Analysis
- max time kernel
52s - max time network
162s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
09/04/2024, 03:02
General
- Target 5a47382c60aad09fd3dbbbd8251ab2f2cbca286248c6738de430d2c284781046.exe
- Size 1.8MB
- Sample240409-djf1zagb4x
- SHA256 5a47382c60aad09fd3dbbbd8251ab2f2cbca286248c6738de430d2c284781046
Malware Config
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
redline
-
LiveTraffic
-
4.185.137.132:1632
Extracted
-
redline
-
@OLEH_PSP
-
185.172.128.33:8970
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
stealc
-
http://52.143.157.84
-
url_path
/c73eed764cc59dcb.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 6 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 8 IoCs
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 7 IoCs
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 6 IoCs
- Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies system certificate store 2 TTPs 2 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 50 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a47382c60aad09fd3dbbbd8251ab2f2cbca286248c6738de430d2c284781046.exe"C:\Users\Admin\AppData\Local\Temp\5a47382c60aad09fd3dbbbd8251ab2f2cbca286248c6738de430d2c284781046.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000985001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 8803⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\472529282816_Desktop.zip' -CompressionLevel Optimal4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 8643⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe"C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe"2⤵
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe"2⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"3⤵
-
C:\Users\Admin\Pictures\e30KlfbDfDPbxq8TZeHHtMWH.exe"C:\Users\Admin\Pictures\e30KlfbDfDPbxq8TZeHHtMWH.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\u1xo.0.exe"C:\Users\Admin\AppData\Local\Temp\u1xo.0.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AKFHDBFIDA.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\AKFHDBFIDA.exe"C:\Users\Admin\AppData\Local\Temp\AKFHDBFIDA.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\AKFHDBFIDA.exe8⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30009⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 34726⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u1xo.1.exe"C:\Users\Admin\AppData\Local\Temp\u1xo.1.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD16⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 15405⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\gSJmgoJP9HcKOdu2QCjKzG9F.exe"C:\Users\Admin\Pictures\gSJmgoJP9HcKOdu2QCjKzG9F.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Users\Admin\Pictures\gSJmgoJP9HcKOdu2QCjKzG9F.exe"C:\Users\Admin\Pictures\gSJmgoJP9HcKOdu2QCjKzG9F.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 6246⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 9685⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\QqlrORphJMz0g27VzI6jSDcb.exe"C:\Users\Admin\Pictures\QqlrORphJMz0g27VzI6jSDcb.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Users\Admin\Pictures\QqlrORphJMz0g27VzI6jSDcb.exe"C:\Users\Admin\Pictures\QqlrORphJMz0g27VzI6jSDcb.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
-
-
-
C:\Users\Admin\Pictures\65LcdPI8as63aWI6EyWdkVf4.exe"C:\Users\Admin\Pictures\65LcdPI8as63aWI6EyWdkVf4.exe" --silent --allusers=04⤵
-
C:\Users\Admin\Pictures\65LcdPI8as63aWI6EyWdkVf4.exeC:\Users\Admin\Pictures\65LcdPI8as63aWI6EyWdkVf4.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6b96e1d0,0x6b96e1dc,0x6b96e1e85⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\65LcdPI8as63aWI6EyWdkVf4.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\65LcdPI8as63aWI6EyWdkVf4.exe" --version5⤵
-
-
C:\Users\Admin\Pictures\65LcdPI8as63aWI6EyWdkVf4.exe"C:\Users\Admin\Pictures\65LcdPI8as63aWI6EyWdkVf4.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4512 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240409030347" --session-guid=b014e3b8-f97c-4b7a-b05c-68e069131379 --server-tracking-blob=NzIzYzM4ZTc3NWQ2NDE0MzE5YTAxYjRlYjAwNjFlOWFiZmUyNWVhNjA2Mzk4MzBlZWMwNWUzYjU1YWI2MDNlODp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTI2MzE4MTguNjQ3NSIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6ImMzMGI4OWU4LWJjOWEtNDM0ZC1hMzVkLTVkNzMxZDQ5ZTNmMiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=70040000000000005⤵
-
C:\Users\Admin\Pictures\65LcdPI8as63aWI6EyWdkVf4.exeC:\Users\Admin\Pictures\65LcdPI8as63aWI6EyWdkVf4.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2bc,0x2c0,0x2c4,0x28c,0x2c8,0x6ae8e1d0,0x6ae8e1dc,0x6ae8e1e86⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404090303471\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404090303471\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404090303471\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404090303471\assistant\assistant_installer.exe" --version5⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404090303471\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404090303471\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x490040,0x49004c,0x4900586⤵
-
-
-
-
C:\Users\Admin\Pictures\EYbd4sX16XKKuJ2RcMMOwSzE.exe"C:\Users\Admin\Pictures\EYbd4sX16XKKuJ2RcMMOwSzE.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC241.tmp\Install.exe.\Install.exe /JYfjdidq "385118" /S5⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"6⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True9⤵
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bgNHpsssZstYPMxCCI" /SC once /ST 03:05:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\jUMRKWr.exe\" mP /FQsite_idTit 385118 /S" /V1 /F6⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\Pictures\feWkxEQN74SEw0JlYNDaNkP8.exe"C:\Users\Admin\Pictures\feWkxEQN74SEw0JlYNDaNkP8.exe"4⤵
-
-
C:\Users\Admin\Pictures\QjUibsW00MjPcNuja4ldta86.exe"C:\Users\Admin\Pictures\QjUibsW00MjPcNuja4ldta86.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSD695.tmp\Install.exe.\Install.exe /JYfjdidq "385118" /S5⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"6⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True9⤵
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bgNHpsssZstYPMxCCI" /SC once /ST 03:05:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\jgPepdt.exe\" mP /dDsite_idArb 385118 /S" /V1 /F6⤵
- Creates scheduled task(s)
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001107001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1001107001\jok.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1001108001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1001108001\swiiii.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3216 -ip 32161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 3472 -ip 34721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2508 -ip 25081⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4020 -ip 40201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4636 -ip 46361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5908 -ip 59081⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
CBFIIEHJ
DAKJDHIE
mozglue.dll
nss3.dll
powershell.exe.log
StartupProfileData-NonInteractive
Assistant_108.0.5067.20_Setup.exe_sfx.exe
opera_package
explorgu.exe
alexxxxxxxx.exe
32456.exe
goldprimeldlldf.exe
NewB.exe
swiiiii.exe
koooooo.exe
random.exe
file300un.exe
jok.exe
swiiii.exe
Install.exe
Opera_installer_2404090303439302236.dll
Tmp41E6.tmp
RevokeSuspend.docx
__PSScriptPolicyTest_43m2jf4e.xuq.ps1
ioloDMLog.txt
ioloDMLog.txt
tmp9FF6.tmp
tmpA345.tmp
u1xo.0.exe
u1xo.1.exe
clip64.dll
cred64.dll
76b53b3ec448f7ccdda2063b15d2bfc3_df7b5384-656a-413f-b3b1-18a65d99c2a7
Traffic.exe
propro.exe
Microsoft Edge.lnk
Microsoft Edge.lnk
65LcdPI8as63aWI6EyWdkVf4.exe
EYbd4sX16XKKuJ2RcMMOwSzE.exe
btdrJ9aA3vCWmoIb53BK62YD.exe
e30KlfbDfDPbxq8TZeHHtMWH.exe
feWkxEQN74SEw0JlYNDaNkP8.exe
gSJmgoJP9HcKOdu2QCjKzG9F.exe
Google Chrome.lnk
Google Chrome.lnk
gpt.ini
memory/1172-6-0x00000000053A0000-0x00000000053A1000-memory.dmp
memory/1172-5-0x0000000005360000-0x0000000005361000-memory.dmp
memory/1172-1-0x0000000077626000-0x0000000077628000-memory.dmp
memory/1172-2-0x0000000000B90000-0x0000000001032000-memory.dmp
memory/1172-4-0x0000000005380000-0x0000000005381000-memory.dmp
memory/1172-3-0x0000000005370000-0x0000000005371000-memory.dmp
memory/1172-7-0x0000000005340000-0x0000000005341000-memory.dmp
memory/1172-8-0x0000000005350000-0x0000000005351000-memory.dmp
memory/1172-0-0x0000000000B90000-0x0000000001032000-memory.dmp
memory/1172-9-0x0000000005390000-0x0000000005391000-memory.dmp
memory/1172-10-0x00000000053C0000-0x00000000053C1000-memory.dmp
memory/1172-11-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/1172-16-0x0000000000B90000-0x0000000001032000-memory.dmp
memory/1588-217-0x0000000000400000-0x000000000044C000-memory.dmp
memory/1588-240-0x0000000000400000-0x000000000044C000-memory.dmp
memory/1588-241-0x0000000000E10000-0x0000000000E11000-memory.dmp
memory/1588-229-0x0000000000400000-0x000000000044C000-memory.dmp
memory/1940-623-0x0000000000EB0000-0x0000000001435000-memory.dmp
memory/1940-453-0x0000000000EB0000-0x0000000001435000-memory.dmp
memory/2024-102-0x0000000072FE0000-0x0000000073791000-memory.dmp
memory/2024-84-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2024-101-0x0000000005700000-0x0000000005710000-memory.dmp
memory/2024-243-0x0000000005700000-0x0000000005710000-memory.dmp
memory/2064-708-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/2064-577-0x0000000000400000-0x000000000063B000-memory.dmp
memory/2064-567-0x0000000000400000-0x000000000063B000-memory.dmp
memory/2460-71-0x00007FFF03AF0000-0x00007FFF045B2000-memory.dmp
memory/2460-72-0x000000001B1A0000-0x000000001B1B0000-memory.dmp
memory/2460-654-0x000000001B2A0000-0x000000001B453000-memory.dmp
memory/2460-248-0x000000001B2A0000-0x000000001B453000-memory.dmp
memory/2460-70-0x00000000003F0000-0x0000000000472000-memory.dmp
memory/2460-173-0x00007FFF03AF0000-0x00007FFF045B2000-memory.dmp
memory/3116-106-0x0000000000FF0000-0x0000000001492000-memory.dmp
memory/3116-295-0x0000000000FF0000-0x0000000001492000-memory.dmp
memory/3116-441-0x0000000000FF0000-0x0000000001492000-memory.dmp
memory/3116-19-0x0000000000FF0000-0x0000000001492000-memory.dmp
memory/3116-20-0x0000000000FF0000-0x0000000001492000-memory.dmp
memory/3116-188-0x0000000000FF0000-0x0000000001492000-memory.dmp
memory/3116-600-0x0000000000FF0000-0x0000000001492000-memory.dmp
memory/3116-100-0x0000000000FF0000-0x0000000001492000-memory.dmp
memory/3116-22-0x0000000005980000-0x0000000005981000-memory.dmp
memory/3116-23-0x00000000059C0000-0x00000000059C1000-memory.dmp
memory/3116-28-0x00000000059E0000-0x00000000059E1000-memory.dmp
memory/3116-21-0x0000000005990000-0x0000000005991000-memory.dmp
memory/3116-25-0x0000000005970000-0x0000000005971000-memory.dmp
memory/3116-24-0x0000000005960000-0x0000000005961000-memory.dmp
memory/3116-26-0x00000000059A0000-0x00000000059A1000-memory.dmp
memory/3116-27-0x00000000059F0000-0x00000000059F1000-memory.dmp
memory/3216-247-0x0000000002E90000-0x0000000004E90000-memory.dmp
memory/3216-205-0x0000000000C50000-0x0000000000CA2000-memory.dmp
memory/3216-238-0x0000000072FE0000-0x0000000073791000-memory.dmp
memory/3324-110-0x0000000000400000-0x0000000000450000-memory.dmp
memory/3324-137-0x0000000005360000-0x0000000005906000-memory.dmp
memory/3324-196-0x0000000005F20000-0x0000000005F6C000-memory.dmp
memory/3324-154-0x00000000050A0000-0x00000000050B0000-memory.dmp
memory/3324-152-0x0000000005010000-0x000000000501A000-memory.dmp
memory/3324-157-0x0000000006340000-0x0000000006958000-memory.dmp
memory/3324-153-0x0000000072FE0000-0x0000000073791000-memory.dmp
memory/3324-186-0x0000000005EE0000-0x0000000005F1C000-memory.dmp
memory/3324-145-0x0000000004E60000-0x0000000004EF2000-memory.dmp
memory/3324-176-0x0000000005E80000-0x0000000005E92000-memory.dmp
memory/3324-170-0x0000000008410000-0x000000000851A000-memory.dmp
memory/3524-57-0x0000000000C70000-0x0000000000E2C000-memory.dmp
memory/3524-230-0x0000000003470000-0x0000000005470000-memory.dmp
memory/3524-68-0x0000000005AA0000-0x0000000005AB0000-memory.dmp
memory/3524-58-0x0000000072FE0000-0x0000000073791000-memory.dmp
memory/3524-89-0x0000000003470000-0x0000000005470000-memory.dmp
memory/3524-96-0x0000000072FE0000-0x0000000073791000-memory.dmp
memory/3856-136-0x0000000072FE0000-0x0000000073791000-memory.dmp
memory/3856-108-0x0000000004F60000-0x0000000004F70000-memory.dmp
memory/3856-105-0x0000000072FE0000-0x0000000073791000-memory.dmp
memory/3856-104-0x0000000000680000-0x00000000006FA000-memory.dmp
memory/3856-146-0x00000000029C0000-0x00000000049C0000-memory.dmp
memory/4008-269-0x0000000000400000-0x000000000044C000-memory.dmp
memory/4008-263-0x0000000000400000-0x000000000044C000-memory.dmp
memory/4300-197-0x00000000006D0000-0x000000000075C000-memory.dmp
memory/4300-535-0x000000001B4E0000-0x000000001B693000-memory.dmp
memory/4300-198-0x00007FFF03AF0000-0x00007FFF045B2000-memory.dmp
memory/4300-271-0x000000001B4E0000-0x000000001B693000-memory.dmp
memory/4380-155-0x0000000000B60000-0x0000000000BB2000-memory.dmp
memory/4380-200-0x0000000006860000-0x000000000687E000-memory.dmp
memory/4380-175-0x0000000005B00000-0x0000000005B76000-memory.dmp
memory/4380-174-0x00000000058F0000-0x0000000005900000-memory.dmp
memory/4380-156-0x0000000072FE0000-0x0000000073791000-memory.dmp
memory/4728-680-0x00007FFF24ED0000-0x00007FFF24ED2000-memory.dmp
memory/4728-700-0x00007FFF22B60000-0x00007FFF22B62000-memory.dmp
memory/4728-709-0x00007FFF22B70000-0x00007FFF22B72000-memory.dmp
memory/4728-693-0x00007FFF23F30000-0x00007FFF23F32000-memory.dmp
memory/4728-686-0x00007FFF23F20000-0x00007FFF23F22000-memory.dmp
memory/4728-682-0x00007FFF24EE0000-0x00007FFF24EE2000-memory.dmp
memory/4812-438-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4952-339-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-326-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-341-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-347-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-336-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-332-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-333-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-328-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-329-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-349-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-362-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-351-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-331-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-330-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-327-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-344-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-324-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-322-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-320-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-318-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-301-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-297-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-294-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-291-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-292-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-290-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-282-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-281-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-260-0x0000000000400000-0x0000000000981000-memory.dmp
memory/4952-255-0x0000000000400000-0x0000000000981000-memory.dmp