crealstealer | c56c6f394fe19e834ab6e6c1230f227fee52246d00236951d15f05c278016eed

Analysis

max time kernel
237s
max time network
175s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-01-2024 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DreddedsMT_V2 (1).exe
Size

325KB
MD5

6cb37737df71985fa41dd732e4cebf2c
SHA1

1cba30161e7a6cf9514e1d7e46e7f72dd8da2a57
SHA256

c56c6f394fe19e834ab6e6c1230f227fee52246d00236951d15f05c278016eed
SHA512

36c8bedc2cfcce83bb1e6ec9fbac1da6e7906ec0097e288765663c347eb102202200114cb3883265e7fd32de7ddc498b1a4ad0d5242e0363aebfc02cac22b30e
SSDEEP

3072:exiie1oWClkHsn0JaAB+UTbnLmPvR59RQKiypXg5qm9LxFYbs:erNPuMUaAAWnS35iyFg5qs9

Score

10^/10

crealstealer xworm persistence rat stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

aes.plain

Signatures

An infostealer written in Python and packaged with PyInstaller. 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012261-86.dat	crealstealer

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012252-5.dat	family_xworm
behavioral1/memory/2660-8-0x0000000000F20000-0x0000000000F30000-memory.dmp	family_xworm
behavioral1/memory/2044-80-0x00000000008E0000-0x00000000008F0000-memory.dmp	family_xworm
behavioral1/memory/1576-92-0x0000000000A30000-0x0000000000A40000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
crealstealer
An infostealer written in Python and packaged with PyInstaller.
stealer crealstealer

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\epicgameslauncher.lnk	epicgameslauncher
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\epicgameslauncher.lnk	discord.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\epicgameslauncher.lnk	discord.exe

Executes dropped EXE 3 IoCs

pid	Process
2660	discord.exe
2044	epicgameslauncher
1576	epicgameslauncher

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\epicgameslauncher = "C:\\Users\\Admin\\AppData\\Roaming\\epicgameslauncher"	discord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\epicgameslauncher = "C:\\Users\\Admin\\AppData\\Roaming\\epicgameslauncher"	epicgameslauncher

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com
9	ip-api.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2376	schtasks.exe
1508	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2136	timeout.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = b02f99ef8e54da01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412899452"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2CE1C0D1-C082-11EE-A628-46FAA8558A22} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\open	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\open\CommandId = "IE.File"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1868	powershell.exe
1104	powershell.exe
320	powershell.exe
2004	powershell.exe
2660	discord.exe
2812	powershell.exe
1928	powershell.exe
2936	powershell.exe
2468	powershell.exe
1576	epicgameslauncher

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	rundll32.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	discord.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	320	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	2660	discord.exe
Token: SeDebugPrivilege	2044	epicgameslauncher
Token: SeDebugPrivilege	1576	epicgameslauncher
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	1576	epicgameslauncher

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
856	iexplore.exe
856	iexplore.exe
856	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2660	discord.exe
856	iexplore.exe
856	iexplore.exe
1304	IEXPLORE.EXE
1304	IEXPLORE.EXE
856	iexplore.exe
856	iexplore.exe
1304	IEXPLORE.EXE
1304	IEXPLORE.EXE
1576	epicgameslauncher

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2660	2396	DreddedsMT_V2 (1).exe	28
PID 2396 wrote to memory of 2660	2396	DreddedsMT_V2 (1).exe	28
PID 2396 wrote to memory of 2660	2396	DreddedsMT_V2 (1).exe	28
PID 2396 wrote to memory of 2760	2396	DreddedsMT_V2 (1).exe	29
PID 2396 wrote to memory of 2760	2396	DreddedsMT_V2 (1).exe	29
PID 2396 wrote to memory of 2760	2396	DreddedsMT_V2 (1).exe	29
PID 2396 wrote to memory of 2764	2396	DreddedsMT_V2 (1).exe	30
PID 2396 wrote to memory of 2764	2396	DreddedsMT_V2 (1).exe	30
PID 2396 wrote to memory of 2764	2396	DreddedsMT_V2 (1).exe	30
PID 2764 wrote to memory of 2684	2764	cmd.exe	32
PID 2764 wrote to memory of 2684	2764	cmd.exe	32
PID 2764 wrote to memory of 2684	2764	cmd.exe	32
PID 2660 wrote to memory of 1868	2660	discord.exe	34
PID 2660 wrote to memory of 1868	2660	discord.exe	34
PID 2660 wrote to memory of 1868	2660	discord.exe	34
PID 2660 wrote to memory of 1104	2660	discord.exe	36
PID 2660 wrote to memory of 1104	2660	discord.exe	36
PID 2660 wrote to memory of 1104	2660	discord.exe	36
PID 2660 wrote to memory of 320	2660	discord.exe	39
PID 2660 wrote to memory of 320	2660	discord.exe	39
PID 2660 wrote to memory of 320	2660	discord.exe	39
PID 2660 wrote to memory of 2004	2660	discord.exe	41
PID 2660 wrote to memory of 2004	2660	discord.exe	41
PID 2660 wrote to memory of 2004	2660	discord.exe	41
PID 2660 wrote to memory of 2376	2660	discord.exe	43
PID 2660 wrote to memory of 2376	2660	discord.exe	43
PID 2660 wrote to memory of 2376	2660	discord.exe	43
PID 1524 wrote to memory of 2044	1524	taskeng.exe	45
PID 1524 wrote to memory of 2044	1524	taskeng.exe	45
PID 1524 wrote to memory of 2044	1524	taskeng.exe	45
PID 2760 wrote to memory of 856	2760	rundll32.exe	48
PID 2760 wrote to memory of 856	2760	rundll32.exe	48
PID 2760 wrote to memory of 856	2760	rundll32.exe	48
PID 856 wrote to memory of 1304	856	iexplore.exe	50
PID 856 wrote to memory of 1304	856	iexplore.exe	50
PID 856 wrote to memory of 1304	856	iexplore.exe	50
PID 856 wrote to memory of 1304	856	iexplore.exe	50
PID 856 wrote to memory of 1500	856	iexplore.exe	52
PID 856 wrote to memory of 1500	856	iexplore.exe	52
PID 856 wrote to memory of 1500	856	iexplore.exe	52
PID 1524 wrote to memory of 1576	1524	taskeng.exe	53
PID 1524 wrote to memory of 1576	1524	taskeng.exe	53
PID 1524 wrote to memory of 1576	1524	taskeng.exe	53
PID 1576 wrote to memory of 2812	1576	epicgameslauncher	54
PID 1576 wrote to memory of 2812	1576	epicgameslauncher	54
PID 1576 wrote to memory of 2812	1576	epicgameslauncher	54
PID 1576 wrote to memory of 1928	1576	epicgameslauncher	56
PID 1576 wrote to memory of 1928	1576	epicgameslauncher	56
PID 1576 wrote to memory of 1928	1576	epicgameslauncher	56
PID 1576 wrote to memory of 2936	1576	epicgameslauncher	59
PID 1576 wrote to memory of 2936	1576	epicgameslauncher	59
PID 1576 wrote to memory of 2936	1576	epicgameslauncher	59
PID 1576 wrote to memory of 2468	1576	epicgameslauncher	61
PID 1576 wrote to memory of 2468	1576	epicgameslauncher	61
PID 1576 wrote to memory of 2468	1576	epicgameslauncher	61
PID 1576 wrote to memory of 1508	1576	epicgameslauncher	63
PID 1576 wrote to memory of 1508	1576	epicgameslauncher	63
PID 1576 wrote to memory of 1508	1576	epicgameslauncher	63
PID 1576 wrote to memory of 2884	1576	epicgameslauncher	65
PID 1576 wrote to memory of 2884	1576	epicgameslauncher	65
PID 1576 wrote to memory of 2884	1576	epicgameslauncher	65
PID 1576 wrote to memory of 568	1576	epicgameslauncher	67
PID 1576 wrote to memory of 568	1576	epicgameslauncher	67
PID 1576 wrote to memory of 568	1576	epicgameslauncher	67

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe
"C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Roaming\discord.exe
  "C:\Users\Admin\AppData\Roaming\discord.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\discord.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'discord.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\epicgameslauncher'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'epicgameslauncher'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2004
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "epicgameslauncher" /tr "C:\Users\Admin\AppData\Roaming\epicgameslauncher"
    3⤵
    - Creates scheduled task(s)
    PID:2376
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\microsoft.py
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Roaming\microsoft.py
    3⤵
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1304
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Roaming\microsoft.py
      4⤵
      PID:1500
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\Dredded'sMT.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2684

C:\Windows\system32\taskeng.exe
taskeng.exe {CAFAE778-F379-418D-824E-73C80C72861C} S-1-5-21-1603059206-2004189698-4139800220-1000:AILVMYUM\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Roaming\epicgameslauncher
  C:\Users\Admin\AppData\Roaming\epicgameslauncher
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Users\Admin\AppData\Roaming\epicgameslauncher
  C:\Users\Admin\AppData\Roaming\epicgameslauncher
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\epicgameslauncher'
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'epicgameslauncher'
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\epicgameslauncher'
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'epicgameslauncher'
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2468
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "epicgameslauncher" /tr "C:\Users\Admin\AppData\Roaming\epicgameslauncher"
    3⤵
    - Creates scheduled task(s)
    PID:1508
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /delete /f /tn "epicgameslauncher"
    3⤵
    PID:2884
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpED8A.tmp.bat""
    3⤵
    PID:568
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29e128febb7a1dbbfc3d9983b14b72fb

SHA1
63cfecf3805000c4aede57ed23a458650fde0ca9

SHA256
b32fbfdbf9c821d3e052082dbe34a4ea8aeb8ec27c35726f01c24cdcf809aab1

SHA512
e46f90e17262f8157633a93b47ef28dafb688d79fa1ca55ff03086f2ab5e43d2e8c3182fde54828240c835b6a781d5c4bbe0abdf4d590d021597cce0383c2a27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44a82c737f53cfbfa8963f48e2b9c33b

SHA1
b2f4d3714067ec4b014036a452fa3787190a3cf0

SHA256
7f6fe7dcea7cd3fc6fcb219ee18dd483077a22fe7b3ecdfe8ebe58bf9c709e8d

SHA512
8e60aee81850c30fd83abf874864fab4f0e8fbcf88e3ef1ef77755b89cd9b3d537161d8c72fd9a18ceb67c566b6b94b54be3de7c320adeceffba2d9f33323811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d2a1b09afb2db87e16259681a8265ab

SHA1
1ebcb91ea3a453e47150f63598c3d54fdfc2fcc1

SHA256
ef76dc27833822f37f338fb596154d66b3b247be3bb1d268db1b5feff90c145a

SHA512
339929caad1005d3c88da513c85dd7869644eb42e65c6b48e8e41ff36e3a70a14e0c8de5ea20ae6dc7d8326dd17a5031507407922250ebb0751ca2826581f901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e47c51be214190c850c7dc00c3b4d77

SHA1
6ae5857c391df3da880c12ac236f4ece541c1c92

SHA256
9972c1a89c39b679d46b2a441806c46189b7e95da83d5f137733b6b2b92b248f

SHA512
31343c5c607d13805e42f9c27560474db99e8dd8498ee5353d169a889b575bdf54dbd00ec5d6f42ef0f44e14e513721c90bc119b5459c1ec4b58214ba4047603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1de7c90df0892c9e994189e0524b2cb

SHA1
808155b521cad62eee271e4901b677c15ba0941c

SHA256
341b2a0fe9878ae42c8911e47c66aa04ce12192cfb6b49b9abeecfe339a0287a

SHA512
79bac58feede6bb1154d2a4856be357aa921efaae1c018ccf1ecd0db1975c3b33ea9484ef1ac87a85af05e85008420cb91ef6ec6f132e0116b26fe594b9e4fd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1eb4697d6afbb641c7411ee2fbb9efee

SHA1
2d286d7576503841090a8e667cfdf9bcc2046269

SHA256
fc7817fd244eb7f4d774274ca05f2fd501dc4e1d51d6cbb16d6f57834737506f

SHA512
ed53e86549e57d6105b33095c65a3d4729e41a5936f378fd40716a773802ada4e55e80d09746d35435b2fcd0c997a3274cad61919aaae8d98f78e6c4eccc1adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF440.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF4C0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpED8A.tmp.bat

Filesize
162B

MD5
a10c02d19df86a8bc71ed6766d1bdd06

SHA1
6d2e8525c752176d32ecc86b2456ef76ac8b5a56

SHA256
d852425dfda79bc3ce7b896bca023b27d7cc168d36b0a797784db24d78c66bf7

SHA512
25cca614b032217701e966b2286f4716422ab35b0f727a2b4e652cbfa2a4c9bfbfa4b7add780d6a500ba364c7878c3c971029a8018f4019a28b19dc26f9ee03f

Download Submit
C:\Users\Admin\AppData\Roaming\Dredded'sMT.bat

Filesize
5KB

MD5
ab56972290ddce5aac7fa4bc3436efab

SHA1
3e0a65413a467ac4c4925366766701f016db173c

SHA256
fdb6f0c1731c5ba1ee0598b85620ab83a9e1f6ffe708c1d8ed0055b6eb7d67c1

SHA512
75ade9804e223bc37837513aaaa0a80d8e4ddab25363261b597d4a8bf33ed6def3736a99c0519b1cd20e04cb2761a8c3956ff3b4bff5a87b48d94c47a6c45754

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f0466e6a05abe0e802feed769fe87168

SHA1
51ea5c6db32eae746649334319241c59bfb4fbe1

SHA256
b0f0d0ea19dc0b8c1cb507ff1ad4022236fd92b1d6918496e390e68b2c3c7175

SHA512
ccc6809a784ee038409b225b6a93be571e69ebb4975b112df236362871de421c3420c49a7e3765182b50bdab333bf864aad75b48d0756506bde5eb1c1e2319a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a62657e5c66decc910b8ff4c007f26d3

SHA1
dadbe7b9ac7a99fbde7a322859f65e44e484caa2

SHA256
e800b18e679a4c3ea261376b7ab72a7c33d78a22d44767ede79ff4c4c89904de

SHA512
b92855d72c366d7ab0573eb19235d3f0cfa09cff0f961e69f8fc60f2f31626003c8dcca9a9e814bf922480e9e01d612a059ae5caa427130d27490b65e7f7b265

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\epicgameslauncher.lnk

Filesize
720B

MD5
929ce8d4e7870e63f45ff870a566f80a

SHA1
c332b9b68f85ffb355e389383c12aa10690a3e47

SHA256
99dccb4d5d997a02575e5020250174bed50133d825d4af10e0b4dfbad0d027fb

SHA512
f00acaf05d9b07c33702e2fc6de14fc7b6437c44ee259c47c99dc8cbbe679ff33bfd6fb7aeb67f8f09de79b75cfa860fdd9c2c54012b785661b90679e000a6ef

Download Submit
C:\Users\Admin\AppData\Roaming\discord.exe

Filesize
41KB

MD5
72ef95ae3368f3e40bb087ddaa1fa5c2

SHA1
20d810b3e8623916c7eb09ab3a4d1df45fb1cf62

SHA256
dd0eaf0b079081d4e1b37f79c28ea5503e84517a67200b8f2b20a9b9683f5154

SHA512
5a7d657c375a4d83c56903e3d0f327939a27c032d24fc309c11dfe2d2deddafab6c56eea33a9ca4e9293e208ced9ef20d4312f3f827c00316f9d8d8490540ae9

Download Submit
C:\Users\Admin\AppData\Roaming\microsoft.py

Filesize
78KB

MD5
56858a6f2411a10b07e553dafc76f2cc

SHA1
51fde952fd7ac4a4ad5afe00ee77116120c1f60b

SHA256
ad2c20dc31883ca97884043544fe004cc370270be97ba1bf447b9358c4bd5f92

SHA512
62e529809f42460bd13752fa97c0fc6a19b33e82d8350be10d187e336638d1abf12325ebba79535d22d6666d97698a234d0dcc86c542f97bcf80d34b403676cb

Download Submit
memory/320-56-0x000007FEEEB60000-0x000007FEEF4FD000-memory.dmp

Filesize
9.6MB

Download
memory/320-59-0x000007FEEEB60000-0x000007FEEF4FD000-memory.dmp

Filesize
9.6MB

Download
memory/320-57-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download
memory/320-58-0x000000000291B000-0x0000000002982000-memory.dmp

Filesize
412KB

Download
memory/320-54-0x000007FEEEB60000-0x000007FEEF4FD000-memory.dmp

Filesize
9.6MB

Download
memory/320-55-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download
memory/1104-44-0x0000000002470000-0x00000000024F0000-memory.dmp

Filesize
512KB

Download
memory/1104-46-0x000000000247B000-0x00000000024E2000-memory.dmp

Filesize
412KB

Download
memory/1104-45-0x0000000002470000-0x00000000024F0000-memory.dmp

Filesize
512KB

Download
memory/1104-47-0x000007FEEE1C0000-0x000007FEEEB5D000-memory.dmp

Filesize
9.6MB

Download
memory/1104-42-0x0000000002470000-0x00000000024F0000-memory.dmp

Filesize
512KB

Download
memory/1104-40-0x000007FEEE1C0000-0x000007FEEEB5D000-memory.dmp

Filesize
9.6MB

Download
memory/1104-41-0x0000000002610000-0x0000000002618000-memory.dmp

Filesize
32KB

Download
memory/1104-39-0x000000001B230000-0x000000001B512000-memory.dmp

Filesize
2.9MB

Download
memory/1104-43-0x000007FEEE1C0000-0x000007FEEEB5D000-memory.dmp

Filesize
9.6MB

Download
memory/1576-120-0x000007FEF4B60000-0x000007FEF554C000-memory.dmp

Filesize
9.9MB

Download
memory/1576-92-0x0000000000A30000-0x0000000000A40000-memory.dmp

Filesize
64KB

Download
memory/1576-93-0x000007FEF4B60000-0x000007FEF554C000-memory.dmp

Filesize
9.9MB

Download
memory/1576-94-0x000000001AEC0000-0x000000001AF40000-memory.dmp

Filesize
512KB

Download
memory/1868-31-0x0000000002440000-0x00000000024C0000-memory.dmp

Filesize
512KB

Download
memory/1868-28-0x0000000002440000-0x00000000024C0000-memory.dmp

Filesize
512KB

Download
memory/1868-27-0x000007FEEEB60000-0x000007FEEF4FD000-memory.dmp

Filesize
9.6MB

Download
memory/1868-26-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/1868-29-0x000007FEEEB60000-0x000007FEEF4FD000-memory.dmp

Filesize
9.6MB

Download
memory/1868-25-0x000000001B3A0000-0x000000001B682000-memory.dmp

Filesize
2.9MB

Download
memory/1868-30-0x0000000002440000-0x00000000024C0000-memory.dmp

Filesize
512KB

Download
memory/1868-32-0x0000000002440000-0x00000000024C0000-memory.dmp

Filesize
512KB

Download
memory/1868-33-0x000007FEEEB60000-0x000007FEEF4FD000-memory.dmp

Filesize
9.6MB

Download
memory/1928-114-0x000007FEED930000-0x000007FEEE2CD000-memory.dmp

Filesize
9.6MB

Download
memory/1928-122-0x000007FEED930000-0x000007FEEE2CD000-memory.dmp

Filesize
9.6MB

Download
memory/1928-121-0x0000000002530000-0x00000000025B0000-memory.dmp

Filesize
512KB

Download
memory/1928-116-0x00000000023F0000-0x00000000023F8000-memory.dmp

Filesize
32KB

Download
memory/1928-119-0x0000000002530000-0x00000000025B0000-memory.dmp

Filesize
512KB

Download
memory/1928-118-0x0000000002530000-0x00000000025B0000-memory.dmp

Filesize
512KB

Download
memory/1928-117-0x000007FEED930000-0x000007FEEE2CD000-memory.dmp

Filesize
9.6MB

Download
memory/1928-113-0x000000001B310000-0x000000001B5F2000-memory.dmp

Filesize
2.9MB

Download
memory/1928-115-0x0000000002530000-0x00000000025B0000-memory.dmp

Filesize
512KB

Download
memory/2004-68-0x000007FEEE1C0000-0x000007FEEEB5D000-memory.dmp

Filesize
9.6MB

Download
memory/2004-73-0x000007FEEE1C0000-0x000007FEEEB5D000-memory.dmp

Filesize
9.6MB

Download
memory/2004-69-0x0000000002590000-0x0000000002610000-memory.dmp

Filesize
512KB

Download
memory/2004-66-0x000007FEEE1C0000-0x000007FEEEB5D000-memory.dmp

Filesize
9.6MB

Download
memory/2004-72-0x0000000002590000-0x0000000002610000-memory.dmp

Filesize
512KB

Download
memory/2004-67-0x0000000002590000-0x0000000002610000-memory.dmp

Filesize
512KB

Download
memory/2004-70-0x0000000002590000-0x0000000002610000-memory.dmp

Filesize
512KB

Download
memory/2044-80-0x00000000008E0000-0x00000000008F0000-memory.dmp

Filesize
64KB

Download
memory/2044-81-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download
memory/2044-82-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download
memory/2396-0-0x0000000000970000-0x00000000009C6000-memory.dmp

Filesize
344KB

Download
memory/2396-1-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download
memory/2396-19-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download
memory/2660-85-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download
memory/2660-60-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download
memory/2660-71-0x000000001AC40000-0x000000001ACC0000-memory.dmp

Filesize
512KB

Download
memory/2660-8-0x0000000000F20000-0x0000000000F30000-memory.dmp

Filesize
64KB

Download
memory/2660-17-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download
memory/2660-20-0x000000001AC40000-0x000000001ACC0000-memory.dmp

Filesize
512KB

Download
memory/2812-107-0x000007FEEE2D0000-0x000007FEEEC6D000-memory.dmp

Filesize
9.6MB

Download
memory/2812-104-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/2812-106-0x0000000002660000-0x00000000026E0000-memory.dmp

Filesize
512KB

Download
memory/2812-102-0x0000000002660000-0x00000000026E0000-memory.dmp

Filesize
512KB

Download
memory/2812-105-0x0000000002660000-0x00000000026E0000-memory.dmp

Filesize
512KB

Download
memory/2812-101-0x000007FEEE2D0000-0x000007FEEEC6D000-memory.dmp

Filesize
9.6MB

Download
memory/2812-100-0x000000001B230000-0x000000001B512000-memory.dmp

Filesize
2.9MB

Download
memory/2812-103-0x000007FEEE2D0000-0x000007FEEEC6D000-memory.dmp

Filesize
9.6MB

Download