colibri | 9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997

System Information Discovery

Processes:

9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exeuujevjb

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	uujevjb

Loads dropped DLL 18 IoCs

Processes:

7C0.exe1C16.exe

pid	process
4116	7C0.exe
4116	7C0.exe
4116	7C0.exe
4116	7C0.exe
4116	7C0.exe
4116	7C0.exe
4116	7C0.exe
4116	7C0.exe
4116	7C0.exe
4116	7C0.exe
4116	7C0.exe
4116	7C0.exe
4116	7C0.exe
4116	7C0.exe
4116	7C0.exe
4560	1C16.exe
4560	1C16.exe
4560	1C16.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

signed.exedllhost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	signed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Service = "C:\\ProgramData\\MsDrvSrvc.exe"	signed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

52 checkip.amazonaws.com

flow	ioc
52	checkip.amazonaws.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

1A9E.exe1713.exe

description	pid	process	target process
PID 3500 set thread context of 65444	3500	1A9E.exe	1A9E.exe
PID 3732 set thread context of 193096	3732	1713.exe	AppLaunch.exe

Detects Pyinstaller 3 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7C0.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\7C0.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\7C0.exe	pyinstaller

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exeuujevjb

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uujevjb
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uujevjb
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uujevjb
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

1C16.exewermgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1C16.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1C16.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
5160	schtasks.exe
2904	schtasks.exe
3420	schtasks.exe
2488	schtasks.exe
2104	schtasks.exe
4404	schtasks.exe
1972	schtasks.exe
2624	schtasks.exe
5144	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

wermgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exe

pid	process
1384	9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exe
1384	9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exe
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3032

pid	process
3032

Suspicious behavior: MapViewOfSection 20 IoCs

Processes:

9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exeuujevjb

pid	process
1384	9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exe
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
4532	uujevjb

Suspicious use of AdjustPrivilegeToken 58 IoCs

Processes:

1F34.exe1A9E.exeAppLaunch.execheat.exepowershell.exepowershell.exedllhost.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeDebugPrivilege	26364	1F34.exe
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeDebugPrivilege	65444	1A9E.exe
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeDebugPrivilege	193096	AppLaunch.exe
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeDebugPrivilege	193400	cheat.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	4376	dllhost.exe
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeDebugPrivilege	89220	powershell.exe
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032
Token: SeShutdownPrivilege	3032
Token: SeCreatePagefilePrivilege	3032

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exeolsmctyclzkxunjx.exe7C0.exe1A9E.exe

description	pid	process	target process
PID 1384 wrote to memory of 1348	1384	9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exe	olsmctyclzkxunjx.exe
PID 1384 wrote to memory of 1348	1384	9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exe	olsmctyclzkxunjx.exe
PID 1384 wrote to memory of 1348	1384	9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exe	olsmctyclzkxunjx.exe
PID 3032 wrote to memory of 740	3032		7C0.exe
PID 3032 wrote to memory of 740	3032		7C0.exe
PID 3032 wrote to memory of 740	3032		7C0.exe
PID 1348 wrote to memory of 2904	1348	olsmctyclzkxunjx.exe	schtasks.exe
PID 1348 wrote to memory of 2904	1348	olsmctyclzkxunjx.exe	schtasks.exe
PID 1348 wrote to memory of 2904	1348	olsmctyclzkxunjx.exe	schtasks.exe
PID 1348 wrote to memory of 2612	1348	olsmctyclzkxunjx.exe	Get-Variable.exe
PID 1348 wrote to memory of 2612	1348	olsmctyclzkxunjx.exe	Get-Variable.exe
PID 1348 wrote to memory of 2612	1348	olsmctyclzkxunjx.exe	Get-Variable.exe
PID 740 wrote to memory of 4116	740	7C0.exe	7C0.exe
PID 740 wrote to memory of 4116	740	7C0.exe	7C0.exe
PID 740 wrote to memory of 4116	740	7C0.exe	7C0.exe
PID 3032 wrote to memory of 3732	3032		1713.exe
PID 3032 wrote to memory of 3732	3032		1713.exe
PID 3032 wrote to memory of 3732	3032		1713.exe
PID 3032 wrote to memory of 3500	3032		1A9E.exe
PID 3032 wrote to memory of 3500	3032		1A9E.exe
PID 3032 wrote to memory of 3500	3032		1A9E.exe
PID 3032 wrote to memory of 4560	3032		1C16.exe
PID 3032 wrote to memory of 4560	3032		1C16.exe
PID 3032 wrote to memory of 4560	3032		1C16.exe
PID 3032 wrote to memory of 26364	3032		1F34.exe
PID 3032 wrote to memory of 26364	3032		1F34.exe
PID 3032 wrote to memory of 26364	3032		1F34.exe
PID 3032 wrote to memory of 47268	3032		2427.exe
PID 3032 wrote to memory of 47268	3032		2427.exe
PID 3032 wrote to memory of 47268	3032		2427.exe
PID 3032 wrote to memory of 52704	3032		explorer.exe
PID 3032 wrote to memory of 52704	3032		explorer.exe
PID 3032 wrote to memory of 52704	3032		explorer.exe
PID 3032 wrote to memory of 52704	3032		explorer.exe
PID 3500 wrote to memory of 65444	3500	1A9E.exe	1A9E.exe
PID 3500 wrote to memory of 65444	3500	1A9E.exe	1A9E.exe
PID 3500 wrote to memory of 65444	3500	1A9E.exe	1A9E.exe
PID 3032 wrote to memory of 71656	3032		explorer.exe
PID 3032 wrote to memory of 71656	3032		explorer.exe
PID 3032 wrote to memory of 71656	3032		explorer.exe
PID 3032 wrote to memory of 85764	3032		explorer.exe
PID 3032 wrote to memory of 85764	3032		explorer.exe
PID 3032 wrote to memory of 85764	3032		explorer.exe
PID 3032 wrote to memory of 85764	3032		explorer.exe
PID 3032 wrote to memory of 100832	3032		explorer.exe
PID 3032 wrote to memory of 100832	3032		explorer.exe
PID 3032 wrote to memory of 100832	3032		explorer.exe
PID 3500 wrote to memory of 65444	3500	1A9E.exe	1A9E.exe
PID 3500 wrote to memory of 65444	3500	1A9E.exe	1A9E.exe
PID 3500 wrote to memory of 65444	3500	1A9E.exe	1A9E.exe
PID 3500 wrote to memory of 65444	3500	1A9E.exe	1A9E.exe
PID 3500 wrote to memory of 65444	3500	1A9E.exe	1A9E.exe
PID 3032 wrote to memory of 111736	3032		explorer.exe
PID 3032 wrote to memory of 111736	3032		explorer.exe
PID 3032 wrote to memory of 111736	3032		explorer.exe
PID 3032 wrote to memory of 111736	3032		explorer.exe
PID 3032 wrote to memory of 116532	3032		explorer.exe
PID 3032 wrote to memory of 116532	3032		explorer.exe
PID 3032 wrote to memory of 116532	3032		explorer.exe
PID 3032 wrote to memory of 116532	3032		explorer.exe
PID 3032 wrote to memory of 122944	3032		explorer.exe
PID 3032 wrote to memory of 122944	3032		explorer.exe
PID 3032 wrote to memory of 122944	3032		explorer.exe
PID 3032 wrote to memory of 122944	3032		explorer.exe

C:\Users\Admin\AppData\Local\Temp\9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exe
"C:\Users\Admin\AppData\Local\Temp\9a9d23f4790dc089e0c0ed2a898c5e3cb4694353d9f6d8e50d39168683747997.exe"
1⤵
- DcRat
- Checks computer location settings
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1384

C:\Users\Admin\AppData\Local\Temp\olsmctyclzkxunjx.exe
"C:\Users\Admin\AppData\Local\Temp\olsmctyclzkxunjx.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\schtasks.exe
/create /tn COMSurrogate /st 00:00 /du 9999:59 /sc once /ri 1 /f /tr "powershell.exe -windowstyle hidden"
3⤵
- DcRat
- Creates scheduled task(s)
PID:2904

C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe"
3⤵
- Executes dropped EXE
PID:2612

C:\Users\Admin\AppData\Local\Temp\signed.exe
"C:\Users\Admin\AppData\Local\Temp\signed.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:193168

C:\ProgramData\MsDrvSrvc.exe
"C:\ProgramData\MsDrvSrvc.exe"
5⤵
- Executes dropped EXE
PID:193276

C:\Users\Admin\AppData\Local\Temp\7C0.exe
C:\Users\Admin\AppData\Local\Temp\7C0.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740

C:\Users\Admin\AppData\Local\Temp\7C0.exe
C:\Users\Admin\AppData\Local\Temp\7C0.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4116

C:\Users\Admin\AppData\Local\Temp\1713.exe
C:\Users\Admin\AppData\Local\Temp\1713.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:193096

C:\Users\Admin\AppData\Local\Temp\cheat.exe
"C:\Users\Admin\AppData\Local\Temp\cheat.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:193400

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
4⤵
PID:2512

C:\Windows\SysWOW64\chcp.com
chcp 1251
5⤵
PID:2932

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
5⤵
PID:4364

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4156

C:\ProgramData\Dllhost\dllhost.exe
"C:\ProgramData\Dllhost\dllhost.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:4524

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- DcRat
- Creates scheduled task(s)
PID:4404

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:1496

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- DcRat
- Creates scheduled task(s)
PID:3420

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:4796

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- DcRat
- Creates scheduled task(s)
PID:1972

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:1648

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- DcRat
- Creates scheduled task(s)
PID:2104

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:3040

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- DcRat
- Creates scheduled task(s)
PID:2624

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:3680

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:4168

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- DcRat
- Creates scheduled task(s)
PID:2488

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:1488

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk69" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:1380

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk69" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- DcRat
- Creates scheduled task(s)
PID:5160

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8154" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:4852

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8154" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- DcRat
- Creates scheduled task(s)
PID:5144

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4980" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:1308

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk10" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:1724

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
5⤵
PID:5224

C:\Users\Admin\AppData\Local\Temp\1A9E.exe
C:\Users\Admin\AppData\Local\Temp\1A9E.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3500

C:\Users\Admin\AppData\Local\Temp\1A9E.exe
C:\Users\Admin\AppData\Local\Temp\1A9E.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:65444

C:\Users\Admin\AppData\Local\Temp\1C16.exe
C:\Users\Admin\AppData\Local\Temp\1C16.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4560

C:\Users\Admin\AppData\Local\Temp\1F34.exe
C:\Users\Admin\AppData\Local\Temp\1F34.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:26364

C:\Users\Admin\AppData\Local\Temp\2427.exe
C:\Users\Admin\AppData\Local\Temp\2427.exe
1⤵
- Executes dropped EXE
PID:47268

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:52704

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:71656

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:85764

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -windowstyle hidden
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:89220

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "0" "89220" "1780" "1732" "1820" "0" "0" "1824" "0" "0" "0" "0" "0"
2⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:5440

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:100832

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:111736

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:116532

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:122944

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:127576

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:132244

C:\Users\Admin\AppData\Roaming\uujevjb
C:\Users\Admin\AppData\Roaming\uujevjb
1⤵
- Executes dropped EXE
- Checks computer location settings
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4532

C:\Users\Admin\AppData\Local\Temp\udusxyqrdyyhcabb.exe
"C:\Users\Admin\AppData\Local\Temp\udusxyqrdyyhcabb.exe"
2⤵
- Executes dropped EXE
PID:5280

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery