umbral | df43da5e9f003414fb7087d002291d62e509d1f977e1304d647abf8ec241a68f

Analysis

max time kernel
65s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21-02-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aimsense.exe
Size

148KB
MD5

db11d5b13124f9dab72425ce56662a4f
SHA1

09b901184f4865437769f0999bd6d9589008c25d
SHA256

df43da5e9f003414fb7087d002291d62e509d1f977e1304d647abf8ec241a68f
SHA512

71597bd4ae24b1b74904f7a09c0fdac8d082a86e1d0d794f419057bdccf7f3c5dc07f60cc3499aa00cf2b96e181b7f35b33dbf5fa55a755d7e6fc4c766a708f4
SSDEEP

3072:3w10kz9kMiNZKVHd64TGyTOdp6KZt+2T4m6DkBcsfdmC:32T9kMiNZ6HgdyTODZ4p0cWd

Score

10^/10

umbral stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000e000000023107-7.dat	family_umbral
behavioral1/memory/1356-14-0x0000023DFA350000-0x0000023DFA390000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Checks computer location settings 2 TTPs 27 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	aimsense.exe

Executes dropped EXE 27 IoCs

pid	Process
1356	auth.exe
1948	auth.exe
1276	auth.exe
1128	auth.exe
4516	auth.exe
4696	auth.exe
4640	auth.exe
3452	auth.exe
3196	auth.exe
4592	auth.exe
1412	auth.exe
3560	auth.exe
1480	auth.exe
3056	auth.exe
4432	auth.exe
1620	auth.exe
5092	auth.exe
4860	auth.exe
2712	auth.exe
2516	auth.exe
3024	auth.exe
1836	auth.exe
3832	auth.exe
3212	auth.exe
1016	auth.exe
2220	auth.exe
988	auth.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1356	auth.exe
Token: SeIncreaseQuotaPrivilege	4504	wmic.exe
Token: SeSecurityPrivilege	4504	wmic.exe
Token: SeTakeOwnershipPrivilege	4504	wmic.exe
Token: SeLoadDriverPrivilege	4504	wmic.exe
Token: SeSystemProfilePrivilege	4504	wmic.exe
Token: SeSystemtimePrivilege	4504	wmic.exe
Token: SeProfSingleProcessPrivilege	4504	wmic.exe
Token: SeIncBasePriorityPrivilege	4504	wmic.exe
Token: SeCreatePagefilePrivilege	4504	wmic.exe
Token: SeBackupPrivilege	4504	wmic.exe
Token: SeRestorePrivilege	4504	wmic.exe
Token: SeShutdownPrivilege	4504	wmic.exe
Token: SeDebugPrivilege	4504	wmic.exe
Token: SeSystemEnvironmentPrivilege	4504	wmic.exe
Token: SeRemoteShutdownPrivilege	4504	wmic.exe
Token: SeUndockPrivilege	4504	wmic.exe
Token: SeManageVolumePrivilege	4504	wmic.exe
Token: 33	4504	wmic.exe
Token: 34	4504	wmic.exe
Token: 35	4504	wmic.exe
Token: 36	4504	wmic.exe
Token: SeIncreaseQuotaPrivilege	4504	wmic.exe
Token: SeSecurityPrivilege	4504	wmic.exe
Token: SeTakeOwnershipPrivilege	4504	wmic.exe
Token: SeLoadDriverPrivilege	4504	wmic.exe
Token: SeSystemProfilePrivilege	4504	wmic.exe
Token: SeSystemtimePrivilege	4504	wmic.exe
Token: SeProfSingleProcessPrivilege	4504	wmic.exe
Token: SeIncBasePriorityPrivilege	4504	wmic.exe
Token: SeCreatePagefilePrivilege	4504	wmic.exe
Token: SeBackupPrivilege	4504	wmic.exe
Token: SeRestorePrivilege	4504	wmic.exe
Token: SeShutdownPrivilege	4504	wmic.exe
Token: SeDebugPrivilege	4504	wmic.exe
Token: SeSystemEnvironmentPrivilege	4504	wmic.exe
Token: SeRemoteShutdownPrivilege	4504	wmic.exe
Token: SeUndockPrivilege	4504	wmic.exe
Token: SeManageVolumePrivilege	4504	wmic.exe
Token: 33	4504	wmic.exe
Token: 34	4504	wmic.exe
Token: 35	4504	wmic.exe
Token: 36	4504	wmic.exe
Token: SeDebugPrivilege	1276	auth.exe
Token: SeIncreaseQuotaPrivilege	3556	wmic.exe
Token: SeSecurityPrivilege	3556	wmic.exe
Token: SeTakeOwnershipPrivilege	3556	wmic.exe
Token: SeLoadDriverPrivilege	3556	wmic.exe
Token: SeSystemProfilePrivilege	3556	wmic.exe
Token: SeSystemtimePrivilege	3556	wmic.exe
Token: SeProfSingleProcessPrivilege	3556	wmic.exe
Token: SeIncBasePriorityPrivilege	3556	wmic.exe
Token: SeCreatePagefilePrivilege	3556	wmic.exe
Token: SeBackupPrivilege	3556	wmic.exe
Token: SeRestorePrivilege	3556	wmic.exe
Token: SeShutdownPrivilege	3556	wmic.exe
Token: SeDebugPrivilege	3556	wmic.exe
Token: SeSystemEnvironmentPrivilege	3556	wmic.exe
Token: SeRemoteShutdownPrivilege	3556	wmic.exe
Token: SeUndockPrivilege	3556	wmic.exe
Token: SeManageVolumePrivilege	3556	wmic.exe
Token: 33	3556	wmic.exe
Token: 34	3556	wmic.exe
Token: 35	3556	wmic.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe
1820	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1356	744	aimsense.exe	91
PID 744 wrote to memory of 1356	744	aimsense.exe	91
PID 744 wrote to memory of 3560	744	aimsense.exe	92
PID 744 wrote to memory of 3560	744	aimsense.exe	92
PID 3560 wrote to memory of 1948	3560	aimsense.exe	94
PID 3560 wrote to memory of 1948	3560	aimsense.exe	94
PID 3560 wrote to memory of 1568	3560	aimsense.exe	95
PID 3560 wrote to memory of 1568	3560	aimsense.exe	95
PID 1356 wrote to memory of 4504	1356	auth.exe	96
PID 1356 wrote to memory of 4504	1356	auth.exe	96
PID 1568 wrote to memory of 1276	1568	aimsense.exe	99
PID 1568 wrote to memory of 1276	1568	aimsense.exe	99
PID 1568 wrote to memory of 3608	1568	aimsense.exe	100
PID 1568 wrote to memory of 3608	1568	aimsense.exe	100
PID 1276 wrote to memory of 3556	1276	auth.exe	101
PID 1276 wrote to memory of 3556	1276	auth.exe	101
PID 3608 wrote to memory of 1128	3608	aimsense.exe	103
PID 3608 wrote to memory of 1128	3608	aimsense.exe	103
PID 3608 wrote to memory of 3188	3608	aimsense.exe	104
PID 3608 wrote to memory of 3188	3608	aimsense.exe	104
PID 1128 wrote to memory of 1308	1128	auth.exe	105
PID 1128 wrote to memory of 1308	1128	auth.exe	105
PID 3188 wrote to memory of 4516	3188	aimsense.exe	107
PID 3188 wrote to memory of 4516	3188	aimsense.exe	107
PID 3188 wrote to memory of 3428	3188	aimsense.exe	108
PID 3188 wrote to memory of 3428	3188	aimsense.exe	108
PID 4516 wrote to memory of 4152	4516	auth.exe	109
PID 4516 wrote to memory of 4152	4516	auth.exe	109
PID 3428 wrote to memory of 4696	3428	aimsense.exe	111
PID 3428 wrote to memory of 4696	3428	aimsense.exe	111
PID 3428 wrote to memory of 4876	3428	aimsense.exe	112
PID 3428 wrote to memory of 4876	3428	aimsense.exe	112
PID 4696 wrote to memory of 3532	4696	auth.exe	113
PID 4696 wrote to memory of 3532	4696	auth.exe	113
PID 4876 wrote to memory of 4640	4876	aimsense.exe	115
PID 4876 wrote to memory of 4640	4876	aimsense.exe	115
PID 4876 wrote to memory of 1488	4876	aimsense.exe	116
PID 4876 wrote to memory of 1488	4876	aimsense.exe	116
PID 4640 wrote to memory of 1132	4640	auth.exe	139
PID 4640 wrote to memory of 1132	4640	auth.exe	139
PID 1488 wrote to memory of 3452	1488	aimsense.exe	119
PID 1488 wrote to memory of 3452	1488	aimsense.exe	119
PID 1488 wrote to memory of 2860	1488	aimsense.exe	120
PID 1488 wrote to memory of 2860	1488	aimsense.exe	120
PID 3452 wrote to memory of 4304	3452	auth.exe	121
PID 3452 wrote to memory of 4304	3452	auth.exe	121
PID 2860 wrote to memory of 3196	2860	aimsense.exe	123
PID 2860 wrote to memory of 3196	2860	aimsense.exe	123
PID 2860 wrote to memory of 2648	2860	aimsense.exe	124
PID 2860 wrote to memory of 2648	2860	aimsense.exe	124
PID 3196 wrote to memory of 5104	3196	auth.exe	125
PID 3196 wrote to memory of 5104	3196	auth.exe	125
PID 2648 wrote to memory of 4592	2648	aimsense.exe	127
PID 2648 wrote to memory of 4592	2648	aimsense.exe	127
PID 2648 wrote to memory of 384	2648	aimsense.exe	128
PID 2648 wrote to memory of 384	2648	aimsense.exe	128
PID 384 wrote to memory of 1412	384	aimsense.exe	129
PID 384 wrote to memory of 1412	384	aimsense.exe	129
PID 384 wrote to memory of 1960	384	aimsense.exe	130
PID 384 wrote to memory of 1960	384	aimsense.exe	130
PID 1412 wrote to memory of 2608	1412	auth.exe	131
PID 1412 wrote to memory of 2608	1412	auth.exe	131
PID 1960 wrote to memory of 3560	1960	aimsense.exe	133
PID 1960 wrote to memory of 3560	1960	aimsense.exe	133

C:\Users\Admin\AppData\Local\Temp\aimsense.exe
"C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:744
- C:\Users\Admin\AppData\Local\Temp\auth.exe
  "C:\Users\Admin\AppData\Local\Temp\auth.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- C:\Users\Admin\AppData\Local\Temp\aimsense.exe
  "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Users\Admin\AppData\Local\Temp\auth.exe
    "C:\Users\Admin\AppData\Local\Temp\auth.exe"
    3⤵
    - Executes dropped EXE
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\aimsense.exe
    "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\auth.exe
      "C:\Users\Admin\AppData\Local\Temp\auth.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1276
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\aimsense.exe
      "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1128
      - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        6⤵
        
        PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        7⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        6⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        8⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        7⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        9⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        8⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        10⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        9⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3196
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        11⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        10⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        11⤵
        Executes dropped EXE
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        11⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        13⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        12⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        13⤵
        Executes dropped EXE
        
        PID:3560
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        14⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        13⤵
        Checks computer location settings
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        14⤵
        Executes dropped EXE
        
        PID:1480
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        15⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        14⤵
        Checks computer location settings
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        15⤵
        Executes dropped EXE
        
        PID:3056
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        16⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        15⤵
        Checks computer location settings
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        16⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        17⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        16⤵
        Checks computer location settings
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        17⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        18⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        17⤵
        Checks computer location settings
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        18⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        19⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        18⤵
        Checks computer location settings
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        19⤵
        Checks computer location settings
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        20⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        21⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        20⤵
        Checks computer location settings
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        21⤵
        Executes dropped EXE
        
        PID:2516
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        22⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        21⤵
        Checks computer location settings
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        22⤵
        Executes dropped EXE
        
        PID:3024
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        23⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        22⤵
        Checks computer location settings
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        23⤵
        Executes dropped EXE
        
        PID:1836
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        24⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        23⤵
        Checks computer location settings
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        24⤵
        Executes dropped EXE
        
        PID:3832
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        25⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        24⤵
        Checks computer location settings
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        25⤵
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        26⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        25⤵
        Checks computer location settings
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        26⤵
        Executes dropped EXE
        
        PID:1016
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        27⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        26⤵
        Checks computer location settings
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        27⤵
        Executes dropped EXE
        
        PID:2220
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        28⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        27⤵
        Checks computer location settings
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        28⤵
        Executes dropped EXE
        
        PID:988
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        29⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\aimsense.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aimsense.exe"
        28⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\auth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\auth.exe"
        19⤵
        Executes dropped EXE
        
        PID:4860
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        20⤵
        
        PID:4588

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1820

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\aimsense.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\auth.exe.log

Filesize
1KB

MD5
4c8fa14eeeeda6fe76a08d14e08bf756

SHA1
30003b6798090ec74eb477bbed88e086f8552976

SHA256
7ebfcfca64b0c1c9f0949652d50a64452b35cefe881af110405cd6ec45f857a5

SHA512
116f80182c25cf0e6159cf59a35ee27d66e431696d29ec879c44521a74ab7523cbfdefeacfb6a3298b48788d7a6caa5336628ec9c1d8b9c9723338dcffea4116

Download Submit
C:\Users\Admin\AppData\Local\Temp\auth.exe

Filesize
231KB

MD5
4e62bcc861008fccf8017a90c9d9fa17

SHA1
267c87bfcfb65a2be5516874b9edf9a76f46409b

SHA256
53681696ea3e42e5dadb92a1d0686a36d024aa7fbad9cadbdc02a97331da5a37

SHA512
a1e65c6a255bc9f7c962d8cd9fe03e1a1d4564fc0f38b6df4f6664d28e0010a255ab3d956bc7ad4acad5311b079536b16da3c48d76bff93284e8b36de715555b

Download Submit
memory/384-139-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/384-151-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/744-1-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/744-2-0x00000000009D0000-0x00000000009E0000-memory.dmp

Filesize
64KB

Download
memory/744-0-0x00000000000B0000-0x00000000000DC000-memory.dmp

Filesize
176KB

Download
memory/744-17-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1128-61-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1128-60-0x000001D469590000-0x000001D4695A0000-memory.dmp

Filesize
64KB

Download
memory/1128-58-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1276-44-0x000001C349B80000-0x000001C349B90000-memory.dmp

Filesize
64KB

Download
memory/1276-41-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1276-45-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1356-19-0x0000023DFCB50000-0x0000023DFCB60000-memory.dmp

Filesize
64KB

Download
memory/1356-14-0x0000023DFA350000-0x0000023DFA390000-memory.dmp

Filesize
256KB

Download
memory/1356-28-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1356-16-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1412-152-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1412-154-0x00000153856F0000-0x0000015385700000-memory.dmp

Filesize
64KB

Download
memory/1412-155-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1488-114-0x0000000002C80000-0x0000000002C90000-memory.dmp

Filesize
64KB

Download
memory/1488-110-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1488-126-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1568-26-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1568-30-0x000000001B340000-0x000000001B350000-memory.dmp

Filesize
64KB

Download
memory/1568-42-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1820-268-0x0000014F9FB50000-0x0000014F9FB51000-memory.dmp

Filesize
4KB

Download
memory/1820-258-0x0000014F9FB50000-0x0000014F9FB51000-memory.dmp

Filesize
4KB

Download
memory/1820-255-0x0000014F9FB50000-0x0000014F9FB51000-memory.dmp

Filesize
4KB

Download
memory/1820-261-0x0000014F9FB50000-0x0000014F9FB51000-memory.dmp

Filesize
4KB

Download
memory/1820-271-0x0000014F9FB50000-0x0000014F9FB51000-memory.dmp

Filesize
4KB

Download
memory/1820-270-0x0000014F9FB50000-0x0000014F9FB51000-memory.dmp

Filesize
4KB

Download
memory/1820-274-0x0000014F9FB50000-0x0000014F9FB51000-memory.dmp

Filesize
4KB

Download
memory/1820-273-0x0000014F9FB50000-0x0000014F9FB51000-memory.dmp

Filesize
4KB

Download
memory/1820-266-0x0000014F9FB50000-0x0000014F9FB51000-memory.dmp

Filesize
4KB

Download
memory/1820-272-0x0000014F9FB50000-0x0000014F9FB51000-memory.dmp

Filesize
4KB

Download
memory/1948-24-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1948-80-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1960-159-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/1960-153-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/2648-138-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/2648-133-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/2860-132-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/2860-127-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/3188-59-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/3188-63-0x000000001B470000-0x000000001B480000-memory.dmp

Filesize
64KB

Download
memory/3188-75-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/3196-131-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/3196-134-0x0000017528690000-0x00000175286A0000-memory.dmp

Filesize
64KB

Download
memory/3196-136-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/3428-76-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/3428-79-0x0000000000E20000-0x0000000000E30000-memory.dmp

Filesize
64KB

Download
memory/3428-92-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/3452-129-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/3452-128-0x0000014E03710000-0x0000014E03720000-memory.dmp

Filesize
64KB

Download
memory/3452-125-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/3560-18-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/3560-20-0x000000001B930000-0x000000001B940000-memory.dmp

Filesize
64KB

Download
memory/3560-25-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/3560-157-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/3608-57-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/3608-43-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/4516-77-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/4516-74-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/4592-137-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/4640-111-0x00000236D2EA0000-0x00000236D2EB0000-memory.dmp

Filesize
64KB

Download
memory/4640-112-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/4640-108-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/4696-91-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/4696-94-0x000001D6BAFC0000-0x000001D6BAFD0000-memory.dmp

Filesize
64KB

Download
memory/4696-95-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/4876-93-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/4876-97-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Filesize
64KB

Download
memory/4876-109-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download
memory/4924-158-0x00007FF92CE80000-0x00007FF92D941000-memory.dmp

Filesize
10.8MB

Download