njrat | 787cb0fab96ebe518dea4d2ebd90528db5ebf6019cb2c0d62ad77413bcd36e2d

Analysis

max time kernel
747s
max time network
762s
platform
windows10-1703_x64
resource
win10-20240214-en
resource tags

arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system
submitted
19-02-2024 15:26

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

puugtqapzxao.exe
Size

769KB
MD5

0b8d6a7e6d09d1ef259d04a5580a5138
SHA1

34beda8270e99335cfd90907f5037250c8fa682e
SHA256

9b49cb61c6998d160a3fd448926df1f08277866e62999223ee7bc1455e023ad8
SHA512

be6bdef101cdf04f21dd9ddf1166866510b8a1b31ce08b4c962a8fb678f68864c54f729be53c22daaae8b1f6f643f5607fb5a882810f142152a78a016ccb4df5
SSDEEP

12288:sunmOayKUGPPVle8m4Ou1bypH3etxcvj8NfM3q9RNIwo:smayKg4OuC3iN03qD

Score

10^/10

njrat lammer evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Lammer

8.tcp.ngrok.io:19346

Mutex

bca7344ec33c4f045ea133b6b48694e2

Attributes

reg_key
bca7344ec33c4f045ea133b6b48694e2
splitter
|'|'|

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral13/memory/5088-520-0x0000000000C90000-0x0000000000C9A000-memory.dmp	disable_win_def

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

puugtqapzxao.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\Documents\\Sub\\xdwdClient.exe"	puugtqapzxao.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

puugtqapzxao.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	puugtqapzxao.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	puugtqapzxao.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	puugtqapzxao.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

puugtqapzxao.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	puugtqapzxao.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	puugtqapzxao.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	puugtqapzxao.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112
Executes dropped EXE 1 IoCs

Processes:

Trojan.exe

pid process

3112 Trojan.exe

pid	process
3112	Trojan.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

puugtqapzxao.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3721099760-3917598953-789468489-1000\Software\Microsoft\Windows\CurrentVersion\Run\SDLKFJHDLKHDkh = "C:\\Users\\Admin\\Documents\\Sub\\xdwdWatchDog.exe"	puugtqapzxao.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

puugtqapzxao.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua	puugtqapzxao.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	puugtqapzxao.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

2 0.tcp.eu.ngrok.io
8 0.tcp.eu.ngrok.io
19 0.tcp.eu.ngrok.io
38 0.tcp.eu.ngrok.io
Suspicious use of SetThreadContext 1 IoCs

Processes:

puugtqapzxao.exe

description pid process target process

PID 5088 set thread context of 3272 5088 puugtqapzxao.exe RegAsm.exe
Drops file in Windows directory 1 IoCs

Processes:

puugtqapzxao.exe

description ioc process

File created C:\Windows\xdwd.dll puugtqapzxao.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
2	0.tcp.eu.ngrok.io
8	0.tcp.eu.ngrok.io
19	0.tcp.eu.ngrok.io
38	0.tcp.eu.ngrok.io

description	pid	process	target process
PID 5088 set thread context of 3272	5088	puugtqapzxao.exe	RegAsm.exe

description	ioc	process
File created	C:\Windows\xdwd.dll	puugtqapzxao.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

puugtqapzxao.exeWmiApSrv.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
5088	puugtqapzxao.exe
4496	WmiApSrv.exe
4496	WmiApSrv.exe
4348	powershell.exe
4348	powershell.exe
4348	powershell.exe
4348	powershell.exe
4348	powershell.exe
1768	powershell.exe
1768	powershell.exe
2168	powershell.exe
2168	powershell.exe
4532	powershell.exe
4532	powershell.exe
1132	powershell.exe
1132	powershell.exe
2864	powershell.exe
2864	powershell.exe
1768	powershell.exe
1768	powershell.exe
2168	powershell.exe
2168	powershell.exe
4260	powershell.exe
4260	powershell.exe
3872	powershell.exe
3872	powershell.exe
4532	powershell.exe
4532	powershell.exe
2736	powershell.exe
2736	powershell.exe
2932	powershell.exe
2932	powershell.exe
1132	powershell.exe
1132	powershell.exe
2864	powershell.exe
2864	powershell.exe
1476	powershell.exe
1476	powershell.exe
2824	powershell.exe
2824	powershell.exe
4260	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

puugtqapzxao.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	5088	puugtqapzxao.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeIncreaseQuotaPrivilege	4348	powershell.exe
Token: SeSecurityPrivilege	4348	powershell.exe
Token: SeTakeOwnershipPrivilege	4348	powershell.exe
Token: SeLoadDriverPrivilege	4348	powershell.exe
Token: SeSystemProfilePrivilege	4348	powershell.exe
Token: SeSystemtimePrivilege	4348	powershell.exe
Token: SeProfSingleProcessPrivilege	4348	powershell.exe
Token: SeIncBasePriorityPrivilege	4348	powershell.exe
Token: SeCreatePagefilePrivilege	4348	powershell.exe
Token: SeBackupPrivilege	4348	powershell.exe
Token: SeRestorePrivilege	4348	powershell.exe
Token: SeShutdownPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeSystemEnvironmentPrivilege	4348	powershell.exe
Token: SeRemoteShutdownPrivilege	4348	powershell.exe
Token: SeUndockPrivilege	4348	powershell.exe
Token: SeManageVolumePrivilege	4348	powershell.exe
Token: 33	4348	powershell.exe
Token: 34	4348	powershell.exe
Token: 35	4348	powershell.exe
Token: 36	4348	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	4532	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	3872	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	684	powershell.exe
Token: SeIncreaseQuotaPrivilege	1768	powershell.exe
Token: SeSecurityPrivilege	1768	powershell.exe
Token: SeTakeOwnershipPrivilege	1768	powershell.exe
Token: SeLoadDriverPrivilege	1768	powershell.exe
Token: SeSystemProfilePrivilege	1768	powershell.exe
Token: SeSystemtimePrivilege	1768	powershell.exe
Token: SeProfSingleProcessPrivilege	1768	powershell.exe
Token: SeIncBasePriorityPrivilege	1768	powershell.exe
Token: SeCreatePagefilePrivilege	1768	powershell.exe
Token: SeBackupPrivilege	1768	powershell.exe
Token: SeRestorePrivilege	1768	powershell.exe
Token: SeShutdownPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeSystemEnvironmentPrivilege	1768	powershell.exe
Token: SeRemoteShutdownPrivilege	1768	powershell.exe
Token: SeUndockPrivilege	1768	powershell.exe
Token: SeManageVolumePrivilege	1768	powershell.exe
Token: 33	1768	powershell.exe
Token: 34	1768	powershell.exe
Token: 35	1768	powershell.exe
Token: 36	1768	powershell.exe
Token: SeIncreaseQuotaPrivilege	1476	powershell.exe
Token: SeSecurityPrivilege	1476	powershell.exe
Token: SeTakeOwnershipPrivilege	1476	powershell.exe
Token: SeLoadDriverPrivilege	1476	powershell.exe
Token: SeSystemProfilePrivilege	1476	powershell.exe
Token: SeSystemtimePrivilege	1476	powershell.exe
Token: SeProfSingleProcessPrivilege	1476	powershell.exe
Token: SeIncBasePriorityPrivilege	1476	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

6136 LogonUI.exe

pid	process
6136	LogonUI.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

puugtqapzxao.exeRegAsm.execmd.execmd.exe

description	pid	process	target process
PID 5088 wrote to memory of 4348	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 4348	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 1768	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 1768	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 2168	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 2168	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 4532	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 4532	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 2864	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 2864	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 1132	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 1132	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 4260	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 4260	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 3872	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 3872	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 2736	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 2736	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 2932	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 2932	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 1476	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 1476	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 2824	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 2824	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 684	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 684	5088	puugtqapzxao.exe	powershell.exe
PID 5088 wrote to memory of 380	5088	puugtqapzxao.exe	RegAsm.exe
PID 5088 wrote to memory of 380	5088	puugtqapzxao.exe	RegAsm.exe
PID 5088 wrote to memory of 380	5088	puugtqapzxao.exe	RegAsm.exe
PID 5088 wrote to memory of 3272	5088	puugtqapzxao.exe	RegAsm.exe
PID 5088 wrote to memory of 3272	5088	puugtqapzxao.exe	RegAsm.exe
PID 5088 wrote to memory of 3272	5088	puugtqapzxao.exe	RegAsm.exe
PID 5088 wrote to memory of 3272	5088	puugtqapzxao.exe	RegAsm.exe
PID 5088 wrote to memory of 3272	5088	puugtqapzxao.exe	RegAsm.exe
PID 5088 wrote to memory of 3272	5088	puugtqapzxao.exe	RegAsm.exe
PID 5088 wrote to memory of 3272	5088	puugtqapzxao.exe	RegAsm.exe
PID 5088 wrote to memory of 3272	5088	puugtqapzxao.exe	RegAsm.exe
PID 3272 wrote to memory of 3112	3272	RegAsm.exe	Trojan.exe
PID 3272 wrote to memory of 3112	3272	RegAsm.exe	Trojan.exe
PID 3272 wrote to memory of 3112	3272	RegAsm.exe	Trojan.exe
PID 5088 wrote to memory of 1200	5088	puugtqapzxao.exe	cmd.exe
PID 5088 wrote to memory of 1200	5088	puugtqapzxao.exe	cmd.exe
PID 1200 wrote to memory of 1076	1200	cmd.exe	powershell.exe
PID 1200 wrote to memory of 1076	1200	cmd.exe	powershell.exe
PID 5088 wrote to memory of 5076	5088	puugtqapzxao.exe	cmd.exe
PID 5088 wrote to memory of 5076	5088	puugtqapzxao.exe	cmd.exe
PID 5076 wrote to memory of 4564	5076	cmd.exe	shutdown.exe
PID 5076 wrote to memory of 4564	5076	cmd.exe	shutdown.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

puugtqapzxao.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	puugtqapzxao.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	puugtqapzxao.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	puugtqapzxao.exe

C:\Users\Admin\AppData\Local\Temp\puugtqapzxao.exe
"C:\Users\Admin\AppData\Local\Temp\puugtqapzxao.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4532

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:684

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3272

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
3⤵
- Executes dropped EXE
PID:3112

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\mzdwe2dt.3yw.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\mzdwe2dt.3yw.exe"'
3⤵
PID:1076

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c Shutdown /s /f /t 00
2⤵
- Suspicious use of WriteProcessMemory
PID:5076

C:\Windows\system32\shutdown.exe
Shutdown /s /f /t 00
3⤵
PID:4564

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4496

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3aeb055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6136

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
ea13e190c322eaf6a89d894fc43e3f4c

SHA1
33a3ac4355ba6d14d9cdf5e19df328cb47097ee5

SHA256
dcdceee337a503e7cc6b183aacc2fc5f94f43a817d594db2ad7a2687489d9b77

SHA512
6c50d6e9ac6d2ab470977f3367646a4366cf9f68bd72093ed8acf27dbeebf771066fcc55febd6d45858e898b520d4580f35172f54ed4a1cf72005641a7715d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
500f9929a55b1e72d1ede67ef8f0bea9

SHA1
1f466dfb41f62b7295590818afbbc280fc23c50c

SHA256
32a9cb389ea918eb00bc20531f15e5f8e301b4812a25e0ff0d80e78f0dd7e84d

SHA512
439e4637e780dc2e0e4fc498f01d57a41cc9d7ac4c218ab0bd95c306e2cb47fd75391ab0bac0b49efae57665ee0a0330d248626f71f55fa2da7aa78c032cf41d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
00ee33eb614372beb96b2240afdfd7af

SHA1
1014d6f7334dbfcb43cf763f2c26ee21228cd208

SHA256
e7ec08f8889e1af96fe047ba2f536494934781c9536a8e57ca5c6521702ab5b1

SHA512
69f46678fcabe9b0522fd9e2322bb19ebc42a4f5b1295aaa6ecc8c0784e5ae5e598587677258868d82b0fd325e668809a0a797c9f0f23979e296f8d9401ea041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
da88074524a2b9647d6b8d3910b2fc0e

SHA1
d8dafb926cd7e1bb5b9804e8c0bef0c3f956aa20

SHA256
200804ebd0a9569ee1ae52076b15d191807c34c63dc325cd54486727543f7d3f

SHA512
1dc3e02ae700217d920415ab9bd2c5008e22f13e759d4d8d46e975b83dcfa4672dccbf61b7eb0cbb94a80da74f79d784a00b091209cad8da57270ef7867a682b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
f52a0d33bd231007139ce27d65a80a88

SHA1
1045cc36c98c03906bd4364e4cda762821ad706e

SHA256
21ea3d0a2cc106fbd7be27c9aae1cdccfb0077f1e5556fc4f2338247f9683ed3

SHA512
22efb20b18a42ab154cb40db5dfc712fc77ff87512223f73adf5c0e55d7da8a263ab598bd79588f9debc691457862378f630fd9827fa24c59fd8127ffedceaa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
6d06201bfb3522adb1874471e6620a43

SHA1
2d817f759f57ecc2157cb064b60598ce41f8d743

SHA256
a6fca35793c3b5b8a08820195718edfe88171da78a2ae7b07ffccaf728fba2bd

SHA512
caafda3be9f9877cd9010606ad75060c2e8803793293e5110c4660e7dcd7f218d3cdbdfa634c98022d04983e33e6eae527c45c68a6cd0d941bcb6ae279f761a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
6188fb06650486c62b0572b3c96978d4

SHA1
ccba65542b637de3d44da444d6aae1556bd260de

SHA256
5d2d3d14055a4b6f6138f5d9104ecf8f291a38561e2bd59fc55c42f284350378

SHA512
6cb4d1d42abdd3cb26bd6b8e53f6c14040684d0a7cee4350568a5520f4fbc0df2329842bc3853d2c1fac6a1fb5d8d2e3d410d058f2c33b575c84b645e37a0602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
061600348279114ba954ce262c62f1ea

SHA1
e0020b70258bb4af6629316bb5c823d9f4127bbf

SHA256
5b38f961b4b570df3c691e744a426cb2ec7135899b7d879d8734d5413590d024

SHA512
cedfee04c722d58d295d6cb280bd7f2fcbd184bd3a4cd164c9eafa9e29310fffd86d49b7dcc425f0d3e68f209822d94e588684756006622834070894f072824f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
514999564a540d85974094c23a036e21

SHA1
dea33138e8b59af0919fa9631248fcecd791b6fa

SHA256
88175f19b6162996efce49671e7f2d543a7afcc63fca54ed0b6d717d3f2c5988

SHA512
580479a6925c8b8b3c3732443153241192faf47305fd624bb0807af2bff234951c3a52692d89d7a5598827532a50534d8f65a9c44225332e6e6a9dc07cadc218

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v2tvrqkp.yoo.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\Documents\Sub\xdwdClient.exe
Filesize
769KB

MD5
0b8d6a7e6d09d1ef259d04a5580a5138

SHA1
34beda8270e99335cfd90907f5037250c8fa682e

SHA256
9b49cb61c6998d160a3fd448926df1f08277866e62999223ee7bc1455e023ad8

SHA512
be6bdef101cdf04f21dd9ddf1166866510b8a1b31ce08b4c962a8fb678f68864c54f729be53c22daaae8b1f6f643f5607fb5a882810f142152a78a016ccb4df5

Download Submit
C:\Windows\xdwd.dll
Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/684-1107-0x0000025AAE370000-0x0000025AAE3DC000-memory.dmp

Filesize
432KB

Download
memory/684-1384-0x0000025AAE370000-0x0000025AAE3DC000-memory.dmp

Filesize
432KB

Download
memory/684-775-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/1132-1045-0x00000159FB890000-0x00000159FB8FC000-memory.dmp

Filesize
432KB

Download
memory/1132-705-0x00007FFC12DF0000-0x00007FFC137DC000-memory.dmp

Filesize
9.9MB

Download
memory/1132-1375-0x00000159FB890000-0x00000159FB8FC000-memory.dmp

Filesize
432KB

Download
memory/1132-672-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/1132-716-0x00000159FB6E0000-0x00000159FB6F0000-memory.dmp

Filesize
64KB

Download
memory/1476-1091-0x0000017371DC0000-0x0000017371E2C000-memory.dmp

Filesize
432KB

Download
memory/1476-1345-0x0000017371DC0000-0x0000017371E2C000-memory.dmp

Filesize
432KB

Download
memory/1476-744-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/1476-779-0x0000017371E90000-0x0000017371EA0000-memory.dmp

Filesize
64KB

Download
memory/1476-765-0x00007FFC12DF0000-0x00007FFC137DC000-memory.dmp

Filesize
9.9MB

Download
memory/1768-668-0x0000024024FE0000-0x0000024024FF0000-memory.dmp

Filesize
64KB

Download
memory/1768-1320-0x00000240250D0000-0x000002402513C000-memory.dmp

Filesize
432KB

Download
memory/1768-662-0x0000024024FE0000-0x0000024024FF0000-memory.dmp

Filesize
64KB

Download
memory/1768-637-0x00007FFC12DF0000-0x00007FFC137DC000-memory.dmp

Filesize
9.9MB

Download
memory/1768-634-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/1768-630-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/1768-999-0x00000240250D0000-0x000002402513C000-memory.dmp

Filesize
432KB

Download
memory/2168-698-0x000002044AB10000-0x000002044AB20000-memory.dmp

Filesize
64KB

Download
memory/2168-1020-0x0000020462F60000-0x0000020462FCC000-memory.dmp

Filesize
432KB

Download
memory/2168-694-0x000002044AB10000-0x000002044AB20000-memory.dmp

Filesize
64KB

Download
memory/2168-657-0x00007FFC12DF0000-0x00007FFC137DC000-memory.dmp

Filesize
9.9MB

Download
memory/2168-635-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/2168-641-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/2168-1355-0x0000020462F60000-0x0000020462FCC000-memory.dmp

Filesize
432KB

Download
memory/2736-732-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/2736-735-0x00007FFC12DF0000-0x00007FFC137DC000-memory.dmp

Filesize
9.9MB

Download
memory/2736-1075-0x000001DDF15B0000-0x000001DDF161C000-memory.dmp

Filesize
432KB

Download
memory/2736-1374-0x000001DDF15B0000-0x000001DDF161C000-memory.dmp

Filesize
432KB

Download
memory/2736-748-0x000001DDF1660000-0x000001DDF1670000-memory.dmp

Filesize
64KB

Download
memory/2736-746-0x000001DDF1660000-0x000001DDF1670000-memory.dmp

Filesize
64KB

Download
memory/2736-731-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/2824-1097-0x000002324A0F0000-0x000002324A15C000-memory.dmp

Filesize
432KB

Download
memory/2824-1392-0x000002324A0F0000-0x000002324A15C000-memory.dmp

Filesize
432KB

Download
memory/2824-767-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/2824-766-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/2864-711-0x00007FFC12DF0000-0x00007FFC137DC000-memory.dmp

Filesize
9.9MB

Download
memory/2864-1408-0x0000026CBFF00000-0x0000026CBFF6C000-memory.dmp

Filesize
432KB

Download
memory/2864-1038-0x0000026CBFF00000-0x0000026CBFF6C000-memory.dmp

Filesize
432KB

Download
memory/2864-718-0x0000026CBFEC0000-0x0000026CBFED0000-memory.dmp

Filesize
64KB

Download
memory/2864-680-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/2932-750-0x00000269F5790000-0x00000269F57A0000-memory.dmp

Filesize
64KB

Download
memory/2932-734-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/2932-1083-0x00000269F5710000-0x00000269F577C000-memory.dmp

Filesize
432KB

Download
memory/2932-1400-0x00000269F5710000-0x00000269F577C000-memory.dmp

Filesize
432KB

Download
memory/2932-760-0x00000269F5790000-0x00000269F57A0000-memory.dmp

Filesize
64KB

Download
memory/3272-4190-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3872-739-0x00000141F8370000-0x00000141F8380000-memory.dmp

Filesize
64KB

Download
memory/3872-1063-0x00000141F83B0000-0x00000141F841C000-memory.dmp

Filesize
432KB

Download
memory/3872-726-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/3872-1391-0x00000141F83B0000-0x00000141F841C000-memory.dmp

Filesize
432KB

Download
memory/3872-741-0x00000141F8370000-0x00000141F8380000-memory.dmp

Filesize
64KB

Download
memory/3872-733-0x00007FFC12DF0000-0x00007FFC137DC000-memory.dmp

Filesize
9.9MB

Download
memory/4260-728-0x00007FFC12DF0000-0x00007FFC137DC000-memory.dmp

Filesize
9.9MB

Download
memory/4260-1413-0x000001AEF3100000-0x000001AEF316C000-memory.dmp

Filesize
432KB

Download
memory/4260-723-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/4260-721-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/4260-738-0x000001AEF30F0000-0x000001AEF3100000-memory.dmp

Filesize
64KB

Download
memory/4260-737-0x000001AEF30F0000-0x000001AEF3100000-memory.dmp

Filesize
64KB

Download
memory/4260-1056-0x000001AEF3100000-0x000001AEF316C000-memory.dmp

Filesize
432KB

Download
memory/4348-585-0x00007FFC12DF0000-0x00007FFC137DC000-memory.dmp

Filesize
9.9MB

Download
memory/4348-581-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/4348-628-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/4348-588-0x0000016A981E0000-0x0000016A98202000-memory.dmp

Filesize
136KB

Download
memory/4348-629-0x00007FFC12DF0000-0x00007FFC137DC000-memory.dmp

Filesize
9.9MB

Download
memory/4348-587-0x0000016AFF3F0000-0x0000016AFF400000-memory.dmp

Filesize
64KB

Download
memory/4348-582-0x00007FFC2F680000-0x00007FFC2F681000-memory.dmp

Filesize
4KB

Download
memory/4348-603-0x0000016AFF3F0000-0x0000016AFF400000-memory.dmp

Filesize
64KB

Download
memory/4348-578-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/4348-627-0x0000016A98210000-0x0000016A9827C000-memory.dmp

Filesize
432KB

Download
memory/4348-586-0x0000016AFF3F0000-0x0000016AFF400000-memory.dmp

Filesize
64KB

Download
memory/4496-36-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/4496-35-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/4496-37-0x00007FFC2F730000-0x00007FFC2F731000-memory.dmp

Filesize
4KB

Download
memory/4496-38-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/4532-647-0x00007FFC2F930000-0x00007FFC2FB0B000-memory.dmp

Filesize
1.9MB

Download
memory/4532-1366-0x000001C977B30000-0x000001C977B9C000-memory.dmp

Filesize
432KB

Download
memory/4532-691-0x00007FFC12DF0000-0x00007FFC137DC000-memory.dmp

Filesize
9.9MB

Download
memory/4532-1031-0x000001C977B30000-0x000001C977B9C000-memory.dmp

Filesize
432KB

Download
memory/4532-713-0x000001C977470000-0x000001C977480000-memory.dmp

Filesize
64KB

Download
memory/5088-67-0x00007FFC12DF0000-0x00007FFC137DC000-memory.dmp

Filesize
9.9MB

Download
memory/5088-180-0x000000001B7C0000-0x000000001B7D0000-memory.dmp

Filesize
64KB

Download
memory/5088-519-0x0000000000D20000-0x0000000000D96000-memory.dmp

Filesize
472KB

Download
memory/5088-520-0x0000000000C90000-0x0000000000C9A000-memory.dmp

Filesize
40KB

Download
memory/5088-521-0x0000000000CC0000-0x0000000000CDE000-memory.dmp

Filesize
120KB

Download
memory/5088-0-0x0000000000540000-0x0000000000606000-memory.dmp

Filesize
792KB

Download
memory/5088-18-0x000000001B7C0000-0x000000001B7D0000-memory.dmp

Filesize
64KB

Download
memory/5088-1-0x00007FFC12DF0000-0x00007FFC137DC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads