eternity | 88283c1be1298e5884b5cbfc02999df22d12365512f4b5133a71d219b3aa631d

Analysis

max time kernel
99s
max time network
154s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
Size

455KB
MD5

c8d9593196962fa5d706a207c16674cd
SHA1

686a8e674e6615d5cd91f7b2cba0c755054b3f69
SHA256

a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d
SHA512

5ddae80780c6091bfe0ab5e29bc63732c08ce34f677fc341366dcecf6db9e1bd2e0ed24cfe57eface0d19c6f46010f47eb2d74888b91a503dae00651c4a756bf
SSDEEP

12288:XcTpGLwWpFGIWFfDtaY4S0LEy7w0iymL/:XOpEwiFYxsEyHiyK

Score

10^/10

eternity xworm evasion persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.1

104.194.9.116:7000

Mutex

bUezpCDHVjUVS3W9

Attributes

install_file
USB.exe
telegram
https://api.telegram.org/bot6330888131:AAE5ycZdHuNqV5SVYhHeCfRENn6GuCjwXjs/sendMessage?chat_id=1046049845

aes.plain

Extracted

Family

eternity

Wallets

47vk9PbPuHnEnazCn4tLpwPCWRLSMhpX9PD8WqpjchhTXisimD6j8EvRFDbPQHKUmHVq3vAM3DLytXLg8CqcdRXRFdPe92Q

Attributes

payload_urls
https://raw.githubusercontent.com/VolVeRFM/SilentMiner-VolVeR/main/VolVeRBuilder/Resources/xmrig.exe

Signatures

Detect Xworm Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1764-6-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/1764-7-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/1764-9-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/1764-11-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/1764-13-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/1764-15-0x00000000005E0000-0x0000000000620000-memory.dmp	family_xworm

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\GVKQGWZS\ImagePath = "C:\\ProgramData\\jjfvbumjfczj\\oapavmkbdsqp.exe"	services.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 5 IoCs

pid	Process
1020	zgxyut.exe
2220	jdrflx.exe
2400	AddInProcess32.exe
3048	cqicha.exe
2324	AddInProcess32.exe

Loads dropped DLL 17 IoCs

pid	Process
1764	CasPol.exe
1764	CasPol.exe
1764	CasPol.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
3020	cmd.exe
1764	CasPol.exe
2948	WerFault.exe
2948	WerFault.exe
2948	WerFault.exe
2948	WerFault.exe
2948	WerFault.exe
468	services.exe
468	services.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	jdrflx.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2876 set thread context of 1764	2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe	28
PID 1020 set thread context of 1812	1020	zgxyut.exe	37
PID 3048 set thread context of 2456	3048	cqicha.exe	52
PID 2220 set thread context of 2056	2220	jdrflx.exe	75
PID 2456 set thread context of 2344	2456	vbc.exe	80

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\wusa.lock	wusa.exe

Launches sc.exe 13 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1500	sc.exe
340	sc.exe
1056	sc.exe
880	sc.exe
744	sc.exe
1644	sc.exe
656	sc.exe
968	sc.exe
708	sc.exe
2624	sc.exe
2064	sc.exe
2304	sc.exe
2168	sc.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1480	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3068	PING.EXE

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
2220	jdrflx.exe
2956	powershell.exe
2220	jdrflx.exe
2220	jdrflx.exe
2220	jdrflx.exe
2220	jdrflx.exe
2220	jdrflx.exe
2220	jdrflx.exe
2220	jdrflx.exe
2220	jdrflx.exe
2220	jdrflx.exe
2220	jdrflx.exe
2220	jdrflx.exe
2220	jdrflx.exe
2220	jdrflx.exe
2056	dialer.exe
2056	dialer.exe
2056	dialer.exe
2056	dialer.exe
2456	vbc.exe
2456	vbc.exe
2344	dialer.exe
2344	dialer.exe
2220	jdrflx.exe
2220	jdrflx.exe
2456	vbc.exe
2344	dialer.exe
2344	dialer.exe
2456	vbc.exe
2456	vbc.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
Token: SeDebugPrivilege	1764	CasPol.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeShutdownPrivilege	1280	powercfg.exe
Token: SeShutdownPrivilege	1524	powercfg.exe
Token: SeShutdownPrivilege	1660	powercfg.exe
Token: SeShutdownPrivilege	1664	powercfg.exe
Token: SeDebugPrivilege	2056	dialer.exe
Token: SeDebugPrivilege	2344	dialer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1764	2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe	28
PID 2876 wrote to memory of 1764	2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe	28
PID 2876 wrote to memory of 1764	2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe	28
PID 2876 wrote to memory of 1764	2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe	28
PID 2876 wrote to memory of 1764	2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe	28
PID 2876 wrote to memory of 1764	2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe	28
PID 2876 wrote to memory of 1764	2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe	28
PID 2876 wrote to memory of 1764	2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe	28
PID 2876 wrote to memory of 1764	2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe	28
PID 2876 wrote to memory of 2148	2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe	29
PID 2876 wrote to memory of 2148	2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe	29
PID 2876 wrote to memory of 2148	2876	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe	29
PID 1764 wrote to memory of 1020	1764	CasPol.exe	31
PID 1764 wrote to memory of 1020	1764	CasPol.exe	31
PID 1764 wrote to memory of 1020	1764	CasPol.exe	31
PID 1764 wrote to memory of 1020	1764	CasPol.exe	31
PID 1764 wrote to memory of 2220	1764	CasPol.exe	34
PID 1764 wrote to memory of 2220	1764	CasPol.exe	34
PID 1764 wrote to memory of 2220	1764	CasPol.exe	34
PID 1764 wrote to memory of 2220	1764	CasPol.exe	34
PID 1020 wrote to memory of 1548	1020	zgxyut.exe	35
PID 1020 wrote to memory of 1548	1020	zgxyut.exe	35
PID 1020 wrote to memory of 1548	1020	zgxyut.exe	35
PID 1020 wrote to memory of 1548	1020	zgxyut.exe	35
PID 1020 wrote to memory of 1300	1020	zgxyut.exe	36
PID 1020 wrote to memory of 1300	1020	zgxyut.exe	36
PID 1020 wrote to memory of 1300	1020	zgxyut.exe	36
PID 1020 wrote to memory of 1300	1020	zgxyut.exe	36
PID 1020 wrote to memory of 1300	1020	zgxyut.exe	36
PID 1020 wrote to memory of 1300	1020	zgxyut.exe	36
PID 1020 wrote to memory of 1300	1020	zgxyut.exe	36
PID 1020 wrote to memory of 1812	1020	zgxyut.exe	37
PID 1020 wrote to memory of 1812	1020	zgxyut.exe	37
PID 1020 wrote to memory of 1812	1020	zgxyut.exe	37
PID 1020 wrote to memory of 1812	1020	zgxyut.exe	37
PID 1020 wrote to memory of 1812	1020	zgxyut.exe	37
PID 1020 wrote to memory of 1812	1020	zgxyut.exe	37
PID 1020 wrote to memory of 1812	1020	zgxyut.exe	37
PID 1020 wrote to memory of 1812	1020	zgxyut.exe	37
PID 1020 wrote to memory of 1812	1020	zgxyut.exe	37
PID 1020 wrote to memory of 1320	1020	zgxyut.exe	38
PID 1020 wrote to memory of 1320	1020	zgxyut.exe	38
PID 1020 wrote to memory of 1320	1020	zgxyut.exe	38
PID 1812 wrote to memory of 3020	1812	AddInProcess32.exe	39
PID 1812 wrote to memory of 3020	1812	AddInProcess32.exe	39
PID 1812 wrote to memory of 3020	1812	AddInProcess32.exe	39
PID 1812 wrote to memory of 3020	1812	AddInProcess32.exe	39
PID 3020 wrote to memory of 2256	3020	cmd.exe	41
PID 3020 wrote to memory of 2256	3020	cmd.exe	41
PID 3020 wrote to memory of 2256	3020	cmd.exe	41
PID 3020 wrote to memory of 2256	3020	cmd.exe	41
PID 3020 wrote to memory of 3068	3020	cmd.exe	42
PID 3020 wrote to memory of 3068	3020	cmd.exe	42
PID 3020 wrote to memory of 3068	3020	cmd.exe	42
PID 3020 wrote to memory of 3068	3020	cmd.exe	42
PID 3020 wrote to memory of 1480	3020	cmd.exe	43
PID 3020 wrote to memory of 1480	3020	cmd.exe	43
PID 3020 wrote to memory of 1480	3020	cmd.exe	43
PID 3020 wrote to memory of 1480	3020	cmd.exe	43
PID 3020 wrote to memory of 2400	3020	cmd.exe	44
PID 3020 wrote to memory of 2400	3020	cmd.exe	44
PID 3020 wrote to memory of 2400	3020	cmd.exe	44
PID 3020 wrote to memory of 2400	3020	cmd.exe	44
PID 1764 wrote to memory of 3048	1764	CasPol.exe	48

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:424

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Sets service image path in registry
- Loads dropped DLL
PID:468
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:584
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:660
- C:\ProgramData\xlffyhztkvzk\pkiwizgebqxq.exe
  C:\ProgramData\xlffyhztkvzk\pkiwizgebqxq.exe
  2⤵
  PID:2828

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:484

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:492

C:\Users\Admin\AppData\Local\Temp\a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
"C:\Users\Admin\AppData\Local\Temp\a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Users\Admin\AppData\Local\Temp\zgxyut.exe
    "C:\Users\Admin\AppData\Local\Temp\zgxyut.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      4⤵
      PID:1548
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      4⤵
      PID:1300
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1812
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "AddInProcess32" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\AddInProcess32.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\AddInProcess32.exe"
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3020
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2256
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:3068
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "AddInProcess32" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\AddInProcess32.exe" /rl HIGHEST /f
        6⤵
        Creates scheduled task(s)
        
        PID:1480
      - C:\Users\Admin\AppData\Local\ServiceHub\AddInProcess32.exe
        
        "C:\Users\Admin\AppData\Local\ServiceHub\AddInProcess32.exe"
        6⤵
        Executes dropped EXE
        
        PID:2400
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1020 -s 2136
      4⤵
      Loads dropped DLL
      PID:1320
- - C:\Users\Admin\AppData\Local\Temp\jdrflx.exe
    "C:\Users\Admin\AppData\Local\Temp\jdrflx.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:2220
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:2272
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        Drops file in Windows directory
        
        PID:2692
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:744
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:1644
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:656
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:968
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:708
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1664
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1660
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1524
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1280
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2056
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "AHIMMUFK"
      4⤵
      Launches sc.exe
      PID:2064
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "AHIMMUFK" binpath= "C:\ProgramData\xlffyhztkvzk\pkiwizgebqxq.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:2624
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:2168
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "AHIMMUFK"
      4⤵
      Launches sc.exe
      PID:880
- - C:\Users\Admin\AppData\Local\Temp\cqicha.exe
    "C:\Users\Admin\AppData\Local\Temp\cqicha.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3048
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      PID:2456
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "GVKQGWZS"
        5⤵
        Launches sc.exe
        
        PID:1500
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "GVKQGWZS" binpath= "C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:340
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        5⤵
        Launches sc.exe
        
        PID:2304
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "GVKQGWZS"
        5⤵
        Launches sc.exe
        
        PID:1056
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3048 -s 716
      4⤵
      Loads dropped DLL
      PID:2948
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2876 -s 740
  2⤵
  PID:2148

C:\Windows\system32\taskeng.exe
taskeng.exe {1F01FF76-D053-4A54-A628-3B00B531A74A} S-1-5-21-2610426812-2871295383-373749122-1000:UEITMFAB\Admin:Interactive:[1]
1⤵
PID:2704
- C:\Users\Admin\AppData\Local\ServiceHub\AddInProcess32.exe
  C:\Users\Admin\AppData\Local\ServiceHub\AddInProcess32.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Users\Admin\AppData\Local\ServiceHub\AddInProcess32.exe
  C:\Users\Admin\AppData\Local\ServiceHub\AddInProcess32.exe
  2⤵
  PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ServiceHub\AddInProcess32.exe

Filesize
41KB

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
\Users\Admin\AppData\Local\Temp\cqicha.exe

Filesize
3.1MB

MD5
f3e70f68d7e2f644bcd312f1333094e1

SHA1
259dd00ddb8a08fb149c37254bfb865a74bb11b9

SHA256
6607d552accc951f2cd068bb394200987d7d1e90e34f8cdab3afe6e3ccedee4e

SHA512
425d60775735804dce4a43aba0426966cc21ef5c0c997d073bc3d0740d3a07b13227fd1e5be93189079e8e01ca0c515d27ddc0451ee4e514e02bdc3bd8f4d33d

Download Submit
\Users\Admin\AppData\Local\Temp\jdrflx.exe

Filesize
2.8MB

MD5
21b6c5c3b7e13ca225dc53324af1cf1d

SHA1
1903cba2906b60ba1a473049abd3c8abd0175b3c

SHA256
1d3c862f7876ed0210cc2672c543d407638230d3651dc5a5f63247556c54df39

SHA512
d05bf8554a98af622c8d80ffc1035c4d9fc8e20a08c10255282adb5bbb2e2b84553106aeba6ce6e099d97c1c6a4cc4f89f9b411d0d31ca88d8249dd791b7e254

Download Submit
\Users\Admin\AppData\Local\Temp\zgxyut.exe

Filesize
393KB

MD5
3f3a51617811e9581aba50376599efa6

SHA1
9b26aa73f43a4db9b216b90d1aa3e2e4d602fde8

SHA256
5f3403e13e316d9320d46233e9f62b183623c46ec80c6c55139efdd72c5ada37

SHA512
9ad5cfb29281dd462b726c7ee239926f83050181fe4f6c3e9057e51df65ae7f850cecbf1cb453287720314275335df36bb8d5299d09a1f73329a5b9292db3ee3

Download Submit
memory/424-594-0x00000000374A0000-0x00000000374B0000-memory.dmp

Filesize
64KB

Download
memory/424-586-0x000007FEBF6C0000-0x000007FEBF6D0000-memory.dmp

Filesize
64KB

Download
memory/424-582-0x0000000000910000-0x000000000093B000-memory.dmp

Filesize
172KB

Download
memory/424-581-0x0000000000730000-0x0000000000754000-memory.dmp

Filesize
144KB

Download
memory/424-579-0x0000000000730000-0x0000000000754000-memory.dmp

Filesize
144KB

Download
memory/1020-61-0x000000001ABF0000-0x000000001AC12000-memory.dmp

Filesize
136KB

Download
memory/1020-27-0x0000000001E80000-0x0000000001F00000-memory.dmp

Filesize
512KB

Download
memory/1020-68-0x000000001B5F0000-0x000000001B68C000-memory.dmp

Filesize
624KB

Download
memory/1020-79-0x000000001B340000-0x000000001B35A000-memory.dmp

Filesize
104KB

Download
memory/1020-78-0x000000001ABC0000-0x000000001ABDA000-memory.dmp

Filesize
104KB

Download
memory/1020-77-0x000000001AC20000-0x000000001AC42000-memory.dmp

Filesize
136KB

Download
memory/1020-76-0x000000001ABC0000-0x000000001ABE2000-memory.dmp

Filesize
136KB

Download
memory/1020-75-0x000000001AA00000-0x000000001AA08000-memory.dmp

Filesize
32KB

Download
memory/1020-74-0x000000001A570000-0x000000001A578000-memory.dmp

Filesize
32KB

Download
memory/1020-26-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/1020-25-0x0000000000370000-0x000000000037E000-memory.dmp

Filesize
56KB

Download
memory/1020-67-0x000000001B9A0000-0x000000001BA1C000-memory.dmp

Filesize
496KB

Download
memory/1020-28-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/1020-29-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/1020-30-0x000000001AB70000-0x000000001ABEE000-memory.dmp

Filesize
504KB

Download
memory/1020-31-0x000000001B4B0000-0x000000001B52E000-memory.dmp

Filesize
504KB

Download
memory/1020-32-0x0000000001DC0000-0x0000000001DDC000-memory.dmp

Filesize
112KB

Download
memory/1020-33-0x0000000001DE0000-0x0000000001DFC000-memory.dmp

Filesize
112KB

Download
memory/1020-34-0x0000000001DC0000-0x0000000001DD4000-memory.dmp

Filesize
80KB

Download
memory/1020-35-0x0000000001F80000-0x0000000001F94000-memory.dmp

Filesize
80KB

Download
memory/1020-36-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Filesize
64KB

Download
memory/1020-37-0x0000000001DD0000-0x0000000001DE0000-memory.dmp

Filesize
64KB

Download
memory/1020-38-0x0000000001DC0000-0x0000000001DD8000-memory.dmp

Filesize
96KB

Download
memory/1020-39-0x000000001A540000-0x000000001A558000-memory.dmp

Filesize
96KB

Download
memory/1020-40-0x000000001BBD0000-0x000000001BD2A000-memory.dmp

Filesize
1.4MB

Download
memory/1020-41-0x000000001BD30000-0x000000001BE8A000-memory.dmp

Filesize
1.4MB

Download
memory/1020-42-0x000000001AB70000-0x000000001AC14000-memory.dmp

Filesize
656KB

Download
memory/1020-43-0x000000001B4B0000-0x000000001B554000-memory.dmp

Filesize
656KB

Download
memory/1020-44-0x0000000001DC0000-0x0000000001DDA000-memory.dmp

Filesize
104KB

Download
memory/1020-45-0x000000001A560000-0x000000001A57A000-memory.dmp

Filesize
104KB

Download
memory/1020-46-0x000000001B9A0000-0x000000001BAC2000-memory.dmp

Filesize
1.1MB

Download
memory/1020-47-0x000000001BBD0000-0x000000001BCF2000-memory.dmp

Filesize
1.1MB

Download
memory/1020-48-0x000000001AB70000-0x000000001ABB4000-memory.dmp

Filesize
272KB

Download
memory/1020-49-0x000000001ABC0000-0x000000001AC04000-memory.dmp

Filesize
272KB

Download
memory/1020-50-0x000000001ABC0000-0x000000001AC36000-memory.dmp

Filesize
472KB

Download
memory/1020-66-0x000000001B5F0000-0x000000001B66C000-memory.dmp

Filesize
496KB

Download
memory/1020-52-0x0000000001FA0000-0x0000000001FB0000-memory.dmp

Filesize
64KB

Download
memory/1020-53-0x000000001A560000-0x000000001A570000-memory.dmp

Filesize
64KB

Download
memory/1020-54-0x000000001ABC0000-0x000000001ABF0000-memory.dmp

Filesize
192KB

Download
memory/1020-55-0x000000001ABF0000-0x000000001AC20000-memory.dmp

Filesize
192KB

Download
memory/1020-56-0x000000001B5F0000-0x000000001B6AA000-memory.dmp

Filesize
744KB

Download
memory/1020-57-0x000000001B7E0000-0x000000001B89A000-memory.dmp

Filesize
744KB

Download
memory/1020-58-0x000000001ABC0000-0x000000001AC20000-memory.dmp

Filesize
384KB

Download
memory/1020-59-0x000000001B340000-0x000000001B3A0000-memory.dmp

Filesize
384KB

Download
memory/1020-60-0x000000001ABC0000-0x000000001ABE2000-memory.dmp

Filesize
136KB

Download
memory/1020-73-0x000000001A580000-0x000000001A58E000-memory.dmp

Filesize
56KB

Download
memory/1020-62-0x000000001BE90000-0x000000001C255000-memory.dmp

Filesize
3.8MB

Download
memory/1020-63-0x000000001C260000-0x000000001C625000-memory.dmp

Filesize
3.8MB

Download
memory/1020-64-0x000000001A570000-0x000000001A58E000-memory.dmp

Filesize
120KB

Download
memory/1020-65-0x000000001A9D0000-0x000000001A9EE000-memory.dmp

Filesize
120KB

Download
memory/1020-51-0x000000001B5F0000-0x000000001B666000-memory.dmp

Filesize
472KB

Download
memory/1020-72-0x000000001A570000-0x000000001A57E000-memory.dmp

Filesize
56KB

Download
memory/1020-71-0x000000001A580000-0x000000001A588000-memory.dmp

Filesize
32KB

Download
memory/1020-69-0x000000001BA20000-0x000000001BABC000-memory.dmp

Filesize
624KB

Download
memory/1020-70-0x000000001A570000-0x000000001A578000-memory.dmp

Filesize
32KB

Download
memory/1764-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1764-11-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1764-13-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1764-9-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1764-18-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/1764-5-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1764-4-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1764-15-0x00000000005E0000-0x0000000000620000-memory.dmp

Filesize
256KB

Download
memory/1764-14-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/1764-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1764-6-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1812-496-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1812-497-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1812-498-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1812-499-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1812-500-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1812-508-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1812-502-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1812-495-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2056-565-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2056-575-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2056-573-0x0000000077240000-0x000000007735F000-memory.dmp

Filesize
1.1MB

Download
memory/2056-571-0x0000000077460000-0x0000000077609000-memory.dmp

Filesize
1.7MB

Download
memory/2056-570-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2056-568-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2056-567-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2056-566-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2344-593-0x0000000077460000-0x0000000077609000-memory.dmp

Filesize
1.7MB

Download
memory/2344-595-0x0000000077240000-0x000000007735F000-memory.dmp

Filesize
1.1MB

Download
memory/2456-532-0x0000000140000000-0x00000001402C1000-memory.dmp

Filesize
2.8MB

Download
memory/2456-534-0x0000000140000000-0x00000001402C1000-memory.dmp

Filesize
2.8MB

Download
memory/2456-543-0x0000000140000000-0x00000001402C1000-memory.dmp

Filesize
2.8MB

Download
memory/2456-541-0x000007FFFFFDD000-0x000007FFFFFDE000-memory.dmp

Filesize
4KB

Download
memory/2456-535-0x0000000140000000-0x00000001402C1000-memory.dmp

Filesize
2.8MB

Download
memory/2456-537-0x0000000140000000-0x00000001402C1000-memory.dmp

Filesize
2.8MB

Download
memory/2456-536-0x0000000140000000-0x00000001402C1000-memory.dmp

Filesize
2.8MB

Download
memory/2456-538-0x0000000140000000-0x00000001402C1000-memory.dmp

Filesize
2.8MB

Download
memory/2456-549-0x0000000140000000-0x00000001402C1000-memory.dmp

Filesize
2.8MB

Download
memory/2456-533-0x0000000140000000-0x00000001402C1000-memory.dmp

Filesize
2.8MB

Download
memory/2876-16-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2876-3-0x000000001B4F0000-0x000000001B554000-memory.dmp

Filesize
400KB

Download
memory/2876-0-0x0000000000AD0000-0x0000000000AE6000-memory.dmp

Filesize
88KB

Download
memory/2876-2-0x000000001B170000-0x000000001B1F0000-memory.dmp

Filesize
512KB

Download
memory/2876-17-0x000000001B170000-0x000000001B1F0000-memory.dmp

Filesize
512KB

Download
memory/2876-1-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download