-mapping.dmp

Download
memory/1960-162-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2100-118-0x0000000000000000-mapping.dmp

Download
memory/2100-128-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/2100-137-0x00000000026C0000-0x00000000026C7000-memory.dmp

Filesize
28KB

Download
memory/2100-123-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/2100-121-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2624-115-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/2624-117-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/2624-116-0x00000000006B0000-0x00000000006BA000-memory.dmp

Filesize
40KB

Download
memory/2624-135-0x0000000002CC0000-0x0000000002CC7000-memory.dmp

Filesize
28KB

Download
memory/2756-170-0x0000000000000000-mapping.dmp

Download
memory/2968-165-0x0000000000000000-mapping.dmp

Download
memory/2996-164-0x0000000000000000-mapping.dmp

Download
memory/3012-129-0x00000000004C0000-0x000000000056E000-memory.dmp

Filesize
696KB

Download
memory/3012-140-0x00000000004C0000-0x000000000056E000-memory.dmp

Filesize
696KB

Download
memory/3012-122-0x0000000000000000-mapping.dmp

Download
memory/3588-152-0x0000000000000000-mapping.dmp

Download
memory/3784-171-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3784-167-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3784-168-0x000000000040202B-mapping.dmp

Download
memory/4072-175-0x0000000140000000-mapping.dmp

Download
memory/4072-174-0x0000000140000000-0x0000000140070000-memory.dmp

Filesize
448KB

Download
memory/4072-182-0x00000265F5930000-0x00000265F59B5000-memory.dmp

Filesize
532KB

Download
memory/4072-183-0x00000265F59E0000-0x00000265F59E2000-memory.dmp

Filesize
8KB

Download
memory/4072-184-0x00000265F5C00000-0x00000265F5C4E000-memory.dmp

Filesize
312KB

Download
memory/4072-185-0x00000265F5250000-0x00000265F5255000-memory.dmp

Filesize
20KB

Download
memory/4072-186-0x00000265F5C50000-0x00000265F5C9F000-memory.dmp

Filesize
316KB

Download
memory/4072-187-0x00000265F5CA0000-0x00000265F5CE6000-memory.dmp

Filesize
280KB

Download