djvu | deaf22c4cadd171ef59fc8e6299d26bd4679b965d24097a48e1cf8f283a0eb89

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

arnatic_5.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	arnatic_5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	arnatic_5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	arnatic_5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	arnatic_5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	arnatic_5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	arnatic_5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	arnatic_5.exe

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rUNdlL32.eXe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 684 4100 rUNdlL32.eXe
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	4100	rUNdlL32.eXe

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3804-270-0x0000000000D60000-0x0000000000F65000-memory.dmp	family_redline
behavioral2/memory/3804-266-0x0000000000D60000-0x0000000000F65000-memory.dmp	family_redline
behavioral2/memory/3804-257-0x0000000000D60000-0x0000000000F65000-memory.dmp	family_redline
behavioral2/memory/3804-275-0x0000000000D60000-0x0000000000F65000-memory.dmp	family_redline

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
suricata
suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
suricata
suricata: ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
suricata: ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
suricata
suricata: ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
suricata: ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
suricata
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata
suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
suricata

Vidar Stealer 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/404-218-0x0000000000400000-0x0000000000A04000-memory.dmp	family_vidar
behavioral2/memory/404-215-0x0000000002640000-0x00000000026DD000-memory.dmp	family_vidar
behavioral2/memory/404-220-0x0000000000400000-0x0000000000A04000-memory.dmp	family_vidar

ASPack v2.12-2.42 9 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\setup_install.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\setup_install.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\libstdc++-6.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\libstdc++-6.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\libcurlpp.dll	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 26 IoCs

Processes:

setup_install.exearnatic_1.exearnatic_2.exearnatic_3.exearnatic_6.exearnatic_5.exearnatic_4.exearnatic_7.exearnatic_1.exeb82yEr8zylq7RV_WnFj_VcTq.exeHALUoIeDNts4LX9f5Ub74gTf.exewj4jG9HQDl1Ocr3q6Z3EpWRW.exeIQbL_jLdISTvES_HOQPQQI45.exeN_4ZflR420myTmTHGPQevgII.exeOK855sd_3rIEV6lTMK8VaEJN.exeM0CNprWmUN7LuGhmB1vWVOei.exee9f1rh2IhRILt5JHk6zUGfHj.exe0OBCIZWT9JSfIwq85QGNq48C.exei9wpULz8LCAxs8Qdt01jsmcD.exegG9DsIgOIVBgFiXl_KEr1W7m.exefYra6bp1pJaWpTYDperfZ_Wq.exeOK855sd_3rIEV6lTMK8VaEJN.exeOK855sd_3rIEV6lTMK8VaEJN.exeOK855sd_3rIEV6lTMK8VaEJN.exebuild2.exebuild2.exe

pid	process
4412	setup_install.exe
4952	arnatic_1.exe
392	arnatic_2.exe
404	arnatic_3.exe
3200	arnatic_6.exe
1376	arnatic_5.exe
5004	arnatic_4.exe
2500	arnatic_7.exe
3284	arnatic_1.exe
4720	b82yEr8zylq7RV_WnFj_VcTq.exe
4724	HALUoIeDNts4LX9f5Ub74gTf.exe
3000	wj4jG9HQDl1Ocr3q6Z3EpWRW.exe
3652	IQbL_jLdISTvES_HOQPQQI45.exe
3336	N_4ZflR420myTmTHGPQevgII.exe
2744	OK855sd_3rIEV6lTMK8VaEJN.exe
4820	M0CNprWmUN7LuGhmB1vWVOei.exe
1816	e9f1rh2IhRILt5JHk6zUGfHj.exe
4328	0OBCIZWT9JSfIwq85QGNq48C.exe
3804	i9wpULz8LCAxs8Qdt01jsmcD.exe
2852	gG9DsIgOIVBgFiXl_KEr1W7m.exe
3928	fYra6bp1pJaWpTYDperfZ_Wq.exe
8624	OK855sd_3rIEV6lTMK8VaEJN.exe
10804	OK855sd_3rIEV6lTMK8VaEJN.exe
14736	OK855sd_3rIEV6lTMK8VaEJN.exe
23340	build2.exe
29720	build2.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2852-267-0x00000000005E0000-0x00000000013A9000-memory.dmp	upx
behavioral2/memory/1816-260-0x0000000000E50000-0x0000000001C18000-memory.dmp	upx
C:\Users\Admin\Documents\e9f1rh2IhRILt5JHk6zUGfHj.exe	upx
C:\Users\Admin\Documents\e9f1rh2IhRILt5JHk6zUGfHj.exe	upx
C:\Users\Admin\Documents\gG9DsIgOIVBgFiXl_KEr1W7m.exe	upx
C:\Users\Admin\Documents\gG9DsIgOIVBgFiXl_KEr1W7m.exe	upx

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

0OBCIZWT9JSfIwq85QGNq48C.exeDEAF22C4CADD171EF59FC8E6299D26BD4679B965D2409.exearnatic_1.exearnatic_5.exefYra6bp1pJaWpTYDperfZ_Wq.exeOK855sd_3rIEV6lTMK8VaEJN.exeN_4ZflR420myTmTHGPQevgII.exeOK855sd_3rIEV6lTMK8VaEJN.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	0OBCIZWT9JSfIwq85QGNq48C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	DEAF22C4CADD171EF59FC8E6299D26BD4679B965D2409.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	arnatic_1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	arnatic_5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	fYra6bp1pJaWpTYDperfZ_Wq.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	OK855sd_3rIEV6lTMK8VaEJN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	N_4ZflR420myTmTHGPQevgII.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	OK855sd_3rIEV6lTMK8VaEJN.exe

Loads dropped DLL 13 IoCs

Processes:

setup_install.exearnatic_2.exerundll32.exe0OBCIZWT9JSfIwq85QGNq48C.exebuild2.exe

pid	process
4412	setup_install.exe
4412	setup_install.exe
4412	setup_install.exe
4412	setup_install.exe
4412	setup_install.exe
4412	setup_install.exe
4412	setup_install.exe
392	arnatic_2.exe
4068	rundll32.exe
4328	0OBCIZWT9JSfIwq85QGNq48C.exe
4328	0OBCIZWT9JSfIwq85QGNq48C.exe
29720	build2.exe
29720	build2.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

10256 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
10256	icacls.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

M0CNprWmUN7LuGhmB1vWVOei.exeOK855sd_3rIEV6lTMK8VaEJN.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	M0CNprWmUN7LuGhmB1vWVOei.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\48d69786-7a2d-4be6-a338-9981538ea4ae\\OK855sd_3rIEV6lTMK8VaEJN.exe\" --AutoStart"	OK855sd_3rIEV6lTMK8VaEJN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	M0CNprWmUN7LuGhmB1vWVOei.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

145 api.2ip.ua
147 api.2ip.ua
163 api.2ip.ua
12 ipinfo.io
14 ipinfo.io

flow	ioc
145	api.2ip.ua
147	api.2ip.ua
163	api.2ip.ua
12	ipinfo.io
14	ipinfo.io

Suspicious use of SetThreadContext 4 IoCs

Processes:

OK855sd_3rIEV6lTMK8VaEJN.exeOK855sd_3rIEV6lTMK8VaEJN.exebuild2.exeHALUoIeDNts4LX9f5Ub74gTf.exe

description	pid	process	target process
PID 2744 set thread context of 8624	2744	OK855sd_3rIEV6lTMK8VaEJN.exe	OK855sd_3rIEV6lTMK8VaEJN.exe
PID 10804 set thread context of 14736	10804	OK855sd_3rIEV6lTMK8VaEJN.exe	OK855sd_3rIEV6lTMK8VaEJN.exe
PID 23340 set thread context of 29720	23340	build2.exe	build2.exe
PID 4724 set thread context of 40228	4724	HALUoIeDNts4LX9f5Ub74gTf.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 16 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2436	2500	WerFault.exe	arnatic_7.exe
4328	4068	WerFault.exe	rundll32.exe
1132	404	WerFault.exe	arnatic_3.exe
8748	3336	WerFault.exe	N_4ZflR420myTmTHGPQevgII.exe
11120	3336	WerFault.exe	N_4ZflR420myTmTHGPQevgII.exe
12668	3336	WerFault.exe	N_4ZflR420myTmTHGPQevgII.exe
14360	3336	WerFault.exe	N_4ZflR420myTmTHGPQevgII.exe
16228	3336	WerFault.exe	N_4ZflR420myTmTHGPQevgII.exe
17144	3336	WerFault.exe	N_4ZflR420myTmTHGPQevgII.exe
18116	3336	WerFault.exe	N_4ZflR420myTmTHGPQevgII.exe
21840	3336	WerFault.exe	N_4ZflR420myTmTHGPQevgII.exe
23256	3336	WerFault.exe	N_4ZflR420myTmTHGPQevgII.exe
24252	4720	WerFault.exe	b82yEr8zylq7RV_WnFj_VcTq.exe
24368	3652	WerFault.exe	IQbL_jLdISTvES_HOQPQQI45.exe
25544	4328	WerFault.exe	0OBCIZWT9JSfIwq85QGNq48C.exe
40344	4724	WerFault.exe	HALUoIeDNts4LX9f5Ub74gTf.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

arnatic_2.exewj4jG9HQDl1Ocr3q6Z3EpWRW.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wj4jG9HQDl1Ocr3q6Z3EpWRW.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wj4jG9HQDl1Ocr3q6Z3EpWRW.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wj4jG9HQDl1Ocr3q6Z3EpWRW.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

0OBCIZWT9JSfIwq85QGNq48C.exebuild2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0OBCIZWT9JSfIwq85QGNq48C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	0OBCIZWT9JSfIwq85QGNq48C.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

29608 timeout.exe
40372 timeout.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

40392 tasklist.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

23364 taskkill.exe
27384 taskkill.exe

pid	process
29608	timeout.exe
40372	timeout.exe

pid	process
40392	tasklist.exe

pid	process
23364	taskkill.exe
27384	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

arnatic_3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	arnatic_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	arnatic_3.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

40488 PING.EXE

pid	process
40488	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

arnatic_2.exe

pid	process
392	arnatic_2.exe
392	arnatic_2.exe
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292
3292

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3292
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

arnatic_2.exewj4jG9HQDl1Ocr3q6Z3EpWRW.exe

pid process

392 arnatic_2.exe
3000 wj4jG9HQDl1Ocr3q6Z3EpWRW.exe

pid	process
3292

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

arnatic_4.exearnatic_6.exei9wpULz8LCAxs8Qdt01jsmcD.exeIQbL_jLdISTvES_HOQPQQI45.exeb82yEr8zylq7RV_WnFj_VcTq.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	5004	arnatic_4.exe
Token: SeDebugPrivilege	3200	arnatic_6.exe
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeDebugPrivilege	3804	i9wpULz8LCAxs8Qdt01jsmcD.exe
Token: SeDebugPrivilege	3652	IQbL_jLdISTvES_HOQPQQI45.exe
Token: SeDebugPrivilege	4720	b82yEr8zylq7RV_WnFj_VcTq.exe
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeDebugPrivilege	23364	taskkill.exe
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292
Token: SeShutdownPrivilege	3292
Token: SeCreatePagefilePrivilege	3292

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

DEAF22C4CADD171EF59FC8E6299D26BD4679B965D2409.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exearnatic_1.exerUNdlL32.eXearnatic_5.exe

description	pid	process	target process
PID 5060 wrote to memory of 4412	5060	DEAF22C4CADD171EF59FC8E6299D26BD4679B965D2409.exe	setup_install.exe
PID 5060 wrote to memory of 4412	5060	DEAF22C4CADD171EF59FC8E6299D26BD4679B965D2409.exe	setup_install.exe
PID 5060 wrote to memory of 4412	5060	DEAF22C4CADD171EF59FC8E6299D26BD4679B965D2409.exe	setup_install.exe
PID 4412 wrote to memory of 1944	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 1944	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 1944	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 2024	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 2024	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 2024	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 5108	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 5108	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 5108	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 2624	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 2624	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 2624	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 3168	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 3168	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 3168	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 2860	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 2860	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 2860	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 2684	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 2684	4412	setup_install.exe	cmd.exe
PID 4412 wrote to memory of 2684	4412	setup_install.exe	cmd.exe
PID 1944 wrote to memory of 4952	1944	cmd.exe	arnatic_1.exe
PID 1944 wrote to memory of 4952	1944	cmd.exe	arnatic_1.exe
PID 1944 wrote to memory of 4952	1944	cmd.exe	arnatic_1.exe
PID 2024 wrote to memory of 392	2024	cmd.exe	arnatic_2.exe
PID 2024 wrote to memory of 392	2024	cmd.exe	arnatic_2.exe
PID 2024 wrote to memory of 392	2024	cmd.exe	arnatic_2.exe
PID 5108 wrote to memory of 404	5108	cmd.exe	arnatic_3.exe
PID 5108 wrote to memory of 404	5108	cmd.exe	arnatic_3.exe
PID 5108 wrote to memory of 404	5108	cmd.exe	arnatic_3.exe
PID 2860 wrote to memory of 3200	2860	cmd.exe	arnatic_6.exe
PID 3168 wrote to memory of 1376	3168	cmd.exe	arnatic_5.exe
PID 2860 wrote to memory of 3200	2860	cmd.exe	arnatic_6.exe
PID 3168 wrote to memory of 1376	3168	cmd.exe	arnatic_5.exe
PID 3168 wrote to memory of 1376	3168	cmd.exe	arnatic_5.exe
PID 2624 wrote to memory of 5004	2624	cmd.exe	arnatic_4.exe
PID 2624 wrote to memory of 5004	2624	cmd.exe	arnatic_4.exe
PID 2684 wrote to memory of 2500	2684	cmd.exe	arnatic_7.exe
PID 2684 wrote to memory of 2500	2684	cmd.exe	arnatic_7.exe
PID 4952 wrote to memory of 3284	4952	arnatic_1.exe	arnatic_1.exe
PID 4952 wrote to memory of 3284	4952	arnatic_1.exe	arnatic_1.exe
PID 4952 wrote to memory of 3284	4952	arnatic_1.exe	arnatic_1.exe
PID 684 wrote to memory of 4068	684	rUNdlL32.eXe	rundll32.exe
PID 684 wrote to memory of 4068	684	rUNdlL32.eXe	rundll32.exe
PID 684 wrote to memory of 4068	684	rUNdlL32.eXe	rundll32.exe
PID 1376 wrote to memory of 4724	1376	arnatic_5.exe	HALUoIeDNts4LX9f5Ub74gTf.exe
PID 1376 wrote to memory of 4724	1376	arnatic_5.exe	HALUoIeDNts4LX9f5Ub74gTf.exe
PID 1376 wrote to memory of 4724	1376	arnatic_5.exe	HALUoIeDNts4LX9f5Ub74gTf.exe
PID 1376 wrote to memory of 4720	1376	arnatic_5.exe	b82yEr8zylq7RV_WnFj_VcTq.exe
PID 1376 wrote to memory of 4720	1376	arnatic_5.exe	b82yEr8zylq7RV_WnFj_VcTq.exe
PID 1376 wrote to memory of 4720	1376	arnatic_5.exe	b82yEr8zylq7RV_WnFj_VcTq.exe
PID 1376 wrote to memory of 3000	1376	arnatic_5.exe	wj4jG9HQDl1Ocr3q6Z3EpWRW.exe
PID 1376 wrote to memory of 3000	1376	arnatic_5.exe	wj4jG9HQDl1Ocr3q6Z3EpWRW.exe
PID 1376 wrote to memory of 3000	1376	arnatic_5.exe	wj4jG9HQDl1Ocr3q6Z3EpWRW.exe
PID 1376 wrote to memory of 3652	1376	arnatic_5.exe	IQbL_jLdISTvES_HOQPQQI45.exe
PID 1376 wrote to memory of 3652	1376	arnatic_5.exe	IQbL_jLdISTvES_HOQPQQI45.exe
PID 1376 wrote to memory of 3652	1376	arnatic_5.exe	IQbL_jLdISTvES_HOQPQQI45.exe
PID 1376 wrote to memory of 3336	1376	arnatic_5.exe	N_4ZflR420myTmTHGPQevgII.exe
PID 1376 wrote to memory of 3336	1376	arnatic_5.exe	N_4ZflR420myTmTHGPQevgII.exe
PID 1376 wrote to memory of 3336	1376	arnatic_5.exe	N_4ZflR420myTmTHGPQevgII.exe
PID 1376 wrote to memory of 2744	1376	arnatic_5.exe	OK855sd_3rIEV6lTMK8VaEJN.exe

C:\Users\Admin\AppData\Local\Temp\DEAF22C4CADD171EF59FC8E6299D26BD4679B965D2409.exe
"C:\Users\Admin\AppData\Local\Temp\DEAF22C4CADD171EF59FC8E6299D26BD4679B965D2409.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5060

C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\setup_install.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4412

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_1.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\arnatic_1.exe
arnatic_1.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4952

C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\arnatic_1.exe
"C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\arnatic_1.exe" -a
5⤵
- Executes dropped EXE
PID:3284

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_6.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2860

C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\arnatic_6.exe
arnatic_6.exe
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_7.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\arnatic_7.exe
arnatic_7.exe
4⤵
- Executes dropped EXE
PID:2500

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2500 -s 1132
5⤵
- Program crash
PID:2436

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_5.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3168

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_4.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2624

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_3.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:5108

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_2.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\arnatic_2.exe
arnatic_2.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:392

C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\arnatic_4.exe
arnatic_4.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\arnatic_5.exe
arnatic_5.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1376

C:\Users\Admin\Documents\HALUoIeDNts4LX9f5Ub74gTf.exe
"C:\Users\Admin\Documents\HALUoIeDNts4LX9f5Ub74gTf.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:40228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 36144
3⤵
- Program crash
PID:40344

C:\Users\Admin\Documents\b82yEr8zylq7RV_WnFj_VcTq.exe
"C:\Users\Admin\Documents\b82yEr8zylq7RV_WnFj_VcTq.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 1832
3⤵
- Program crash
PID:24252

C:\Users\Admin\Documents\wj4jG9HQDl1Ocr3q6Z3EpWRW.exe
"C:\Users\Admin\Documents\wj4jG9HQDl1Ocr3q6Z3EpWRW.exe"
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3000

C:\Users\Admin\Documents\IQbL_jLdISTvES_HOQPQQI45.exe
"C:\Users\Admin\Documents\IQbL_jLdISTvES_HOQPQQI45.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 1852
3⤵
- Program crash
PID:24368

C:\Users\Admin\Documents\M0CNprWmUN7LuGhmB1vWVOei.exe
"C:\Users\Admin\Documents\M0CNprWmUN7LuGhmB1vWVOei.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4820

C:\Windows\SysWOW64\cmd.exe
cmd /c HajsdiEUeyhauefhKJAsnvnbAJKSdjhwiueiuwUHQWIr8
3⤵
PID:3268

C:\Windows\SysWOW64\cmd.exe
cmd /c cmd < Puo.doc
3⤵
PID:9704

C:\Windows\SysWOW64\cmd.exe
cmd
4⤵
PID:11576

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq PSUAService.exe"
5⤵
- Enumerates processes with tasklist
PID:40392

C:\Windows\SysWOW64\find.exe
find /I /N "psuaservice.exe"
5⤵
PID:40424

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^GenDLGIWHnMRujmupBwmZpYQQwklmcAtydrRzguPaJSafGltEekhEEBbrHMJcnvjYIMPoIMUxkuddGBlQiFbpjmAOFNMBbxUhGxHUcVWddSankibuCSgS$" Stoffe.doc
5⤵
PID:40444

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Spinetta.exe.pif
Spinetta.exe.pif z
5⤵
PID:40468

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Spinetta.exe.pif
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Spinetta.exe.pif
6⤵
PID:40636

C:\Windows\SysWOW64\PING.EXE
ping localhost -n 5
5⤵
- Runs ping.exe
PID:40488

C:\Users\Admin\Documents\OK855sd_3rIEV6lTMK8VaEJN.exe
"C:\Users\Admin\Documents\OK855sd_3rIEV6lTMK8VaEJN.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2744

C:\Users\Admin\Documents\OK855sd_3rIEV6lTMK8VaEJN.exe
"C:\Users\Admin\Documents\OK855sd_3rIEV6lTMK8VaEJN.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
PID:8624

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\48d69786-7a2d-4be6-a338-9981538ea4ae" /deny *S-1-1-0:(OI)(CI)(DE,DC)
4⤵
- Modifies file permissions
PID:10256

C:\Users\Admin\Documents\OK855sd_3rIEV6lTMK8VaEJN.exe
"C:\Users\Admin\Documents\OK855sd_3rIEV6lTMK8VaEJN.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:10804

C:\Users\Admin\Documents\OK855sd_3rIEV6lTMK8VaEJN.exe
"C:\Users\Admin\Documents\OK855sd_3rIEV6lTMK8VaEJN.exe" --Admin IsNotAutoStart IsNotTask
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:14736

C:\Users\Admin\AppData\Local\14edfe8d-b6e1-4575-9714-eec9478d4247\build2.exe
"C:\Users\Admin\AppData\Local\14edfe8d-b6e1-4575-9714-eec9478d4247\build2.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:23340

C:\Users\Admin\AppData\Local\14edfe8d-b6e1-4575-9714-eec9478d4247\build2.exe
"C:\Users\Admin\AppData\Local\14edfe8d-b6e1-4575-9714-eec9478d4247\build2.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:29720

C:\Users\Admin\Documents\N_4ZflR420myTmTHGPQevgII.exe
"C:\Users\Admin\Documents\N_4ZflR420myTmTHGPQevgII.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 452
3⤵
- Program crash
PID:8748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 772
3⤵
- Program crash
PID:11120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 808
3⤵
- Program crash
PID:12668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 772
3⤵
- Program crash
PID:14360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 788
3⤵
- Program crash
PID:16228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 984
3⤵
- Program crash
PID:17144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 1016
3⤵
- Program crash
PID:18116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 1320
3⤵
- Program crash
PID:21840

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "N_4ZflR420myTmTHGPQevgII.exe" /f & erase "C:\Users\Admin\Documents\N_4ZflR420myTmTHGPQevgII.exe" & exit
3⤵
PID:22972

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "N_4ZflR420myTmTHGPQevgII.exe" /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:23364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 1380
3⤵
- Program crash
PID:23256

C:\Users\Admin\Documents\0OBCIZWT9JSfIwq85QGNq48C.exe
"C:\Users\Admin\Documents\0OBCIZWT9JSfIwq85QGNq48C.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:4328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 0OBCIZWT9JSfIwq85QGNq48C.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\0OBCIZWT9JSfIwq85QGNq48C.exe" & del C:\ProgramData\*.dll & exit
3⤵
PID:25008

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 0OBCIZWT9JSfIwq85QGNq48C.exe /f
4⤵
- Kills process with taskkill
PID:27384

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:29608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 1968
3⤵
- Program crash
PID:25544

C:\Users\Admin\Documents\fYra6bp1pJaWpTYDperfZ_Wq.exe
"C:\Users\Admin\Documents\fYra6bp1pJaWpTYDperfZ_Wq.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
PID:3928

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
3⤵
PID:6944

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 45
3⤵
PID:40212

C:\Windows\SysWOW64\timeout.exe
timeout 45
4⤵
- Delays execution with timeout.exe
PID:40372

C:\Users\Admin\Documents\gG9DsIgOIVBgFiXl_KEr1W7m.exe
"C:\Users\Admin\Documents\gG9DsIgOIVBgFiXl_KEr1W7m.exe"
2⤵
- Executes dropped EXE
PID:2852

C:\Users\Admin\Documents\i9wpULz8LCAxs8Qdt01jsmcD.exe
"C:\Users\Admin\Documents\i9wpULz8LCAxs8Qdt01jsmcD.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3804

C:\Users\Admin\Documents\e9f1rh2IhRILt5JHk6zUGfHj.exe
"C:\Users\Admin\Documents\e9f1rh2IhRILt5JHk6zUGfHj.exe"
2⤵
- Executes dropped EXE
PID:1816

C:\Users\Admin\AppData\Local\Temp\7zS4C3E77A6\arnatic_3.exe
arnatic_3.exe
1⤵
- Executes dropped EXE
- Modifies system certificate store
PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 1040
2⤵
- Program crash
PID:1132

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 2500 -ip 2500
1⤵
PID:5032

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 604
3⤵
- Program crash
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4068 -ip 4068
1⤵
PID:868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 404 -ip 404
1⤵
PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3336 -ip 3336
1⤵
PID:8528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3336 -ip 3336
1⤵
PID:10752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3336 -ip 3336
1⤵
PID:12348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3336 -ip 3336
1⤵
PID:14252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3336 -ip 3336
1⤵
PID:15788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3336 -ip 3336
1⤵
PID:16988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3336 -ip 3336
1⤵
PID:17848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3336 -ip 3336
1⤵
PID:21744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3336 -ip 3336
1⤵
PID:23020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4720 -ip 4720
1⤵
PID:23948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3652 -ip 3652
1⤵
PID:24136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4328 -ip 4328
1⤵
PID:25252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4724 -ip 4724
1⤵
PID:40300

C:\Users\Admin\AppData\Local\Temp\CEB5.exe
C:\Users\Admin\AppData\Local\Temp\CEB5.exe
1⤵
PID:40672

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

File Permissions Modification

T1222

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery