growtopia | 571a330dfb82f72878d9ede8bdfc332544446a0160117bf37399c3b9ca0775e2

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RadiumExecutor.exe
Size

12.6MB
MD5

7a17d34bac23e365863ea1da1e42e968
SHA1

b5ccab413899349d2821cc2798bce29f0118121f
SHA256

571a330dfb82f72878d9ede8bdfc332544446a0160117bf37399c3b9ca0775e2
SHA512

c021f26320c49c64831c676820d1bc7cb84ba3f49b798d4f858461eebc398a37d937de1d4cf214b973b8ac1cb693830894c4ae9b1bc7d62f2fd5d56b7d5ba4ac
SSDEEP

196608:MRvSjNRyzz9V4EAWzcNtYuZuT0ItZ/jBpOtwDc3rSlou2it3NaB+He+8:MRqjj+xV8acwWuNtZ/jetwc3SYihNqc

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2664-58-0x0000000000550000-0x00000000005BC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-63-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-65-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-71-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-73-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-75-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-77-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-81-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-79-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-83-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-85-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-87-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-89-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-91-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-93-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-95-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-97-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-99-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-101-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-103-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-105-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-107-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-109-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-111-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-113-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-115-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-117-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-119-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-121-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-123-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-125-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-127-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-129-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-131-0x0000000000550000-0x00000000005B5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2988-846-0x000000001B220000-0x000000001B2A0000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 9 IoCs

Processes:

Ilkdt.exeWinHostMgr.exeWinErrorMgr.exeKeyGeneratorI.exeSahyui1337.exeKeyGeneratorI.exeWinErrorMgr.exebauwrdgwodhv.exe

pid	Process
2664	Ilkdt.exe
2564	WinHostMgr.exe
2684	WinErrorMgr.exe
2484	KeyGeneratorI.exe
2988	Sahyui1337.exe
704	KeyGeneratorI.exe
572	WinErrorMgr.exe
464
1536	bauwrdgwodhv.exe

Loads dropped DLL 9 IoCs

Processes:

RadiumExecutor.exeKeyGeneratorI.exeWinErrorMgr.exe

pid	Process
3004	RadiumExecutor.exe
3004	RadiumExecutor.exe
3004	RadiumExecutor.exe
3004	RadiumExecutor.exe
3004	RadiumExecutor.exe
3004	RadiumExecutor.exe
704	KeyGeneratorI.exe
2684	WinErrorMgr.exe
464

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

Processes:

flow	ioc
2	discord.com
3	discord.com
10	pastebin.com
11	pastebin.com

Drops file in System32 directory 4 IoCs

Processes:

powershell.exeWinHostMgr.exepowershell.exebauwrdgwodhv.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bauwrdgwodhv.exe

description	pid	Process	procid_target
PID 1536 set thread context of 364	1536	bauwrdgwodhv.exe	97
PID 1536 set thread context of 1856	1536	bauwrdgwodhv.exe	98

Drops file in Windows directory 2 IoCs

Processes:

wusa.exewusa.exe

description	ioc	Process
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\wusa.lock	wusa.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	Process
1612	sc.exe
2796	sc.exe
2872	sc.exe
1180	sc.exe
2672	sc.exe
2736	sc.exe
1828	sc.exe
1440	sc.exe
2380	sc.exe
2264	sc.exe
1504	sc.exe
2768	sc.exe
1132	sc.exe
2724	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

Processes:

resource	yara_rule
behavioral1/files/0x000600000001944d-28.dat	pyinstaller
behavioral1/files/0x000600000001944d-31.dat	pyinstaller
behavioral1/files/0x000600000001944d-38.dat	pyinstaller
behavioral1/files/0x000600000001944d-53.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exe

pid	Process
3036	schtasks.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 7003bd924b6fda01	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeSahyui1337.exeWinHostMgr.exepowershell.exebauwrdgwodhv.exepowershell.exeexplorer.exe

pid	Process
3052	powershell.exe
2988	Sahyui1337.exe
2988	Sahyui1337.exe
2564	WinHostMgr.exe
1968	powershell.exe
2564	WinHostMgr.exe
2564	WinHostMgr.exe
2564	WinHostMgr.exe
2564	WinHostMgr.exe
2564	WinHostMgr.exe
2564	WinHostMgr.exe
2564	WinHostMgr.exe
2564	WinHostMgr.exe
2564	WinHostMgr.exe
2564	WinHostMgr.exe
2564	WinHostMgr.exe
2564	WinHostMgr.exe
2564	WinHostMgr.exe
2564	WinHostMgr.exe
1536	bauwrdgwodhv.exe
368	powershell.exe
1536	bauwrdgwodhv.exe
1536	bauwrdgwodhv.exe
1536	bauwrdgwodhv.exe
1536	bauwrdgwodhv.exe
1536	bauwrdgwodhv.exe
1536	bauwrdgwodhv.exe
1536	bauwrdgwodhv.exe
1536	bauwrdgwodhv.exe
1536	bauwrdgwodhv.exe
1536	bauwrdgwodhv.exe
1536	bauwrdgwodhv.exe
1536	bauwrdgwodhv.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe
1856	explorer.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid	Process
464

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

Ilkdt.exepowershell.exeSahyui1337.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exe

description	pid	Process
Token: SeDebugPrivilege	2664	Ilkdt.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	2988	Sahyui1337.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeShutdownPrivilege	2652	powercfg.exe
Token: SeShutdownPrivilege	1656	powercfg.exe
Token: SeShutdownPrivilege	1332	powercfg.exe
Token: SeShutdownPrivilege	1608	powercfg.exe
Token: SeDebugPrivilege	368	powershell.exe
Token: SeShutdownPrivilege	1908	powercfg.exe
Token: SeShutdownPrivilege	3044	powercfg.exe
Token: SeShutdownPrivilege	1944	powercfg.exe
Token: SeShutdownPrivilege	3056	powercfg.exe
Token: SeLockMemoryPrivilege	1856	explorer.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

RadiumExecutor.exeKeyGeneratorI.exeWinErrorMgr.exeWinErrorMgr.execmd.execmd.exebauwrdgwodhv.exe

description	pid	Process	procid_target
PID 3004 wrote to memory of 3052	3004	RadiumExecutor.exe	30
PID 3004 wrote to memory of 3052	3004	RadiumExecutor.exe	30
PID 3004 wrote to memory of 3052	3004	RadiumExecutor.exe	30
PID 3004 wrote to memory of 3052	3004	RadiumExecutor.exe	30
PID 3004 wrote to memory of 2664	3004	RadiumExecutor.exe	32
PID 3004 wrote to memory of 2664	3004	RadiumExecutor.exe	32
PID 3004 wrote to memory of 2664	3004	RadiumExecutor.exe	32
PID 3004 wrote to memory of 2664	3004	RadiumExecutor.exe	32
PID 3004 wrote to memory of 2564	3004	RadiumExecutor.exe	33
PID 3004 wrote to memory of 2564	3004	RadiumExecutor.exe	33
PID 3004 wrote to memory of 2564	3004	RadiumExecutor.exe	33
PID 3004 wrote to memory of 2564	3004	RadiumExecutor.exe	33
PID 3004 wrote to memory of 2684	3004	RadiumExecutor.exe	34
PID 3004 wrote to memory of 2684	3004	RadiumExecutor.exe	34
PID 3004 wrote to memory of 2684	3004	RadiumExecutor.exe	34
PID 3004 wrote to memory of 2684	3004	RadiumExecutor.exe	34
PID 3004 wrote to memory of 2484	3004	RadiumExecutor.exe	35
PID 3004 wrote to memory of 2484	3004	RadiumExecutor.exe	35
PID 3004 wrote to memory of 2484	3004	RadiumExecutor.exe	35
PID 3004 wrote to memory of 2484	3004	RadiumExecutor.exe	35
PID 3004 wrote to memory of 2988	3004	RadiumExecutor.exe	36
PID 3004 wrote to memory of 2988	3004	RadiumExecutor.exe	36
PID 3004 wrote to memory of 2988	3004	RadiumExecutor.exe	36
PID 3004 wrote to memory of 2988	3004	RadiumExecutor.exe	36
PID 2484 wrote to memory of 704	2484	KeyGeneratorI.exe	38
PID 2484 wrote to memory of 704	2484	KeyGeneratorI.exe	38
PID 2484 wrote to memory of 704	2484	KeyGeneratorI.exe	38
PID 2684 wrote to memory of 572	2684	WinErrorMgr.exe	39
PID 2684 wrote to memory of 572	2684	WinErrorMgr.exe	39
PID 2684 wrote to memory of 572	2684	WinErrorMgr.exe	39
PID 2684 wrote to memory of 572	2684	WinErrorMgr.exe	39
PID 572 wrote to memory of 3036	572	WinErrorMgr.exe	40
PID 572 wrote to memory of 3036	572	WinErrorMgr.exe	40
PID 572 wrote to memory of 3036	572	WinErrorMgr.exe	40
PID 572 wrote to memory of 3036	572	WinErrorMgr.exe	40
PID 928 wrote to memory of 672	928	cmd.exe	50
PID 928 wrote to memory of 672	928	cmd.exe	50
PID 928 wrote to memory of 672	928	cmd.exe	50
PID 1392 wrote to memory of 2460	1392	cmd.exe	82
PID 1392 wrote to memory of 2460	1392	cmd.exe	82
PID 1392 wrote to memory of 2460	1392	cmd.exe	82
PID 1536 wrote to memory of 364	1536	bauwrdgwodhv.exe	97
PID 1536 wrote to memory of 364	1536	bauwrdgwodhv.exe	97
PID 1536 wrote to memory of 364	1536	bauwrdgwodhv.exe	97
PID 1536 wrote to memory of 364	1536	bauwrdgwodhv.exe	97
PID 1536 wrote to memory of 364	1536	bauwrdgwodhv.exe	97
PID 1536 wrote to memory of 364	1536	bauwrdgwodhv.exe	97
PID 1536 wrote to memory of 364	1536	bauwrdgwodhv.exe	97
PID 1536 wrote to memory of 364	1536	bauwrdgwodhv.exe	97
PID 1536 wrote to memory of 364	1536	bauwrdgwodhv.exe	97
PID 1536 wrote to memory of 1856	1536	bauwrdgwodhv.exe	98
PID 1536 wrote to memory of 1856	1536	bauwrdgwodhv.exe	98
PID 1536 wrote to memory of 1856	1536	bauwrdgwodhv.exe	98
PID 1536 wrote to memory of 1856	1536	bauwrdgwodhv.exe	98
PID 1536 wrote to memory of 1856	1536	bauwrdgwodhv.exe	98

C:\Users\Admin\AppData\Local\Temp\RadiumExecutor.exe
"C:\Users\Admin\AppData\Local\Temp\RadiumExecutor.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAawB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHQAdwBpACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAbQBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGEAagB0ACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3052
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2564
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Drops file in Windows directory
      PID:672
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2672
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2264
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1504
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2796
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:2768
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:1132
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1612
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:2724
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:2736
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEC0.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:3036
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:704
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2988

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Drops file in Windows directory
    PID:2460
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1828
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1440
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2380
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2872
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1180
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:364
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI24842\python312.dll

Filesize
795KB

MD5
7ddfabe8b0fd0da23f50aa734142321a

SHA1
47a83aafb4de2f435711e79a12fc22fc3b604a55

SHA256
4b63a76e31de683c50f378136a7153c6b4a7b1017079a11eeed87b3f062b4725

SHA512
cadbdaa6cedcc5476b270ff024d6fe4c3f2f5f0e7cc55b27834242f3ce9fd55a49bf894bf5920579c2f54a406cff97b05777535bf099afe2557542ee45a5c967

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEC0.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
1.6MB

MD5
92f2679cf4b9449a203004561e49903a

SHA1
91014f5b2ccb509e42893434fd2d4913fdf725b3

SHA256
ea2380d8e0c96a5053c45581efdcab529ef14781178ed14bde1ad5dcac87ca91

SHA512
0dfc45037258fde42408f62b339dd5a9ec8c792e123e457ef282b99073854a18351c0ccd542ae6cff68e5aa29aa440334fa8770b9882b5fc7025190104e0e31e

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
448KB

MD5
f5e04039818d55d465009ebd42a059b2

SHA1
481574e863316a3b8ae9a099b58018674e4f556a

SHA256
d59593d526328b5a167216b01b1d1cbb8d80428001b0c7b7b119fe43df5063b1

SHA512
22d8ac153c7684dc2e428b25d3b4dd03e34f36dfbf7a768ffd73c6e04b33e863ab67a9f52b32bbeea9f5d3fffdbb86ed996bf505eff55c41323912ba4926c94e

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
777KB

MD5
080bf6d90b60526379f9497d9dc04698

SHA1
e01c66c4be090d40630ff0ca43f9adcd66e3456a

SHA256
3ca919741bdf29b143cc39923786dd4bc2decbed65ecd31dd12be58f4d167e63

SHA512
866e2586b32514756eed479764fab93f1f596a325d069226769dccdb88191cf8be4d2044ce973fc00bf9e893fc560261c342205a7fc4de0cbf4f35d64c0067a4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KX3VMUBNHNWMTA4ZSVMU.temp

Filesize
7KB

MD5
e93538274a3b318a51e464a43b647388

SHA1
37fbc84143dbbcaf844ddc2b42e8528cc55938ff

SHA256
8abc8013be7660227f483d1c95e099f67189662648cea0b767dfe33223893858

SHA512
4e65685bee3048819d5d14b8c1d0d88e2def9141906ccd1749054783a2d3a3aa97794c8877b9bc0ff8e32f7652bf82d289945422939bc3616377727d69f70e4e

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
5.0MB

MD5
e222309197c5e633aa8e294ba4bdcd29

SHA1
52b3f89a3d2262bf603628093f6d1e71d9cc3820

SHA256
047a7ca1b8848c1c0e3c0fcc6ece056390760b24580f27f6966b86b0c2a1042b

SHA512
9eb37686e0cee9ec18d12a4edd37c8334d26650c74eae5b30231c2b0db1628d52848123c9348c3da306ec950b827ec0a56cdf43ee325a9e280022c68193d8503

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI24842\python312.dll

Filesize
1.4MB

MD5
2505be6a785fdab9aeadb993935a0cfb

SHA1
555f7fceee041c1d977e6225c2408fcf7f9ee067

SHA256
3bac055c65319eb7440b08d2da4d3f2433aa2ce6d7f525ef3a3ddb2c14728a02

SHA512
22c69a80d62e190d9e9df95e262c341f49b6ac533fed4d9bc44fcb034a5070898943c57b3b7660b37ff74320b8980e7083f32ecf000d4d18589dee0dbb88058e

Download Submit
\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
1.5MB

MD5
5f7ca3c83702edee95276dd90cc0cd4a

SHA1
e414a2de3f78f9d2df46f8388d610fc477e58d05

SHA256
c05acdad0628535a70527d01bbfab5b1909bb3cd783b6f11657a055bee5600c0

SHA512
af1f5acc5ab1c3172ff177bcb6bbbb7c680535b26d0f4b17acb906211c4307ea6e8e5022a72b781177568c6cd8088e5758c407594f54dd37db3e984a8f58437e

Download Submit
memory/368-1709-0x000007FEF47E0000-0x000007FEF517D000-memory.dmp

Filesize
9.6MB

Download
memory/368-1702-0x0000000000A40000-0x0000000000A48000-memory.dmp

Filesize
32KB

Download
memory/368-1705-0x000007FEF47E0000-0x000007FEF517D000-memory.dmp

Filesize
9.6MB

Download
memory/368-1703-0x000007FEF47E0000-0x000007FEF517D000-memory.dmp

Filesize
9.6MB

Download
memory/368-1701-0x00000000199D0000-0x0000000019CB2000-memory.dmp

Filesize
2.9MB

Download
memory/368-1706-0x0000000001070000-0x00000000010F0000-memory.dmp

Filesize
512KB

Download
memory/368-1708-0x0000000001070000-0x00000000010F0000-memory.dmp

Filesize
512KB

Download
memory/368-1707-0x0000000001070000-0x00000000010F0000-memory.dmp

Filesize
512KB

Download
memory/368-1704-0x0000000001070000-0x00000000010F0000-memory.dmp

Filesize
512KB

Download
memory/572-69-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/572-842-0x0000000073730000-0x0000000073E1E000-memory.dmp

Filesize
6.9MB

Download
memory/572-1692-0x00000000048D0000-0x0000000004910000-memory.dmp

Filesize
256KB

Download
memory/572-1669-0x00000000048D0000-0x0000000004910000-memory.dmp

Filesize
256KB

Download
memory/572-1681-0x0000000073730000-0x0000000073E1E000-memory.dmp

Filesize
6.9MB

Download
memory/1856-1734-0x00000000001E0000-0x0000000000200000-memory.dmp

Filesize
128KB

Download
memory/1856-1735-0x00000000001E0000-0x0000000000200000-memory.dmp

Filesize
128KB

Download
memory/1968-1694-0x000007FEF5180000-0x000007FEF5B1D000-memory.dmp

Filesize
9.6MB

Download
memory/1968-1688-0x000007FEF5180000-0x000007FEF5B1D000-memory.dmp

Filesize
9.6MB

Download
memory/1968-1687-0x0000000001E90000-0x0000000001E98000-memory.dmp

Filesize
32KB

Download
memory/1968-1686-0x000000001B320000-0x000000001B602000-memory.dmp

Filesize
2.9MB

Download
memory/1968-1689-0x0000000002680000-0x0000000002700000-memory.dmp

Filesize
512KB

Download
memory/1968-1690-0x000007FEF5180000-0x000007FEF5B1D000-memory.dmp

Filesize
9.6MB

Download
memory/1968-1691-0x0000000002680000-0x0000000002700000-memory.dmp

Filesize
512KB

Download
memory/1968-1693-0x0000000002680000-0x0000000002700000-memory.dmp

Filesize
512KB

Download
memory/2664-65-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-95-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-103-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-105-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-107-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-109-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-111-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-113-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-115-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-117-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-119-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-121-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-123-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-125-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-127-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-129-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-131-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-25-0x00000000008C0000-0x00000000008F6000-memory.dmp

Filesize
216KB

Download
memory/2664-37-0x0000000073730000-0x0000000073E1E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-99-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-56-0x00000000048C0000-0x0000000004900000-memory.dmp

Filesize
256KB

Download
memory/2664-58-0x0000000000550000-0x00000000005BC000-memory.dmp

Filesize
432KB

Download
memory/2664-97-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-63-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-71-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-101-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-1670-0x0000000073730000-0x0000000073E1E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-93-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-91-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-89-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-87-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-85-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-83-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-79-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-81-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-77-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-75-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2664-73-0x0000000000550000-0x00000000005B5000-memory.dmp

Filesize
404KB

Download
memory/2684-66-0x0000000073730000-0x0000000073E1E000-memory.dmp

Filesize
6.9MB

Download
memory/2684-39-0x0000000073730000-0x0000000073E1E000-memory.dmp

Filesize
6.9MB

Download
memory/2684-24-0x0000000000190000-0x00000000001A0000-memory.dmp

Filesize
64KB

Download
memory/2988-1459-0x000007FEF5130000-0x000007FEF5B1C000-memory.dmp

Filesize
9.9MB

Download
memory/2988-846-0x000000001B220000-0x000000001B2A0000-memory.dmp

Filesize
512KB

Download
memory/2988-49-0x0000000000110000-0x0000000000164000-memory.dmp

Filesize
336KB

Download
memory/2988-839-0x000007FEF5130000-0x000007FEF5B1C000-memory.dmp

Filesize
9.9MB

Download
memory/3052-1204-0x0000000072C60000-0x000000007320B000-memory.dmp

Filesize
5.7MB

Download
memory/3052-55-0x0000000072C60000-0x000000007320B000-memory.dmp

Filesize
5.7MB

Download
memory/3052-844-0x0000000001D60000-0x0000000001DA0000-memory.dmp

Filesize
256KB

Download
memory/3052-42-0x0000000001D60000-0x0000000001DA0000-memory.dmp

Filesize
256KB

Download
memory/3052-840-0x0000000001D60000-0x0000000001DA0000-memory.dmp

Filesize
256KB

Download