zgrat | 855254eaf0ce1c8f022531e0157e64e70e7343c1de9e8ebfc903a9ea5666af4e

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2024, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Size 1.9MB
Sample240116-we54eafhgn
SHA256 855254eaf0ce1c8f022531e0157e64e70e7343c1de9e8ebfc903a9ea5666af4e
MD5 34c8c7dc49cd21795dfd39ffda9cee5f
SHA1 9c153d4a620899459ee0a4c56a6142fba2835d3d
SHA512 749d64e0366dfb6a60d7aa12f348c70dfc550d51ffa1558c321376d077281f9d1952e056dc6ff629c00a7ca19d13b93b3bb2855c26c87ff59ee497514085ec61
SSDEEP 24576:J6fDEs25370/5lJHI2cxaSzXykO0eW66f3XEWpEmEQ/2VmCthZ2yA1QB4QdvZztY:YECrHjxdXZsUWzuUQME46LMEQ7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral2/memory/2972-0-0x00000000005F0000-0x00000000007DC000-memory.dmp	family_zgrat_v1
behavioral2/files/0x000600000002314d-38.dat	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Users\\Public\\dllhost.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\odt\\dllhost.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\odt\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\34C8C7DC49CD21795DFD39FFDA9CEE5F.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3896	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3080	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	3044	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	3044	schtasks.exe	88

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe

Executes dropped EXE 1 IoCs

pid	Process
4396	TextInputHost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\dllhost.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\dllhost.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\34C8C7DC49CD21795DFD39FFDA9CEE5F = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\34C8C7DC49CD21795DFD39FFDA9CEE5F.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\34C8C7DC49CD21795DFD39FFDA9CEE5F = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\34C8C7DC49CD21795DFD39FFDA9CEE5F.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files\\WindowsPowerShell\\TextInputHost.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\odt\\dllhost.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\odt\\dllhost.exe\""	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCA87DD23D9BEC409697C81F9A448B9E.TMP	csc.exe
File created	\??\c:\Windows\System32\lq89_s.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\TextInputHost.exe	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
File created	C:\Program Files\WindowsPowerShell\22eafd247d37c3	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2808	schtasks.exe
2036	schtasks.exe
3404	schtasks.exe
3080	schtasks.exe
536	schtasks.exe
4892	schtasks.exe
4608	schtasks.exe
2628	schtasks.exe
4972	schtasks.exe
1604	schtasks.exe
3256	schtasks.exe
4272	schtasks.exe
4844	schtasks.exe
3896	schtasks.exe
1620	schtasks.exe
1160	schtasks.exe
1960	schtasks.exe
1136	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1200	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
Token: SeDebugPrivilege	4396	TextInputHost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3232	2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe	92
PID 2972 wrote to memory of 3232	2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe	92
PID 3232 wrote to memory of 3904	3232	csc.exe	94
PID 3232 wrote to memory of 3904	3232	csc.exe	94
PID 2972 wrote to memory of 4356	2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe	110
PID 2972 wrote to memory of 4356	2972	34C8C7DC49CD21795DFD39FFDA9CEE5F.exe	110
PID 4356 wrote to memory of 4848	4356	cmd.exe	112
PID 4356 wrote to memory of 4848	4356	cmd.exe	112
PID 4356 wrote to memory of 1200	4356	cmd.exe	113
PID 4356 wrote to memory of 1200	4356	cmd.exe	113
PID 4356 wrote to memory of 4396	4356	cmd.exe	118
PID 4356 wrote to memory of 4396	4356	cmd.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\34C8C7DC49CD21795DFD39FFDA9CEE5F.exe
"C:\Users\Admin\AppData\Local\Temp\34C8C7DC49CD21795DFD39FFDA9CEE5F.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0w2rqykx\0w2rqykx.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE280.tmp" "c:\Windows\System32\CSCA87DD23D9BEC409697C81F9A448B9E.TMP"
    3⤵
    PID:3904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DM5HXZ3czY.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4848
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - Runs ping.exe
    PID:1200
- - C:\Program Files\WindowsPowerShell\TextInputHost.exe
    "C:\Program Files\WindowsPowerShell\TextInputHost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Public\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Public\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34C8C7DC49CD21795DFD39FFDA9CEE5F3" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\34C8C7DC49CD21795DFD39FFDA9CEE5F.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34C8C7DC49CD21795DFD39FFDA9CEE5F" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\34C8C7DC49CD21795DFD39FFDA9CEE5F.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34C8C7DC49CD21795DFD39FFDA9CEE5F3" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\34C8C7DC49CD21795DFD39FFDA9CEE5F.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TextInputHost.exe

Path C:\Program Files\WindowsPowerShell\TextInputHost.exe
Size 1.9MB
SHA256 855254eaf0ce1c8f022531e0157e64e70e7343c1de9e8ebfc903a9ea5666af4e
MD5 34c8c7dc49cd21795dfd39ffda9cee5f
SHA1 9c153d4a620899459ee0a4c56a6142fba2835d3d
SHA512 749d64e0366dfb6a60d7aa12f348c70dfc550d51ffa1558c321376d077281f9d1952e056dc6ff629c00a7ca19d13b93b3bb2855c26c87ff59ee497514085ec61
SSDEEP 24576:J6fDEs25370/5lJHI2cxaSzXykO0eW66f3XEWpEmEQ/2VmCthZ2yA1QB4QdvZztY:YECrHjxdXZsUWzuUQME46LMEQ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

DM5HXZ3czY.bat

Path C:\Users\Admin\AppData\Local\Temp\DM5HXZ3czY.bat
Size 180B
SHA256 e7426d4b90c0afb4b3bf1fd5148c78dee83f4cae3545691d598ac3b0898b2506
MD5 00bfb7fb20bcbae58d6bc156ab85eb62
SHA1 a25fa3ed099aaf0c2575a9dffd5637dd9afeeba7
SHA512 cecaaf977fc3c68aa939cc74f444cd92d78eeee629789d69f419b3aa75af6e5307b24bd30f8c083574b411afcc23b493286b3e1888cf20d781f5f4a528be6f20
MD5 SHA1 SHA512

Submit Download

RESE280.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE280.tmp
Size 1KB
SHA256 b5be38592dfa48641ff3a9de213c76f94bf5b3d304e8412d54b83daea1361ed6
MD5 5c6fd2713962038e3d86b105f7d9bcc4
SHA1 18b5c457174b9e53f4a1dd94908b5fdb13814f4e
SHA512 3c86b38cae9270ac75986c37ca40c60ecfc38b2c2ee5959c7e732164da98922591467bc5eadea49c42c8381aff9c26bb784275c9efc840d11b13038f56dff719
MD5 SHA1 SHA512

Submit Download

0w2rqykx.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\0w2rqykx\0w2rqykx.0.cs
Size 384B
SHA256 021ffbcd5bbc626f2b97a4c31d5f21f97b80b7d8ebf9f76fc797db8d87240556
MD5 a90c592d93c8abe24634c6cbea009849
SHA1 0bc4e2cf722e54ff2d05e71cb1ab23725e83935a
SHA512 47db86326ac7be64e577f22363963ad057f29fe4b22de95dea688a05c445df026385901b93bfe13e7bd339a58b3e7cc896ade407735c8128a051b7021dd13736
MD5 SHA1 SHA512

Submit Download

0w2rqykx.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0w2rqykx\0w2rqykx.cmdline
Size 235B
SHA256 0d22148ef0af3045d8b1cf997d496251dffbfd72cd0a133f169e51fb817e9661
MD5 ed83fb906127ab1acad27a8c4e9fe6de
SHA1 7200884bec86ddb0b4bc33d8af2f475b2a5e2898
SHA512 04f968822152d644c4591a89e85fe6407615ae5e50822f435da76ef8665d41904edd4b8bf0f4cebecd4f0af2ecf0082257db9e34c911aa73ac638dfdf9b1b16d
MD5 SHA1 SHA512

Submit Download

CSCA87DD23D9BEC409697C81F9A448B9E.TMP

Path \??\c:\Windows\System32\CSCA87DD23D9BEC409697C81F9A448B9E.TMP
Size 1KB
SHA256 9827893aecc99317c037eff6bb0008aed34f9d9273f8f77f88d8abcf1bc26bf1
MD5 378dc0d2e10054948ad49f0dac541e3d
SHA1 7116ba3559f7fa116bb63167fc48b70169cdd693
SHA512 f1d5380d7ce188eb56d54663da211627ca7d2ab74ae93cdfe29604a018f611ed5627ef665cb9d5a4bddb82759687c55a94b0512151f1ebb9ac91965e06700f40
MD5 SHA1 SHA512

Submit Download

memory/2972-15-0x000000001C0A0000-0x000000001C0F0000-memory.dmp

Download

memory/2972-58-0x000000001C430000-0x000000001C49B000-memory.dmp

Download

memory/2972-9-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

Download

memory/2972-10-0x00007FFCEFC30000-0x00007FFCEFCEE000-memory.dmp

Download

memory/2972-13-0x00007FFCD22C0000-0x00007FFCD2D81000-memory.dmp

Download

memory/2972-12-0x000000001B310000-0x000000001B32C000-memory.dmp

Download

memory/2972-14-0x00007FFCEFC10000-0x00007FFCEFC11000-memory.dmp

Download

memory/2972-0-0x00000000005F0000-0x00000000007DC000-memory.dmp

Download

memory/2972-18-0x000000001B330000-0x000000001B348000-memory.dmp

Download

memory/2972-16-0x00007FFCEFC00000-0x00007FFCEFC01000-memory.dmp

Download

memory/2972-19-0x00007FFCEFBF0000-0x00007FFCEFBF1000-memory.dmp

Download

memory/2972-21-0x00000000029C0000-0x00000000029CC000-memory.dmp

Download

memory/2972-22-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

Download

memory/2972-23-0x00007FFCEFBE0000-0x00007FFCEFBE1000-memory.dmp

Download

memory/2972-25-0x000000001B2F0000-0x000000001B2FE000-memory.dmp

Download

memory/2972-28-0x000000001B300000-0x000000001B30C000-memory.dmp

Download

memory/2972-26-0x00007FFCEFBD0000-0x00007FFCEFBD1000-memory.dmp

Download

memory/2972-8-0x0000000002860000-0x000000000286E000-memory.dmp

Download

memory/2972-5-0x00007FFCEFC30000-0x00007FFCEFCEE000-memory.dmp

Download

memory/2972-4-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

Download

memory/2972-3-0x0000000002820000-0x0000000002821000-memory.dmp

Download

memory/2972-2-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

Download

memory/2972-1-0x00007FFCD22C0000-0x00007FFCD2D81000-memory.dmp

Download

memory/2972-6-0x00007FFCEFC20000-0x00007FFCEFC21000-memory.dmp

Download

memory/2972-59-0x00007FFCEFC30000-0x00007FFCEFCEE000-memory.dmp

Download

memory/2972-60-0x00007FFCD22C0000-0x00007FFCD2D81000-memory.dmp

Download

memory/4396-78-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp

Download

memory/4396-65-0x000000001B580000-0x000000001B590000-memory.dmp

Download

memory/4396-66-0x0000000001080000-0x0000000001081000-memory.dmp

Download

memory/4396-67-0x000000001B580000-0x000000001B590000-memory.dmp

Download

memory/4396-68-0x00007FFCEFC30000-0x00007FFCEFCEE000-memory.dmp

Download

memory/4396-69-0x00007FFCEFC20000-0x00007FFCEFC21000-memory.dmp

Download

memory/4396-71-0x000000001B580000-0x000000001B590000-memory.dmp

Download

memory/4396-72-0x00007FFCEFC30000-0x00007FFCEFCEE000-memory.dmp

Download

memory/4396-76-0x00007FFCEFC00000-0x00007FFCEFC01000-memory.dmp

Download

memory/4396-73-0x00007FFCEFC10000-0x00007FFCEFC11000-memory.dmp

Download

memory/4396-79-0x00007FFCEFBF0000-0x00007FFCEFBF1000-memory.dmp

Download

memory/4396-80-0x00007FFCEFBE0000-0x00007FFCEFBE1000-memory.dmp

Download

memory/4396-64-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp

Download

memory/4396-82-0x00007FFCEFBD0000-0x00007FFCEFBD1000-memory.dmp

Download

memory/4396-84-0x000000001B580000-0x000000001B590000-memory.dmp

Download

memory/4396-85-0x000000001C670000-0x000000001C6DB000-memory.dmp

Download

memory/4396-86-0x000000001B580000-0x000000001B590000-memory.dmp

Download

memory/4396-87-0x000000001C670000-0x000000001C6DB000-memory.dmp

Download

memory/4396-90-0x000000001B580000-0x000000001B590000-memory.dmp

Download

memory/4396-119-0x000000001B580000-0x000000001B590000-memory.dmp

Download