dcrat | 6116bdbb3fe14fc7332761384a4d04b92b67eacd9a73245008b3b693204f6dcf

System Information Discovery

Processes:

hF7AEpWLrQU0kZ6ODlO7TM4r.exeNetdhcpsvcDriverintocrt.exeHyETNjrh5ivUqWlqzqoRNxBn.exeBS4Px4hwEeXp4WGCb5v1RGfL.exeWScript.exeOZVrGg6pS6ezue5OKjDkQAaE.exe6116bdbb3fe14fc7332761384a4d04b92b67eacd9a73245008b3b693204f6dcf.exesotema_1.exesotema_5.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	hF7AEpWLrQU0kZ6ODlO7TM4r.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	NetdhcpsvcDriverintocrt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	HyETNjrh5ivUqWlqzqoRNxBn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	BS4Px4hwEeXp4WGCb5v1RGfL.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	OZVrGg6pS6ezue5OKjDkQAaE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	6116bdbb3fe14fc7332761384a4d04b92b67eacd9a73245008b3b693204f6dcf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	sotema_1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	sotema_5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	Install.exe

Loads dropped DLL 17 IoCs

Processes:

setup_install.exesotema_6.tmprUNdlL32.eXesotema_2.exeOZVrGg6pS6ezue5OKjDkQAaE.exeevjhbveAccostarmi.exe.pif

pid	process
4760	setup_install.exe
4760	setup_install.exe
4760	setup_install.exe
4760	setup_install.exe
4760	setup_install.exe
3144	sotema_6.tmp
2416	rUNdlL32.eXe
2004	sotema_2.exe
4528	OZVrGg6pS6ezue5OKjDkQAaE.exe
4528	OZVrGg6pS6ezue5OKjDkQAaE.exe
2300	evjhbve
1484	Accostarmi.exe.pif
1484	Accostarmi.exe.pif
1484	Accostarmi.exe.pif
1484	Accostarmi.exe.pif
1484	Accostarmi.exe.pif
1484	Accostarmi.exe.pif

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

NetdhcpsvcDriverintocrt.exe2sLIAsXQmTkdasCg6OpALBG8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\SimCfg\\dwm.exe\""	NetdhcpsvcDriverintocrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WerFault = "\"C:\\odt\\WerFault.exe\""	NetdhcpsvcDriverintocrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Netdhcpsvc\\StartMenuExperienceHost.exe\""	NetdhcpsvcDriverintocrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\WsmAgentUninstall\\WmiPrvSE.exe\""	NetdhcpsvcDriverintocrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Install = "\"C:\\Netdhcpsvc\\Install.exe\""	NetdhcpsvcDriverintocrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\System32\\CoreMessaging\\conhost.exe\""	NetdhcpsvcDriverintocrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\Migration\\WTR\\conhost.exe\""	NetdhcpsvcDriverintocrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eyxrppteq = "\"C:\\Users\\Admin\\AppData\\Roaming\\Mzpexsf\\Eyxrppteq.exe\""	2sLIAsXQmTkdasCg6OpALBG8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BS4Px4hwEeXp4WGCb5v1RGfL = "\"C:\\Netdhcpsvc\\BS4Px4hwEeXp4WGCb5v1RGfL.exe\""	NetdhcpsvcDriverintocrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\kbdgeome\\dwm.exe\""	NetdhcpsvcDriverintocrt.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

99 ipinfo.io
102 api.db-ip.com
103 api.db-ip.com
11 ip-api.com
98 ipinfo.io

flow	ioc
99	ipinfo.io
102	api.db-ip.com
103	api.db-ip.com
11	ip-api.com
98	ipinfo.io

Drops file in System32 directory 9 IoCs

Processes:

NetdhcpsvcDriverintocrt.exeInstall.exe

description	ioc	process
File created	C:\Windows\System32\CoreMessaging\conhost.exe	NetdhcpsvcDriverintocrt.exe
File created	C:\Windows\System32\SimCfg\dwm.exe	NetdhcpsvcDriverintocrt.exe
File created	C:\Windows\System32\kbdgeome\6cb0b6c459d5d3	NetdhcpsvcDriverintocrt.exe
File created	C:\Windows\System32\SimCfg\6cb0b6c459d5d3	NetdhcpsvcDriverintocrt.exe
File created	C:\Windows\System32\kbdgeome\dwm.exe	NetdhcpsvcDriverintocrt.exe
File created	C:\Windows\System32\CoreMessaging\088424020bedd6	NetdhcpsvcDriverintocrt.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\System32\wbem\WsmAgentUninstall\WmiPrvSE.exe	NetdhcpsvcDriverintocrt.exe
File created	C:\Windows\System32\wbem\WsmAgentUninstall\24dbde2999530e	NetdhcpsvcDriverintocrt.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

2sLIAsXQmTkdasCg6OpALBG8.exeAccostarmi.exe.pif

description	pid	process	target process
PID 4596 set thread context of 388	4596	2sLIAsXQmTkdasCg6OpALBG8.exe	MSBuild.exe
PID 1484 set thread context of 3676	1484	Accostarmi.exe.pif	Accostarmi.exe.pif

Drops file in Windows directory 3 IoCs

Processes:

NetdhcpsvcDriverintocrt.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Migration\WTR\conhost.exe	NetdhcpsvcDriverintocrt.exe
File created	C:\Windows\Migration\WTR\088424020bedd6	NetdhcpsvcDriverintocrt.exe
File created	C:\Windows\Tasks\booXbIzkEgfNdKvxAC.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 18 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2844	2416	WerFault.exe	rUNdlL32.eXe
4820	4024	WerFault.exe	sotema_3.exe
4820	2832	WerFault.exe	FBKYcin59tyjMPHSUv7BH_aX.exe
4508	3480	WerFault.exe
4344	3764	WerFault.exe
4920	4736	WerFault.exe	Uhn7Q0rtlXMplTY_9N4Qj8GN.exe
4456	2832	WerFault.exe	FBKYcin59tyjMPHSUv7BH_aX.exe
1484	4084	WerFault.exe	IS78n_CWfc_wtXJOmUGZsL4f.exe
228	4084	WerFault.exe	IS78n_CWfc_wtXJOmUGZsL4f.exe
380	3480	WerFault.exe	hF7AEpWLrQU0kZ6ODlO7TM4r.exe
2368	3764	WerFault.exe	v0B4OhkWWppszDzLHWyssVrY.exe
3380	4736	WerFault.exe	Uhn7Q0rtlXMplTY_9N4Qj8GN.exe
4820	3480	WerFault.exe	hF7AEpWLrQU0kZ6ODlO7TM4r.exe
256	3480	WerFault.exe	hF7AEpWLrQU0kZ6ODlO7TM4r.exe
2460	3480	WerFault.exe	hF7AEpWLrQU0kZ6ODlO7TM4r.exe
4468	3480	WerFault.exe	hF7AEpWLrQU0kZ6ODlO7TM4r.exe
3204	3480	WerFault.exe	hF7AEpWLrQU0kZ6ODlO7TM4r.exe
3092	3480	WerFault.exe	hF7AEpWLrQU0kZ6ODlO7TM4r.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

evjhbvesotema_2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	evjhbve
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	evjhbve
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	evjhbve
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sotema_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sotema_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sotema_2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

OZVrGg6pS6ezue5OKjDkQAaE.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OZVrGg6pS6ezue5OKjDkQAaE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OZVrGg6pS6ezue5OKjDkQAaE.exe

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4672	schtasks.exe
4072	schtasks.exe
4076	schtasks.exe
3640	schtasks.exe
956	schtasks.exe
3160	schtasks.exe
4800	schtasks.exe
2576	schtasks.exe
4012	schtasks.exe
2804	schtasks.exe
3888	schtasks.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2276 timeout.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

1152 tasklist.exe
3176 tasklist.exe

pid	process
2276	timeout.exe

pid	process
1152	tasklist.exe
3176	tasklist.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

Install.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

2604 taskkill.exe
3728 taskkill.exe
4320 taskkill.exe

pid	process
2604	taskkill.exe
3728	taskkill.exe
4320	taskkill.exe

Modifies registry class 2 IoCs

Processes:

sotema_1.exeHyETNjrh5ivUqWlqzqoRNxBn.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	sotema_1.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	HyETNjrh5ivUqWlqzqoRNxBn.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

sotema_3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sotema_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sotema_3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

jfiag3g_gg.exesotema_2.exe

pid	process
3208	jfiag3g_gg.exe
3208	jfiag3g_gg.exe
2004	sotema_2.exe
2004	sotema_2.exe
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3028
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

sotema_2.exeevjhbve

pid process

2004 sotema_2.exe
2300 evjhbve

pid	process
3028

pid	process
2004	sotema_2.exe
2300	evjhbve

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

damse0JB1oV1OzxpQud9fSIT.exe

description	pid	process
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeCreateTokenPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeAssignPrimaryTokenPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeLockMemoryPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeIncreaseQuotaPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeMachineAccountPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeTcbPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeSecurityPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeTakeOwnershipPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeLoadDriverPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeSystemProfilePrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeSystemtimePrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeProfSingleProcessPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeIncBasePriorityPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeCreatePagefilePrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeCreatePermanentPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeBackupPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeRestorePrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeShutdownPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeDebugPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeAuditPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeSystemEnvironmentPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeChangeNotifyPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeRemoteShutdownPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeUndockPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeSyncAgentPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeEnableDelegationPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeManageVolumePrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeImpersonatePrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeCreateGlobalPrivilege	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: 31	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: 32	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: 33	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: 34	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: 35	4536	damse0JB1oV1OzxpQud9fSIT.exe
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028

Suspicious use of FindShellTrayWindow 15 IoCs

Processes:

Accostarmi.exe.pif

pid process

1484 Accostarmi.exe.pif
3028
3028
1484 Accostarmi.exe.pif
1484 Accostarmi.exe.pif
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Accostarmi.exe.pif

pid process

1484 Accostarmi.exe.pif
1484 Accostarmi.exe.pif
1484 Accostarmi.exe.pif

pid	process
1484	Accostarmi.exe.pif
3028
3028
1484	Accostarmi.exe.pif
1484	Accostarmi.exe.pif
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028

pid	process
1484	Accostarmi.exe.pif
1484	Accostarmi.exe.pif
1484	Accostarmi.exe.pif

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6116bdbb3fe14fc7332761384a4d04b92b67eacd9a73245008b3b693204f6dcf.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.exesotema_6.exesotema_4.exesotema_1.exesotema_5.exe

description	pid	process	target process
PID 2392 wrote to memory of 4760	2392	6116bdbb3fe14fc7332761384a4d04b92b67eacd9a73245008b3b693204f6dcf.exe	setup_install.exe
PID 2392 wrote to memory of 4760	2392	6116bdbb3fe14fc7332761384a4d04b92b67eacd9a73245008b3b693204f6dcf.exe	setup_install.exe
PID 2392 wrote to memory of 4760	2392	6116bdbb3fe14fc7332761384a4d04b92b67eacd9a73245008b3b693204f6dcf.exe	setup_install.exe
PID 4760 wrote to memory of 4940	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4940	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4940	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4680	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4680	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4680	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4600	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4600	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4600	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4608	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4608	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4608	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 5036	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 5036	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 5036	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4488	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4488	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4488	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4528	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4528	4760	setup_install.exe	cmd.exe
PID 4760 wrote to memory of 4528	4760	setup_install.exe	cmd.exe
PID 4940 wrote to memory of 4572	4940	cmd.exe	sotema_1.exe
PID 4940 wrote to memory of 4572	4940	cmd.exe	sotema_1.exe
PID 4940 wrote to memory of 4572	4940	cmd.exe	sotema_1.exe
PID 4680 wrote to memory of 2004	4680	cmd.exe	sotema_2.exe
PID 4680 wrote to memory of 2004	4680	cmd.exe	sotema_2.exe
PID 4680 wrote to memory of 2004	4680	cmd.exe	sotema_2.exe
PID 4600 wrote to memory of 4024	4600	cmd.exe	sotema_3.exe
PID 4600 wrote to memory of 4024	4600	cmd.exe	sotema_3.exe
PID 4600 wrote to memory of 4024	4600	cmd.exe	sotema_3.exe
PID 5036 wrote to memory of 4148	5036	cmd.exe	sotema_5.exe
PID 5036 wrote to memory of 4148	5036	cmd.exe	sotema_5.exe
PID 5036 wrote to memory of 4148	5036	cmd.exe	sotema_5.exe
PID 4608 wrote to memory of 5112	4608	cmd.exe	sotema_4.exe
PID 4608 wrote to memory of 5112	4608	cmd.exe	sotema_4.exe
PID 4608 wrote to memory of 5112	4608	cmd.exe	sotema_4.exe
PID 4488 wrote to memory of 4152	4488	cmd.exe	sotema_6.exe
PID 4488 wrote to memory of 4152	4488	cmd.exe	sotema_6.exe
PID 4488 wrote to memory of 4152	4488	cmd.exe	sotema_6.exe
PID 4152 wrote to memory of 3144	4152	sotema_6.exe	sotema_6.tmp
PID 4152 wrote to memory of 3144	4152	sotema_6.exe	sotema_6.tmp
PID 4152 wrote to memory of 3144	4152	sotema_6.exe	sotema_6.tmp
PID 5112 wrote to memory of 1440	5112	sotema_4.exe	jfiag3g_gg.exe
PID 5112 wrote to memory of 1440	5112	sotema_4.exe	jfiag3g_gg.exe
PID 5112 wrote to memory of 1440	5112	sotema_4.exe	jfiag3g_gg.exe
PID 4572 wrote to memory of 2416	4572	sotema_1.exe	rUNdlL32.eXe
PID 4572 wrote to memory of 2416	4572	sotema_1.exe	rUNdlL32.eXe
PID 4572 wrote to memory of 2416	4572	sotema_1.exe	rUNdlL32.eXe
PID 5112 wrote to memory of 3208	5112	sotema_4.exe	jfiag3g_gg.exe
PID 5112 wrote to memory of 3208	5112	sotema_4.exe	jfiag3g_gg.exe
PID 5112 wrote to memory of 3208	5112	sotema_4.exe	jfiag3g_gg.exe
PID 4148 wrote to memory of 4084	4148	sotema_5.exe	IS78n_CWfc_wtXJOmUGZsL4f.exe
PID 4148 wrote to memory of 4084	4148	sotema_5.exe	IS78n_CWfc_wtXJOmUGZsL4f.exe
PID 4148 wrote to memory of 4084	4148	sotema_5.exe	IS78n_CWfc_wtXJOmUGZsL4f.exe
PID 4148 wrote to memory of 2848	4148	sotema_5.exe	HyETNjrh5ivUqWlqzqoRNxBn.exe
PID 4148 wrote to memory of 2848	4148	sotema_5.exe	HyETNjrh5ivUqWlqzqoRNxBn.exe
PID 4148 wrote to memory of 2848	4148	sotema_5.exe	HyETNjrh5ivUqWlqzqoRNxBn.exe
PID 4148 wrote to memory of 2832	4148	sotema_5.exe	WerFault.exe
PID 4148 wrote to memory of 2832	4148	sotema_5.exe	WerFault.exe
PID 4148 wrote to memory of 2832	4148	sotema_5.exe	WerFault.exe
PID 4148 wrote to memory of 3480	4148	sotema_5.exe	hF7AEpWLrQU0kZ6ODlO7TM4r.exe

C:\Users\Admin\AppData\Local\Temp\6116bdbb3fe14fc7332761384a4d04b92b67eacd9a73245008b3b693204f6dcf.exe
"C:\Users\Admin\AppData\Local\Temp\6116bdbb3fe14fc7332761384a4d04b92b67eacd9a73245008b3b693204f6dcf.exe"
1⤵
- DcRat
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2392

C:\Users\Admin\AppData\Local\Temp\7zS8590037D\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8590037D\setup_install.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sotema_1.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4940

C:\Users\Admin\AppData\Local\Temp\7zS8590037D\sotema_1.exe
sotema_1.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\SysWOW64\rUNdlL32.eXe
"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
5⤵
- Loads dropped DLL
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 612
6⤵
- Program crash
PID:2844

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sotema_2.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4680

C:\Users\Admin\AppData\Local\Temp\7zS8590037D\sotema_2.exe
sotema_2.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2004

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sotema_3.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4600

C:\Users\Admin\AppData\Local\Temp\7zS8590037D\sotema_3.exe
sotema_3.exe
4⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 1032
5⤵
- Program crash
PID:4820

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sotema_6.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4488

C:\Users\Admin\AppData\Local\Temp\7zS8590037D\sotema_6.exe
sotema_6.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152

C:\Users\Admin\AppData\Local\Temp\is-9KPM4.tmp\sotema_6.tmp
"C:\Users\Admin\AppData\Local\Temp\is-9KPM4.tmp\sotema_6.tmp" /SL5="$70046,506127,422400,C:\Users\Admin\AppData\Local\Temp\7zS8590037D\sotema_6.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3144

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sotema_5.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:5036

C:\Users\Admin\AppData\Local\Temp\7zS8590037D\sotema_5.exe
sotema_5.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4148

C:\Users\Admin\Documents\IS78n_CWfc_wtXJOmUGZsL4f.exe
"C:\Users\Admin\Documents\IS78n_CWfc_wtXJOmUGZsL4f.exe"
5⤵
- Executes dropped EXE
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 444
6⤵
- Program crash
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 436
6⤵
- Program crash
PID:228

C:\Users\Admin\Documents\HyETNjrh5ivUqWlqzqoRNxBn.exe
"C:\Users\Admin\Documents\HyETNjrh5ivUqWlqzqoRNxBn.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:2848

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Netdhcpsvc\77FTyD6gK21dfSGhRqsixY3e.vbe"
6⤵
- Checks computer location settings
PID:3060

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Netdhcpsvc\jGDslx6begqObyzNRSfaWpJOf.bat" "
7⤵
PID:980

C:\Netdhcpsvc\NetdhcpsvcDriverintocrt.exe
"C:\Netdhcpsvc\NetdhcpsvcDriverintocrt.exe"
8⤵
- DcRat
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:4400

C:\Windows\System32\wbem\WsmAgentUninstall\WmiPrvSE.exe
"C:\Windows\System32\wbem\WsmAgentUninstall\WmiPrvSE.exe"
9⤵
- Executes dropped EXE
PID:900

C:\Users\Admin\Documents\FBKYcin59tyjMPHSUv7BH_aX.exe
"C:\Users\Admin\Documents\FBKYcin59tyjMPHSUv7BH_aX.exe"
5⤵
PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 432
6⤵
- Program crash
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 440
6⤵
- Program crash
PID:4456

C:\Users\Admin\Documents\BS4Px4hwEeXp4WGCb5v1RGfL.exe
"C:\Users\Admin\Documents\BS4Px4hwEeXp4WGCb5v1RGfL.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:4848

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Affaticato.gif
6⤵
PID:260

C:\Windows\SysWOW64\cmd.exe
cmd
7⤵
PID:3140

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq BullGuardCore.exe"
8⤵
- Enumerates processes with tasklist
PID:1152

C:\Windows\SysWOW64\find.exe
find /I /N "bullguardcore.exe"
8⤵
PID:220

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq PSUAService.exe"
8⤵
- Enumerates processes with tasklist
PID:3176

C:\Windows\SysWOW64\find.exe
find /I /N "psuaservice.exe"
8⤵
PID:1992

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^uEDzPzHFCdzewXWMRhXuwzGNjMXXrsYuMnTuDfFnaaWMxrxJAnNdPOrNYPircJBlshdCrQoBHnNIvTzoshbFDH$" Koubbeh.gif
8⤵
PID:2832

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.pif
Accostarmi.exe.pif N
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1484

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.pif
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.pif
9⤵
- Executes dropped EXE
PID:3676

C:\Users\Admin\Documents\ECr7A5yOwDRVKOweHEdBxfYk.exe
"C:\Users\Admin\Documents\ECr7A5yOwDRVKOweHEdBxfYk.exe"
5⤵
- Executes dropped EXE
PID:4056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\Documents\ECr7A5yOwDRVKOweHEdBxfYk.exe
6⤵
PID:3588

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
7⤵
PID:3064

C:\Users\Admin\Documents\Uhn7Q0rtlXMplTY_9N4Qj8GN.exe
"C:\Users\Admin\Documents\Uhn7Q0rtlXMplTY_9N4Qj8GN.exe"
5⤵
- Executes dropped EXE
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 444
6⤵
- Program crash
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 452
6⤵
- Program crash
PID:3380

C:\Users\Admin\Documents\TSuZGIH_9jNJZvrey3H_zf1B.exe
"C:\Users\Admin\Documents\TSuZGIH_9jNJZvrey3H_zf1B.exe"
5⤵
- Executes dropped EXE
PID:4520

C:\Users\Admin\Documents\2sLIAsXQmTkdasCg6OpALBG8.exe
"C:\Users\Admin\Documents\2sLIAsXQmTkdasCg6OpALBG8.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:4596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
6⤵
PID:3808

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
6⤵
PID:388

C:\Users\Admin\Documents\nOdRp7hhnlCdYlTmhT5Wu57U.exe
"C:\Users\Admin\Documents\nOdRp7hhnlCdYlTmhT5Wu57U.exe"
5⤵
- Executes dropped EXE
PID:1432

C:\Users\Admin\Documents\ETsS_9u7zABGMw8r3BpiaNO6.exe
"C:\Users\Admin\Documents\ETsS_9u7zABGMw8r3BpiaNO6.exe"
5⤵
- Executes dropped EXE
PID:2560

C:\Users\Admin\Documents\v0B4OhkWWppszDzLHWyssVrY.exe
"C:\Users\Admin\Documents\v0B4OhkWWppszDzLHWyssVrY.exe"
5⤵
- Executes dropped EXE
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 452
6⤵
- Program crash
PID:2368

C:\Users\Admin\Documents\OZVrGg6pS6ezue5OKjDkQAaE.exe
"C:\Users\Admin\Documents\OZVrGg6pS6ezue5OKjDkQAaE.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:4528

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im OZVrGg6pS6ezue5OKjDkQAaE.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\OZVrGg6pS6ezue5OKjDkQAaE.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:388

C:\Windows\SysWOW64\taskkill.exe
taskkill /im OZVrGg6pS6ezue5OKjDkQAaE.exe /f
7⤵
- Kills process with taskkill
PID:3728

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Delays execution with timeout.exe
PID:2276

C:\Users\Admin\Documents\3s_N6g5YX3LxzEeGFf8MBfDk.exe
"C:\Users\Admin\Documents\3s_N6g5YX3LxzEeGFf8MBfDk.exe"
5⤵
- Executes dropped EXE
PID:4340

C:\Users\Admin\Documents\damse0JB1oV1OzxpQud9fSIT.exe
"C:\Users\Admin\Documents\damse0JB1oV1OzxpQud9fSIT.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
6⤵
PID:4012

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
7⤵
- Kills process with taskkill
PID:2604

C:\Users\Admin\Documents\hF7AEpWLrQU0kZ6ODlO7TM4r.exe
"C:\Users\Admin\Documents\hF7AEpWLrQU0kZ6ODlO7TM4r.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 636
6⤵
- Program crash
PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 660
6⤵
- Program crash
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 1288
6⤵
- Program crash
PID:256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 1336
6⤵
- Program crash
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 1352
6⤵
- Program crash
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 1360
6⤵
- Program crash
PID:3204

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "hF7AEpWLrQU0kZ6ODlO7TM4r.exe" /f & erase "C:\Users\Admin\Documents\hF7AEpWLrQU0kZ6ODlO7TM4r.exe" & exit
6⤵
PID:380

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "hF7AEpWLrQU0kZ6ODlO7TM4r.exe" /f
7⤵
- Kills process with taskkill
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 1448
6⤵
- Program crash
PID:3092

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sotema_7.exe
3⤵
PID:4528

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sotema_4.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4608

C:\Users\Admin\AppData\Local\Temp\7zS8590037D\sotema_4.exe
sotema_4.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
PID:1440

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2416 -ip 2416
1⤵
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4024 -ip 4024
1⤵
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4084 -ip 4084
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2832 -ip 2832
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3480 -ip 3480
1⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 624
1⤵
- Program crash
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2560 -ip 2560
1⤵
PID:684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4736 -ip 4736
1⤵
PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4340 -ip 4340
1⤵
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4340 -ip 4340
1⤵
PID:796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2560 -ip 2560
1⤵
PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 432
1⤵
- Program crash
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2832 -ip 2832
1⤵
PID:3796

C:\Users\Admin\AppData\Local\Temp\7zS30CD.tmp\Install.exe
.\Install.exe
1⤵
- Executes dropped EXE
PID:2768

C:\Users\Admin\AppData\Local\Temp\7zS40EA.tmp\Install.exe
.\Install.exe /S /site_id "525403"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in System32 directory
- Enumerates system info in registry
PID:4392

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
3⤵
PID:2696

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
4⤵
PID:2216

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
5⤵
PID:5020

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
5⤵
PID:4600

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
3⤵
PID:3560

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
4⤵
PID:4156

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
5⤵
PID:3020

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
5⤵
PID:3680

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gDWfIWoFM" /SC once /ST 00:59:07 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- DcRat
- Creates scheduled task(s)
PID:956

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gDWfIWoFM"
3⤵
PID:1660

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gDWfIWoFM"
3⤵
PID:1268

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "booXbIzkEgfNdKvxAC" /SC once /ST 01:08:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\tkqLPFW.exe\" j6 /site_id 525403 /S" /V1 /F
3⤵
- DcRat
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4084 -ip 4084
1⤵
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3480 -ip 3480
1⤵
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3764 -ip 3764
1⤵
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3480 -ip 3480
1⤵
PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4736 -ip 4736
1⤵
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3764 -ip 3764
1⤵
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3480 -ip 3480
1⤵
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3480 -ip 3480
1⤵
PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3480 -ip 3480
1⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3480 -ip 3480
1⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3480 -ip 3480
1⤵
- Executes dropped EXE
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BS4Px4hwEeXp4WGCb5v1RGfL" /sc ONLOGON /tr "'C:\Netdhcpsvc\BS4Px4hwEeXp4WGCb5v1RGfL.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\WsmAgentUninstall\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Install" /sc ONLOGON /tr "'C:\Netdhcpsvc\Install.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\SimCfg\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WerFault" /sc ONLOGON /tr "'C:\odt\WerFault.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Netdhcpsvc\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3480 -ip 3480
1⤵
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\kbdgeome\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\CoreMessaging\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:60

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:796

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3652

C:\Users\Admin\AppData\Roaming\evjhbve
C:\Users\Admin\AppData\Roaming\evjhbve
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery