lumma | 31280918bca075062bac6918b91c0ed7a125b4094825e44746723bc7e4c919bc

Analysis

max time kernel
41s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Set-up.exe
Size 785.1MB
Sample240225-3sft1afg46
SHA256 31280918bca075062bac6918b91c0ed7a125b4094825e44746723bc7e4c919bc
MD5 ba0e6b416df17415f3ccd6f7a0848a10
SHA1 82b64851271cb6d4770122d1c19b6a7e72aed8af
SHA512 5c0be6bbe526e0fac33be3ce196862cf67653f261046bb0e1cd3d3ef9f44ca9384da32b0d0239cfab1496fcaadd3833ce0f673058ac234f99ed9d889e0c56bb7
SSDEEP 49152:P+6GEOCYqs7gKN+vcqhC853Tngs+Bds9x6gIpV0ePQBmsQXcgIJm:pGEpY58KN+kovDgs+Bds9PIptXsgR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma xmrig evasion miner persistence stealer upx

Malware Config

Extracted

Family

lumma

https://technologyenterdo.shop/api
https://detectordiscusser.shop/api
https://turkeyunlikelyofw.shop/api
https://associationokeo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral2/memory/4032-89-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4032-90-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4032-92-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4032-93-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4032-94-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4032-95-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4032-96-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4032-97-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/5104-163-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/5104-164-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/5104-165-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/5104-166-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/5104-167-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/5104-169-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/5104-170-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/5104-175-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/5104-176-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/5104-185-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 3 IoCs

pid	Process
4372	WeMods.exe
1676	Aulio.exe
4224	swnhuybimaeo.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4032-84-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4032-85-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4032-86-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4032-87-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4032-88-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4032-89-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4032-90-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4032-92-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4032-93-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4032-94-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4032-95-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4032-96-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4032-97-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/5104-163-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/5104-164-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/5104-165-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/5104-166-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/5104-167-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/5104-169-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/5104-170-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/5104-175-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/5104-176-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/5104-185-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	swnhuybimaeo.exe
File opened for modification	C:\Windows\system32\MRT.exe	WeMods.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1676 set thread context of 4188	1676	Aulio.exe	94
PID 4224 set thread context of 4768	4224	swnhuybimaeo.exe	139
PID 4224 set thread context of 4032	4224	swnhuybimaeo.exe	140

Launches sc.exe 19 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1948	sc.exe
4176	sc.exe
3556	sc.exe
628	sc.exe
3676	sc.exe
4920	sc.exe
3624	sc.exe
2264	sc.exe
2888	sc.exe
924	sc.exe
4268	sc.exe
1648	sc.exe
3800	sc.exe
4400	sc.exe
3856	sc.exe
4976	sc.exe
2836	sc.exe
1392	sc.exe
3900	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4372	WeMods.exe
4692	powershell.exe
4692	powershell.exe
4372	WeMods.exe
4372	WeMods.exe
4372	WeMods.exe
4372	WeMods.exe
4372	WeMods.exe
4372	WeMods.exe
4372	WeMods.exe
4372	WeMods.exe
4372	WeMods.exe
4372	WeMods.exe
4372	WeMods.exe
4224	swnhuybimaeo.exe
436	powershell.exe
436	powershell.exe
4224	swnhuybimaeo.exe
4224	swnhuybimaeo.exe
4224	swnhuybimaeo.exe
4224	swnhuybimaeo.exe
4224	swnhuybimaeo.exe
4224	swnhuybimaeo.exe
4224	swnhuybimaeo.exe
4224	swnhuybimaeo.exe
4032	svchost.exe
4032	svchost.exe
4768	conhost.exe
2412	powershell.exe
2412	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeLockMemoryPrivilege	4032	svchost.exe
Token: SeDebugPrivilege	2412	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4372	4864	Set-up.exe	91
PID 4864 wrote to memory of 4372	4864	Set-up.exe	91
PID 4864 wrote to memory of 1676	4864	Set-up.exe	92
PID 4864 wrote to memory of 1676	4864	Set-up.exe	92
PID 4864 wrote to memory of 1676	4864	Set-up.exe	92
PID 1676 wrote to memory of 4188	1676	Aulio.exe	94
PID 1676 wrote to memory of 4188	1676	Aulio.exe	94
PID 1676 wrote to memory of 4188	1676	Aulio.exe	94
PID 1676 wrote to memory of 4188	1676	Aulio.exe	94
PID 1676 wrote to memory of 4188	1676	Aulio.exe	94
PID 1676 wrote to memory of 4188	1676	Aulio.exe	94
PID 1676 wrote to memory of 4188	1676	Aulio.exe	94
PID 1676 wrote to memory of 4188	1676	Aulio.exe	94
PID 1676 wrote to memory of 4188	1676	Aulio.exe	94
PID 3620 wrote to memory of 464	3620	cmd.exe	103
PID 3620 wrote to memory of 464	3620	cmd.exe	103
PID 4360 wrote to memory of 4808	4360	cmd.exe	121
PID 4360 wrote to memory of 4808	4360	cmd.exe	121
PID 2588 wrote to memory of 1816	2588	cmd.exe	132
PID 2588 wrote to memory of 1816	2588	cmd.exe	132
PID 4224 wrote to memory of 4768	4224	swnhuybimaeo.exe	139
PID 4224 wrote to memory of 4768	4224	swnhuybimaeo.exe	139
PID 4224 wrote to memory of 4768	4224	swnhuybimaeo.exe	139
PID 4224 wrote to memory of 4768	4224	swnhuybimaeo.exe	139
PID 4224 wrote to memory of 4768	4224	swnhuybimaeo.exe	139
PID 4224 wrote to memory of 4768	4224	swnhuybimaeo.exe	139
PID 4224 wrote to memory of 4768	4224	swnhuybimaeo.exe	139
PID 4224 wrote to memory of 4768	4224	swnhuybimaeo.exe	139
PID 4224 wrote to memory of 4768	4224	swnhuybimaeo.exe	139
PID 4224 wrote to memory of 4032	4224	swnhuybimaeo.exe	140
PID 4224 wrote to memory of 4032	4224	swnhuybimaeo.exe	140
PID 4224 wrote to memory of 4032	4224	swnhuybimaeo.exe	140
PID 4224 wrote to memory of 4032	4224	swnhuybimaeo.exe	140
PID 4224 wrote to memory of 4032	4224	swnhuybimaeo.exe	140

C:\Users\Admin\AppData\Local\Temp\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Roaming\WeMods.exe
  C:\Users\Admin\AppData\Roaming\WeMods.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3620
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:464
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4976
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3676
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:3800
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1948
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "ZMRGPDMB"
    3⤵
    - Launches sc.exe
    PID:2836
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "ZMRGPDMB" binpath= "C:\ProgramData\qygplxdxulai\swnhuybimaeo.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\WeMods.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4808
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "ZMRGPDMB"
    3⤵
    - Launches sc.exe
    PID:4400
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:4176
- C:\Users\Admin\AppData\Roaming\Aulio.exe
  C:\Users\Admin\AppData\Roaming\Aulio.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4188

C:\ProgramData\qygplxdxulai\swnhuybimaeo.exe
C:\ProgramData\qygplxdxulai\swnhuybimaeo.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1816
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3624
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2264
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3556
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2888
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2412
- - C:\ProgramData\qygplxdxulai\swnhuybimaeo.exe
    "C:\ProgramData\qygplxdxulai\swnhuybimaeo.exe"
    3⤵
    PID:3796
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      PID:2732
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:1392
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:924
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:3900
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:4268
  - - C:\Windows\system32\svchost.exe
      svchost.exe
      4⤵
      PID:5104
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:1508
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4032

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
1⤵
PID:3248

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:1028

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

swnhuybimaeo.exe

Path C:\ProgramData\qygplxdxulai\swnhuybimaeo.exe
Size 3.7MB
SHA256 89f6a83c454a95313fbb7b8114ba5c99c279d73a42e190705260d03c25ac556f
MD5 85a323a1639d453ceda35a327263d232
SHA1 dbf9d0bcd0793e362822cb372c35ece16903a1aa
SHA512 c21b8e152e68d2ba8d492fff4ef240d5ec6580067eb1184c8f706fbe9e0e901f989feedd4cec512145784bfa89aa8561a937b67c6e5d77929adc4f720ff5250b
SSDEEP 98304:avGhcV2/1IyDLZU4X5nMh7LnGnYGZGLyS53rP:aOn/3DlU2nW7zOHsLyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

swnhuybimaeo.exe

Path C:\ProgramData\qygplxdxulai\swnhuybimaeo.exe
Size 6.1MB
SHA256 98308498bb6dcc3b3c348b0d10b63d416e08dc1738aa06893258f3a878dce280
MD5 cf57555e4fef5e9a2ac7c3c68ef0a2e9
SHA1 403c6f18b1ec8f556ec951b6fcb9230667f4bbf0
SHA512 73e631548c5479a5d1d1bab8ea746ce07957797c28b1041a30c2901b994cb69948d6d7a74c31e9ce39bedf779056e6f938c7b03d45a2af4e4a7b3932bb1d4bf1
SSDEEP 98304:avGhcV2/1IyDLZU4X5nMh7LnGnYGZGLyS53rP:aOn/3DlU2nW7zOHsLyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

swnhuybimaeo.exe

Path C:\ProgramData\qygplxdxulai\swnhuybimaeo.exe
Size 6.8MB
SHA256 ab4c75c64e527d6bd67db230e847b513a834e0431c25ff10fd248f725223ee2e
MD5 db7fb2ebe27eada78b34129b91c59c2c
SHA1 285e31358f510fd5a433b1ec09e1329395b02d5e
SHA512 bda20864650f28f2fddf583133599b692789a82e7a9dd6fe4f70848b273091971c117697728b8ffc37eebadd117ab566ca7bc40607a9774912c9053b6c4933f2
SSDEEP 98304:avGhcV2/1IyDLZU4X5nMh7LnGnYGZGLyS53rP:aOn/3DlU2nW7zOHsLyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_gbkefeob.yjz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gbkefeob.yjz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Aulio.exe

Path C:\Users\Admin\AppData\Roaming\Aulio.exe
Size 952KB
SHA256 7b27f88d2cc7106f7f085b57449bf3ffede9bfeb1a1c9aca7359bd056b16d7a7
MD5 63069039eb33cf207f904b95788d168f
SHA1 1b949a3cd10e1462bf41c3572f41280c4b1693cd
SHA512 8204d9c390c96b830288976858684a496c6dbda42399948a35d772b0e83479fbe8c3a09540df8351271dc6427e4f199f69a9e2cc7af2d46fbf56753b74c69fd5
SSDEEP 6144:MlS+WAC+nOxnULm5Axukpd5Pw2B3rluhJwXj29xGnNQqoLsW:MsACMB8kuk/t3rl8wXj2zGnqqm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aulio.exe

Path C:\Users\Admin\AppData\Roaming\Aulio.exe
Size 12.8MB
SHA256 c9737451d6c3466cb303d608cfd31248578bb98accbb4ef4dcf68c0151750087
MD5 b57ec2ff7322b30694c3d7a893e53cff
SHA1 e51348e775cc0f5408fe504f45c7c5497eaa46e0
SHA512 94cbbaa983d85d3ce596d10c69b3a071bda736a9215d5d033cc5fe5bfb61ce9ce2b729e7535c9e76cac3a2f3a8ffbe974fe92a539a6c68f527dd08ec2aa1b5c9
SSDEEP 6144:MlS+WAC+nOxnULm5Axukpd5Pw2B3rluhJwXj29xGnNQqoLsW:MsACMB8kuk/t3rl8wXj2zGnqqm
MD5 SHA1 SHA512 SSDEEP

Submit Download

WeMods.exe

Path C:\Users\Admin\AppData\Roaming\WeMods.exe
Size 19.0MB
SHA256 5e6b68cd6106cf3f43f0819a619c5ffa0bcfa27704d317831299dc1c1f477556
MD5 181a28bf3f4dbff9496ceb414f3ce9f5
SHA1 c1b1a1163668f517773a1b5f7b57598243cc8166
SHA512 72d7a2b18b721b3b00cca0857131dfcc9dabea85e5b271558df0de81e0aa61d852c4304408744d1e148a76d99ba2ab1dfeb7f2505904de68669f20e88c51c4ce
SSDEEP 98304:avGhcV2/1IyDLZU4X5nMh7LnGnYGZGLyS53rP:aOn/3DlU2nW7zOHsLyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

WeMods.exe

Path C:\Users\Admin\AppData\Roaming\WeMods.exe
Size 16.1MB
SHA256 99811fb7e2cd05006c7bf4c878ac1227dfef3bfeef44420c17a776e5e0a41fde
MD5 e4c3958a1e068edf16ff5c4f318060f6
SHA1 9db06c52079c02e5f1c72afbc489983698e421e8
SHA512 2f7e6a6c91c0c5e8f6561c98df8deb421ef0c858276d6227445c7d77b8e76b9dc69874c82249b0fae17376bcd9ac2d06e0ba96906e618d4483aa5ac3011654ae
SSDEEP 98304:avGhcV2/1IyDLZU4X5nMh7LnGnYGZGLyS53rP:aOn/3DlU2nW7zOHsLyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

reudqcdifqjp.sys

Path C:\Windows\TEMP\reudqcdifqjp.sys
Size 14KB
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
MD5 b42c70c1dbf0d1d477ec86902db9e986
SHA1 1d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA512 57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a023d88a2c4dc566cd55f1ba276a03f9c2fc6232cbe4a501ddab72099a908231
MD5 0c36078ee6dc454f1a5ced884fb4e404
SHA1 5c8560dc1e9c70303deeb91886781ea573bdf4f7
SHA512 c76103bfc23fc8e98d4b21d39f7371c0efe28835f1329eb6d15a3241b052f280d267a9eabfa91d69a2d9cd061d9a3166428b763732ea0f5dde2b884c22dc7417
MD5 SHA1 SHA512

Submit Download

memory/436-63-0x000001927C720000-0x000001927C730000-memory.dmp

Download

memory/436-68-0x000001927F3E0000-0x000001927F3FA000-memory.dmp

Download

memory/436-75-0x00007FFAF4900000-0x00007FFAF53C1000-memory.dmp

Download

memory/436-72-0x000001927C720000-0x000001927C730000-memory.dmp

Download

memory/436-71-0x000001927F3D0000-0x000001927F3DA000-memory.dmp

Download

memory/436-70-0x000001927F3C0000-0x000001927F3C6000-memory.dmp

Download

memory/436-69-0x000001927F390000-0x000001927F398000-memory.dmp

Download

memory/436-67-0x000001927F380000-0x000001927F38A000-memory.dmp

Download

memory/436-66-0x000001927F3A0000-0x000001927F3BC000-memory.dmp

Download

memory/436-47-0x00007FFAF4900000-0x00007FFAF53C1000-memory.dmp

Download

memory/436-52-0x00007FF467EF0000-0x00007FF467F00000-memory.dmp

Download

memory/436-62-0x000001927F150000-0x000001927F16C000-memory.dmp

Download

memory/436-65-0x000001927F230000-0x000001927F23A000-memory.dmp

Download

memory/436-64-0x000001927F170000-0x000001927F225000-memory.dmp

Download

memory/1028-187-0x000001FC6FF00000-0x000001FC6FF01000-memory.dmp

Download

memory/1028-183-0x000001FC6FF00000-0x000001FC6FF01000-memory.dmp

Download

memory/1028-172-0x000001FC6FF00000-0x000001FC6FF01000-memory.dmp

Download

memory/1028-184-0x000001FC6FF00000-0x000001FC6FF01000-memory.dmp

Download

memory/1028-173-0x000001FC6FF00000-0x000001FC6FF01000-memory.dmp

Download

memory/1028-174-0x000001FC6FF00000-0x000001FC6FF01000-memory.dmp

Download

memory/1028-182-0x000001FC6FF00000-0x000001FC6FF01000-memory.dmp

Download

memory/1028-180-0x000001FC6FF00000-0x000001FC6FF01000-memory.dmp

Download

memory/1028-181-0x000001FC6FF00000-0x000001FC6FF01000-memory.dmp

Download

memory/1028-186-0x000001FC6FF00000-0x000001FC6FF01000-memory.dmp

Download

memory/1676-8-0x00000000008F0000-0x0000000000946000-memory.dmp

Download

memory/1676-9-0x00000000751D0000-0x0000000075980000-memory.dmp

Download

memory/1676-18-0x00000000751D0000-0x0000000075980000-memory.dmp

Download

memory/1676-16-0x0000000002E30000-0x0000000004E30000-memory.dmp

Download

memory/2412-126-0x00007FFAF4900000-0x00007FFAF53C1000-memory.dmp

Download

memory/2412-124-0x000001AEA8340000-0x000001AEA8350000-memory.dmp

Download

memory/2412-114-0x000001AEA8340000-0x000001AEA8350000-memory.dmp

Download

memory/2412-112-0x00007FFAF4900000-0x00007FFAF53C1000-memory.dmp

Download

memory/2732-139-0x00007FFAF4900000-0x00007FFAF53C1000-memory.dmp

Download

memory/2732-152-0x00007FFAF4900000-0x00007FFAF53C1000-memory.dmp

Download

memory/2732-150-0x00000211D4800000-0x00000211D4810000-memory.dmp

Download

memory/2732-140-0x00000211D4800000-0x00000211D4810000-memory.dmp

Download

memory/4032-88-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4032-90-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4032-92-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4032-93-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4032-94-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4032-95-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4032-96-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4032-97-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4032-91-0x00000282B2B80000-0x00000282B2BA0000-memory.dmp

Download

memory/4032-89-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4032-87-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4032-86-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4032-85-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4032-84-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4188-12-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/4188-15-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/4188-19-0x0000000002E30000-0x0000000004E30000-memory.dmp

Download

memory/4188-20-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4188-21-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/4188-22-0x0000000002E30000-0x0000000002E3C000-memory.dmp

Download

memory/4692-34-0x000001BF6E5E0000-0x000001BF6E5F0000-memory.dmp

Download

memory/4692-35-0x000001BF6E5E0000-0x000001BF6E5F0000-memory.dmp

Download

memory/4692-23-0x000001BF6E520000-0x000001BF6E542000-memory.dmp

Download

memory/4692-33-0x00007FFAF4900000-0x00007FFAF53C1000-memory.dmp

Download

memory/4692-38-0x00007FFAF4900000-0x00007FFAF53C1000-memory.dmp

Download

memory/4768-76-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4768-78-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4768-83-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4768-80-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4768-79-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4768-77-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/5104-167-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5104-165-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5104-175-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5104-176-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5104-164-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5104-163-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5104-166-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5104-168-0x0000029CFA970000-0x0000029CFA990000-memory.dmp

Download

memory/5104-171-0x0000029CFA9D0000-0x0000029CFA9F0000-memory.dmp

Download

memory/5104-185-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5104-170-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5104-169-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5104-188-0x0000029CFA9D0000-0x0000029CFA9F0000-memory.dmp

Download