Overview

overview

10

Static

static

10

14052163e5...43.exe

windows7-x64

10

14052163e5...43.exe

windows10-1703-x64

10

14052163e5...43.exe

windows10-2004-x64

10

14052163e5...43.exe

windows11-21h2-x64

10

Antimalwar...ble.js

windows7-x64

8

Antimalwar...ble.js

windows10-1703-x64

8

Antimalwar...ble.js

windows10-2004-x64

8

Antimalwar...ble.js

windows11-21h2-x64

8

EmbraTor M...et.exe

windows7-x64

1

EmbraTor M...et.exe

windows10-1703-x64

1

EmbraTor M...et.exe

windows10-2004-x64

1

EmbraTor M...et.exe

windows11-21h2-x64

1

Java Install.jar

windows7-x64

1

Java Install.jar

windows10-1703-x64

7

Java Install.jar

windows10-2004-x64

7

Java Install.jar

windows11-21h2-x64

7

MsMpEng.js

windows7-x64

10

MsMpEng.js

windows10-1703-x64

9

MsMpEng.js

windows10-2004-x64

10

MsMpEng.js

windows11-21h2-x64

10

Windows Dr...on.vbs

windows7-x64

10

Windows Dr...on.vbs

windows10-1703-x64

10

Windows Dr...on.vbs

windows10-2004-x64

10

Windows Dr...on.vbs

windows11-21h2-x64

10

Resubmissions

09-04-2024 13:34

240409-qvlrtabe9s 10

09-04-2024 13:34

240409-qvk6aabe81 10

09-04-2024 13:33

240409-qthzjabe5z 10

09-04-2024 13:33

240409-qthc1abe5y 10

07-07-2023 11:45

230707-nw632ahf6w 10

Analysis

  • max time kernel
    1197s
  • max time network
    1199s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14-04-2024 10:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    14052163e50c197697c64b143.exe

  • Size

    17.6MB

  • MD5

    14052163e50c197697c64b1431b42271

  • SHA1

    df301332faa73c3d5f915fde61df2fc9de21a61a

  • SHA256

    4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778

  • SHA512

    124f6fb9812fe56fc9428a53206e67ada7a5221bbac08204c52fc9df970a492f133ac3911b1cfd2a76c58b8921580f58b2f8d32db7395442549bdfefafc3bfab

  • SSDEEP

    393216:LOh37DR+wwmOoDxRz016TCORfagi8boLH6fQmQa9T1AE0Grq:g/FRxRzlRfPeLajLlg

Score
10/10
strratevasionpersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

rar.ydns.eu:9999

svchost.ydns.eu:10000
Attributes
  • license_id

    khonsari

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    false

  • secondary_startup

    false

  • startup

    true

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://files.catbox.moe/fvl5hy.jpg

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

    trojanstealerstrrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Blocklisted process makes network request 40 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 56 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 14 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 17 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe
    "C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Antimalware Service Executable.JS"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1296
      • C:\Windows\SysWOW64\wscript.exe
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.JS"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        • Adds Run key to start application
        PID:2460
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MsMpEng.js"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2960
      • C:\Users\Admin\AppData\Local\Temp\x.exe
        "C:\Users\Admin\AppData\Local\Temp\x.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1856
        • C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
          C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1840
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2580
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
            5⤵
            • Creates scheduled task(s)
            PID:2992
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\x.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\x.exe" exit)
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1316
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 0
            5⤵
            • Delays execution with timeout.exe
            PID:1552
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\ProgramData\rrrrrrrr.ps1"
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2504
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Java Install.jar"
      2⤵
        PID:2668
      • C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe
        "C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2472
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {C2D580E4-8650-4C35-BF11-7BF94CEC4A3D} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1964
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2872
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
            7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2816
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfig
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2824
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1952
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:676
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2896
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2084
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1320
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2464
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2104
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2792
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2324
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2960
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2244
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2852
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2840
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1576
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          PID:1548
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2788
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:2012
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:688
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          PID:2556
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:2700
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:3056
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          PID:1316
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:1820
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          PID:1120
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:1716
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:2024
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:1580
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          PID:2748
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:1796
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:2008
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          PID:2196
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:2132
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:848
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          PID:1512
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:1760
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          PID:2304
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:1824
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:1364
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          PID:2740
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:2480
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          PID:2088
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:1644
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:1652
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          PID:2868
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:2432
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:1956
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          PID:3044
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:2944
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:2832

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\rrrrrrrr.ps1
      Filesize

      437B

      MD5

      3ad705568172956efe092dfac809642c

      SHA1

      d34bfb981dd4478998ec767879ea00cd6406c496

      SHA256

      4247e7a94a7fd5e4266622a37d91770dfedb12587aff4c2ece7812c56bd2c1fb

      SHA512

      ef89e5b7eec05f3d9bbd2ab1fdd011c0917ef6241f6f0afba139860578498971559e2c66041c70b28a91fb09fdbb67eeee1d8a75179c65949028b45ecc813f97

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\32.exe
      Filesize

      7.4MB

      MD5

      7f9e6ee81558b38fbe276f60949d38b9

      SHA1

      6358b944b0515b04da8fe7fda7dc3dbbfb82423c

      SHA256

      6cd0a0976cff64c5287c166b73e5c877f026274f85599344756c47e9aa756bcb

      SHA512

      960966cc6254f15d5653ec9dbfe0fdc6725f2c1209b4ddb8b1c68d8f646521340f91029a53a5c8c60c9f813f3fe3e83644b052913178ac75886ccbd894be9ce3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\64.exe
      Filesize

      8.4MB

      MD5

      a2a5a9b937771a4b82694c844fd27e36

      SHA1

      402e2f7bfe1f24d6ea048d58bf156676132f515d

      SHA256

      390126ab71cd12f414f4200cc246d5283c534ab216794ce9980048779960ea68

      SHA512

      d352b147c8f045f9931725d25166916ce081ac5cf251f2987fb011deed2e8d3e08f91dbce8a2464abab5561b7915d69cbb7a0d02437b30b6fd3d5622621149e1

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Antimalware Service Executable.JS
      Filesize

      713KB

      MD5

      c958a31d5e439d5b0d01900e5a85992a

      SHA1

      fc40d0ef637fe55fbaf83e8f4891e008ac736df6

      SHA256

      e3a33757c2e596f7ee50a4a41ff58f2e64dbdb062257fe5749ca19b955b0baaf

      SHA512

      2aa0c813b7c17b01e1c18a3a12fb4f3c8ba9c9fee79a3ed66421959fd0440571e0cba5e90569970655342ce2730e823feae23ef6c5da09248f3da68fc0f3cf1c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt
      Filesize

      14.6MB

      MD5

      cfe4b8f7535c958ea26cde6f32b559aa

      SHA1

      253ba3372c6c0b1c301f6e968c4fb7d5ffd696d0

      SHA256

      0afc8b7c47f48ef991535d435d48411ea12c4b98f14253a27b15ec6d7f020620

      SHA512

      01e8862cb7c1a3b247d09ca8e9f94c40232aaed93ab9f1937de0f69f83ba3d32926b6289b7bc5b8ae2bb06876b915a50ed65bb8ba10ffadcbbee579ce968bd39

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Java Install.jar
      Filesize

      92KB

      MD5

      c55f9247eb8ea19af96292f0893f86b5

      SHA1

      bd5e6884b8151114af7e45a92525893f4d2aaabd

      SHA256

      16ed7004aa68efab0eda75b3f9bff11508365a4224ef859c91f93029bc441284

      SHA512

      3efab4ee9e3c9d81efd4e2f164c0a2ae72f688cbd0068cc44a063bf4787ba65b8d2a644ac2f7704fbd059d0ba96665aeff46c2bfba820fb42df06eea7e87ccdb

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MsMpEng.js
      Filesize

      24.2MB

      MD5

      690d57b0d8670391bad0876cae078bab

      SHA1

      32bea01d606128c606b71e19920099c6cb15030f

      SHA256

      b27dd5407a22c8df93090fbc1a3eb93c6461f4a279cfabd87b4b21e246bda458

      SHA512

      dd113765cd5cfeb99a98775c3c8e265463fca7863ffa519dcb7175312bbbeb4ea24ca45b4cef0320b430d413c020970346f4db671e0730e9e044cd2585f71fd4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml
      Filesize

      2KB

      MD5

      9160347bec74471e1a79edfd950629ae

      SHA1

      c149a7e5aab6e349a70b7b458d0eaaa9d301c790

      SHA256

      0fe356f3d04bb43f772604b049fd2b20f3038ca2ce84bf9778b8ccdd481d77ab

      SHA512

      b8061834f658567a1e742496c38688bdecd60191a92163d47470f64aa1fba23e92dd36fa1d2bb7efa36f14002c0606013973718b9f107e62d845a17be4b0d358

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs
      Filesize

      984B

      MD5

      df00d1e54f85ae90f2f69b73a34c90f4

      SHA1

      1d3e521a8efc17334f4f578432d5af0bb1ef1951

      SHA256

      2c5907389d374ed9efb86194a7f0f954349c93a7bc67b99c3d6b59bfc0d8296c

      SHA512

      5636973f61dd7cce413049f246b5ede00c736f4ac333508a2176b65524327080e17ac97260cbe908fc2d0b18235ee6d7f7a74c808a7ceaddb9ee6518452fa618

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\asacpiex.dll
      Filesize

      14.6MB

      MD5

      2380aed7f261148fdb35af6688e408ee

      SHA1

      fa359778d16c934ba96b96f3c6c17a10a9e266b0

      SHA256

      12afa4813940c6985259f487d5e2892550596a60c6c77f806aefa2c254c74bb4

      SHA512

      646bdbc4f01991460755c6a2c2dbbca0a0170c83d06050ba50ec1b5406d58f8035498c84462dd9e6ab1d695b8854e2f4734d64ec2f4ab1083371fd145963bb85

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp
      Filesize

      2.5MB

      MD5

      54183220aa6c777f8228474ff5b5df01

      SHA1

      ed438f17bffb37d42afd61d8dcef0c50d554c65c

      SHA256

      9a78c80e93bd1ed3d71eb090465e39a69470cd1812fc5e169d8b412e8c665963

      SHA512

      70b1e22449c5264bed46b62595206e3ad36e2a9c33fa9589acb792d499dcbbae5ebdbf3b35c140e72a7d594f807a6ce1ab925736b5e1a07c17a26445a2591987

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdesc-consensus.tmp
      Filesize

      2.7MB

      MD5

      9b2986911dd53fdda3a049f80e2fe4c8

      SHA1

      2e9e3f7bd2ed141fcedfd8c9caa787b04a96db67

      SHA256

      1baf86a01a45e998d4e94c0c85c8bd5a7058693fe4587e2ada13eebec809ff2d

      SHA512

      45e8cb3eeff3b2b2d3f0dd5f124fdf660698ccba9a346bcc502b7672bc65ca30f0fa507a4b69eb1dda7fe9b033b9abb1ea4a6d914c8b7b395a6220cf21af9187

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdescs.new
      Filesize

      5.0MB

      MD5

      42b2655933a8af67e94ad90d42ee44e2

      SHA1

      a963fa0bf20a41ab9823744c6a09bb5baa35d466

      SHA256

      fe7770e6e5902ae1f7c482a502fd6cde040a658c4472cb67293957e556d8bdf6

      SHA512

      0644e050e6f5e22bcf774a6668a518123cc91ff6449af84724491c275bfada61653b9658b5ac6d225ad9377ba0dad9d18d648893673d06605f35bee31a6fc294

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
      Filesize

      4.3MB

      MD5

      9f2d86da7d58a70b0003307d9cfc2438

      SHA1

      bd69ad6ea837e309232d7c4fd0e87e22c3266ac5

      SHA256

      7052619814a614a1b157c5c94a92dbec22b425a0977ac8b21958b8db81e2dd65

      SHA512

      ce345ff77d8043f416a04b782be8e7b0d5fdea933f3ac79abb88648a9fca23d7a69f537a825d0b636ba64f80afe70f758114ddbf412bd9398800ba4b6e359a99

      Download Submit

    • \Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
      Filesize

      722KB

      MD5

      43141e85e7c36e31b52b22ab94d5e574

      SHA1

      cfd7079a9b268d84b856dc668edbb9ab9ef35312

      SHA256

      ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d

      SHA512

      9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc

      Download Submit

    • \Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe
      Filesize

      1012KB

      MD5

      5d57e6b8aff1ec900f553789f6796648

      SHA1

      f9a953cfe6decb237ed98c30faabec8654d99171

      SHA256

      3863d2cab19dba2988e33810d9235e0f04aee019b696e4fdf4cf637b3072b19d

      SHA512

      d66a6a97c5b3bb23df2b549af8dd6e2c201d0cdb08a2a4026bfbf831652ba5c8f133beba13f64426f1bdaf6cca83c4e54de8099ea0e02ac7a6c91f35d68f4915

      Download Submit

    • \Users\Admin\AppData\Local\Temp\x.exe
      Filesize

      18.1MB

      MD5

      efcd72ad2d3430248a68e5f960ed5e2b

      SHA1

      58cc7d2732f401b99926211c0dab319dfc0bba1a

      SHA256

      41686ad9f581037f44b72b37f8bee562512854fc6807c5a13ea1646cdeab61c8

      SHA512

      d50dd3628e0ed5b6040545e1a1836ffcdde30c4748b220efb7df29aa139b22b814d2466d6808c8dc3af765b9ce8092582720f69187a6562eefd6fca4cb9670e5

      Download Submit

    • memory/1856-90-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/1856-91-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/1856-71-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/1856-75-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/1856-81-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/1856-112-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/1856-86-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/1856-87-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/1856-108-0x0000000001900000-0x0000000001901000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1856-59-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/1856-57-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/1856-105-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/1856-92-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/1856-99-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/1856-70-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/1856-100-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/1856-104-0x00000000001C0000-0x00000000013E6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/2504-56-0x00000000027B0000-0x00000000027F0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2504-48-0x00000000027B0000-0x00000000027F0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2504-88-0x0000000073450000-0x00000000739FB000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2504-40-0x00000000027B0000-0x00000000027F0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2504-39-0x0000000073450000-0x00000000739FB000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2504-43-0x0000000073450000-0x00000000739FB000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2668-55-0x0000000002560000-0x0000000005560000-memory.dmp

      Filesize

      48.0MB

      Download

    • memory/2668-198-0x0000000000130000-0x0000000000131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2668-208-0x0000000000130000-0x0000000000131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2668-209-0x0000000000130000-0x0000000000131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2668-212-0x0000000000130000-0x0000000000131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2668-49-0x0000000000130000-0x0000000000131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2668-60-0x0000000000130000-0x0000000000131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2816-183-0x0000000000060000-0x0000000000183000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2816-224-0x0000000000060000-0x0000000000183000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2816-175-0x000007FFFFFDC000-0x000007FFFFFDD000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2816-257-0x0000000000060000-0x0000000000183000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2816-171-0x0000000000060000-0x0000000000183000-memory.dmp

      Filesize

      1.1MB

      Download