xmrig | d8cd09a657f75577156236c84ba49c04faa8280b7f13a5394a7ad691312ced6b

Resubmissions

19/04/2024, 00:47

240419-a5dwysbf54 10

19/04/2024, 00:35

240419-axr4lsbd55 10

Analysis

max time kernel
26s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1.Install_Loader.exe
Size

10.2MB
MD5

7c9494727f40e6afc4c8b1b5867c7e41
SHA1

87a4075936832f3fea4d23a5c0610b6de7b4e5cf
SHA256

0f06e67411fc5f473f5d7d707e9e6c15c89400e0729c14382bc803ae32895b9d
SHA512

0f73b144f374f1c1e7be851df3b1fe7f3d48fefc2f323b3e08c23183e3fbdbb43a652320d39bb8c2bd32e2715c200a8c7cfd18bae451689f2be3f5b7c1b71c6e
SSDEEP

196608:C8aJhSRE1uYcTS7pq83f9eX1JVqjbhKphKr44A4001/xu5cJIL:CbcYg0VPwX4jbtrT900Du8IL

Score

10^/10

xmrig evasion miner persistence spyware stealer themida trojan

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	srslhpbeabfz.exe

XMRig Miner payload 27 IoCs

miner

resource	yara_rule
behavioral1/memory/3152-104-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-105-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-106-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-107-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-108-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-109-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-110-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-111-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-113-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-116-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-117-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-118-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-120-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-119-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-122-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-123-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-126-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-127-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-129-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-128-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-132-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-134-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-133-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-135-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-138-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-140-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/3152-141-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	srslhpbeabfz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	srslhpbeabfz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1.exe

Executes dropped EXE 3 IoCs

pid	Process
3956	1.exe
4636	2.exe
4420	srslhpbeabfz.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 19 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000400000001e970-3.dat	themida
behavioral1/files/0x000400000001e970-2.dat	themida
behavioral1/memory/3956-6-0x00007FF692D00000-0x00007FF6941A9000-memory.dmp	themida
behavioral1/memory/3956-4-0x00007FF692D00000-0x00007FF6941A9000-memory.dmp	themida
behavioral1/memory/3956-5-0x00007FF692D00000-0x00007FF6941A9000-memory.dmp	themida
behavioral1/memory/3956-7-0x00007FF692D00000-0x00007FF6941A9000-memory.dmp	themida
behavioral1/memory/3956-8-0x00007FF692D00000-0x00007FF6941A9000-memory.dmp	themida
behavioral1/memory/3956-9-0x00007FF692D00000-0x00007FF6941A9000-memory.dmp	themida
behavioral1/memory/3956-28-0x00007FF692D00000-0x00007FF6941A9000-memory.dmp	themida
behavioral1/files/0x00090000000233f9-46.dat	themida
behavioral1/files/0x00090000000233f9-47.dat	themida
behavioral1/memory/4420-50-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp	themida
behavioral1/memory/4420-48-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp	themida
behavioral1/memory/4420-49-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp	themida
behavioral1/memory/4420-52-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp	themida
behavioral1/memory/4420-53-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp	themida
behavioral1/memory/4420-54-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp	themida
behavioral1/memory/4420-55-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp	themida
behavioral1/memory/4420-114-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	srslhpbeabfz.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
14	pastebin.com
45	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
37	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4636 set thread context of 1088	4636	2.exe	122

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4444	sc.exe
1712	sc.exe
2132	sc.exe
4500	sc.exe
1544	sc.exe
4672	sc.exe
2700	sc.exe
1200	sc.exe
4888	sc.exe
4844	sc.exe
4444	sc.exe
3692	sc.exe
2148	sc.exe
4888	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3956	1.exe
2884	powershell.exe
2884	powershell.exe
3956	1.exe
3956	1.exe
3956	1.exe
3956	1.exe
3956	1.exe
3956	1.exe
3956	1.exe
3956	1.exe
3956	1.exe
3956	1.exe
3956	1.exe
4420	srslhpbeabfz.exe
2476	powershell.exe
2476	powershell.exe
2476	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	3956	1.exe
Token: SeDebugPrivilege	1088	RegAsm.exe
Token: SeDebugPrivilege	2476	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 3956	1892	1.Install_Loader.exe	92
PID 1892 wrote to memory of 3956	1892	1.Install_Loader.exe	92
PID 4728 wrote to memory of 3152	4728	cmd.exe	100
PID 4728 wrote to memory of 3152	4728	cmd.exe	100
PID 1892 wrote to memory of 4636	1892	1.Install_Loader.exe	95
PID 1892 wrote to memory of 4636	1892	1.Install_Loader.exe	95
PID 1892 wrote to memory of 4636	1892	1.Install_Loader.exe	95
PID 3372 wrote to memory of 3940	3372	cmd.exe	121
PID 3372 wrote to memory of 3940	3372	cmd.exe	121
PID 4636 wrote to memory of 1088	4636	2.exe	122
PID 4636 wrote to memory of 1088	4636	2.exe	122
PID 4636 wrote to memory of 1088	4636	2.exe	122
PID 4636 wrote to memory of 1088	4636	2.exe	122
PID 4636 wrote to memory of 1088	4636	2.exe	122
PID 4636 wrote to memory of 1088	4636	2.exe	122
PID 4636 wrote to memory of 1088	4636	2.exe	122
PID 4636 wrote to memory of 1088	4636	2.exe	122

C:\Users\Admin\AppData\Local\Temp\1.Install_Loader.exe
"C:\Users\Admin\AppData\Local\Temp\1.Install_Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Roaming\1.exe
  C:\Users\Admin\AppData\Roaming\1.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3152
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4672
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1712
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1544
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:4888
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:4444
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "BQMZMFNO"
    3⤵
    - Launches sc.exe
    PID:2148
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "BQMZMFNO" binpath= "C:\ProgramData\renoknhhpzet\srslhpbeabfz.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4844
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3692
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "BQMZMFNO"
    3⤵
    - Launches sc.exe
    PID:2132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\1.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3940
- C:\Users\Admin\AppData\Roaming\2.exe
  C:\Users\Admin\AppData\Roaming\2.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1088

C:\ProgramData\renoknhhpzet\srslhpbeabfz.exe
C:\ProgramData\renoknhhpzet\srslhpbeabfz.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:4420
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:764
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5016
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1200
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4500
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2700
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:4888
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:4444
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:976
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\renoknhhpzet\srslhpbeabfz.exe

Filesize
396.5MB

MD5
4e677fdcd4d0cd7e88331f337c2aa23e

SHA1
034dcdf26f2392f62198659ab3fa3ced81a1ee69

SHA256
35294423d06f0a6c40ec0d47234b26289f4114e62374eff73336bb635d3ac339

SHA512
a6e1c73cbd706ffffe6cac8719045d704da4b796d3d0b9409ae3840a084ee7203b8ccd916d8c13f68bcdf207d6b2f8aaca910cad325438905300f2fe910bb504

Download Submit
C:\ProgramData\renoknhhpzet\srslhpbeabfz.exe

Filesize
396.8MB

MD5
ffbe278a6c9b8eee18bebfb5010abfa1

SHA1
695886b7808692e4f8b5bb7339cbe506ce8fedd0

SHA256
8a358aed4cc3e44e0e3a41640ec1d3ba4d41f40bdc421867779d9c13f08baf46

SHA512
70d455198960d0a171b93ac0624629e39729576f1dd79e4bb73838aeff5b81679b5ac47e7ce7bb1516a386a49a4b234c206b3f12fd82ccc3ef2f61b3c2d91130

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nh0vrgth.kjm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\1.exe

Filesize
461.4MB

MD5
4179c468e7208b07d736d46e51e22781

SHA1
e5947a1a65423ca2db48fd47a5194661dbc3eaa3

SHA256
dcfd8b357f6a52899a2740d408a042ed8ac555c5519bb6c6939a1feef4a65083

SHA512
551133340357ff9ab30d6d38e2a6d288153738b576ba217f3ba4b1decc3357680c9685496048072020673782c14b177828b8b93bb03c1c40fee67fd00462351f

Download Submit
C:\Users\Admin\AppData\Roaming\1.exe

Filesize
469.6MB

MD5
8d00eb82cce9cf2b78a3f4d2b2055a43

SHA1
1a4f48e92fd615b98533bb18347414e3fc32e36b

SHA256
380854fe728c6e0a20be92e3548d8a9748a880154eea427daa9933803b0953ca

SHA512
e9a09809f0f93852680ed02370b477dd166d25ebde2c5e0c2c3b48bfd6c7a70b0ec2e6e0031b32e1ac7298f5d5cf06937a92cc9fbded22c0b33f8080476c9471

Download Submit
C:\Users\Admin\AppData\Roaming\2.exe

Filesize
434.0MB

MD5
d5a4bc6beff842581abd63c641abce0e

SHA1
c23687dfa3dcedc008c01ffa17d3eee94e4b3ee2

SHA256
5fddc92bb5273b860774d806d719cfa3cb01324eb21d3989dd4633f74dfb55e3

SHA512
c70dd332db009c92c37c8db4656a39805294d5b897819f43eb9151155a9918c7ac81d55dc181c4a652899d59f587b0f79985b49ebb26802a94ca4df63f1c3444

Download Submit
C:\Users\Admin\AppData\Roaming\2.exe

Filesize
425.2MB

MD5
9f2d10fbbac5b23af82b038c863d571a

SHA1
6c4997c7cdf85f5860438ab8f480832f6383db00

SHA256
b9d65b5ce81e998db6d63484d5f3528da50ef2a8d14a996eccc31e4e637efd07

SHA512
253cfa687267536f9c27ef6e9fa75513d2837d26465bf9ba59f500e958cdfa6bb6f189c3a4118918a5ee9242fed2e4a215752d9569cdb664110d6b343137a165

Download Submit
memory/976-99-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/976-98-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/976-97-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/976-102-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/976-96-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/976-95-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1088-85-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/1088-43-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/1088-45-0x0000000007790000-0x00000000077F6000-memory.dmp

Filesize
408KB

Download
memory/1088-44-0x0000000006AA0000-0x0000000006B32000-memory.dmp

Filesize
584KB

Download
memory/1088-38-0x0000000005C10000-0x00000000061B4000-memory.dmp

Filesize
5.6MB

Download
memory/1088-41-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download
memory/1088-36-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2476-89-0x000002ABC2A30000-0x000002ABC2A36000-memory.dmp

Filesize
24KB

Download
memory/2476-91-0x000002ABA7D00000-0x000002ABA7D10000-memory.dmp

Filesize
64KB

Download
memory/2476-80-0x000002ABC27E0000-0x000002ABC2895000-memory.dmp

Filesize
724KB

Download
memory/2476-79-0x00007FF47B8F0000-0x00007FF47B900000-memory.dmp

Filesize
64KB

Download
memory/2476-58-0x000002ABA7D00000-0x000002ABA7D10000-memory.dmp

Filesize
64KB

Download
memory/2476-78-0x000002ABC27C0000-0x000002ABC27DC000-memory.dmp

Filesize
112KB

Download
memory/2476-94-0x00007FFC77C40000-0x00007FFC78701000-memory.dmp

Filesize
10.8MB

Download
memory/2476-81-0x000002ABA7D00000-0x000002ABA7D10000-memory.dmp

Filesize
64KB

Download
memory/2476-90-0x000002ABC2A40000-0x000002ABC2A4A000-memory.dmp

Filesize
40KB

Download
memory/2476-57-0x00007FFC77C40000-0x00007FFC78701000-memory.dmp

Filesize
10.8MB

Download
memory/2476-88-0x000002ABC2A00000-0x000002ABC2A08000-memory.dmp

Filesize
32KB

Download
memory/2476-87-0x000002ABC2A50000-0x000002ABC2A6A000-memory.dmp

Filesize
104KB

Download
memory/2476-86-0x000002ABC29F0000-0x000002ABC29FA000-memory.dmp

Filesize
40KB

Download
memory/2476-83-0x000002ABC2A10000-0x000002ABC2A2C000-memory.dmp

Filesize
112KB

Download
memory/2476-82-0x000002ABC28A0000-0x000002ABC28AA000-memory.dmp

Filesize
40KB

Download
memory/2884-23-0x000001E331C50000-0x000001E331C60000-memory.dmp

Filesize
64KB

Download
memory/2884-26-0x00007FFC77C40000-0x00007FFC78701000-memory.dmp

Filesize
10.8MB

Download
memory/2884-22-0x000001E331C50000-0x000001E331C60000-memory.dmp

Filesize
64KB

Download
memory/2884-17-0x00007FFC77C40000-0x00007FFC78701000-memory.dmp

Filesize
10.8MB

Download
memory/2884-16-0x000001E331C10000-0x000001E331C32000-memory.dmp

Filesize
136KB

Download
memory/3152-103-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-126-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-142-0x000001F6CD3A0000-0x000001F6CD3C0000-memory.dmp

Filesize
128KB

Download
memory/3152-141-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-140-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-138-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-137-0x000001F6CD3C0000-0x000001F6CD3E0000-memory.dmp

Filesize
128KB

Download
memory/3152-136-0x000001F6CD3A0000-0x000001F6CD3C0000-memory.dmp

Filesize
128KB

Download
memory/3152-135-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-133-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-134-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-132-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-131-0x000001F6CD3A0000-0x000001F6CD3C0000-memory.dmp

Filesize
128KB

Download
memory/3152-128-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-130-0x000001F6CD3A0000-0x000001F6CD3C0000-memory.dmp

Filesize
128KB

Download
memory/3152-129-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-127-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-125-0x000001F6CD3A0000-0x000001F6CD3C0000-memory.dmp

Filesize
128KB

Download
memory/3152-104-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-124-0x000001F6CD3A0000-0x000001F6CD3C0000-memory.dmp

Filesize
128KB

Download
memory/3152-105-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-106-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-107-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-108-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-109-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-110-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-111-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-113-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-123-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-115-0x000001F6CCBC0000-0x000001F6CCBE0000-memory.dmp

Filesize
128KB

Download
memory/3152-116-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-117-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-118-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-120-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-119-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3152-121-0x000001F6CD380000-0x000001F6CD3A0000-memory.dmp

Filesize
128KB

Download
memory/3152-122-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/3956-4-0x00007FF692D00000-0x00007FF6941A9000-memory.dmp

Filesize
20.7MB

Download
memory/3956-5-0x00007FF692D00000-0x00007FF6941A9000-memory.dmp

Filesize
20.7MB

Download
memory/3956-7-0x00007FF692D00000-0x00007FF6941A9000-memory.dmp

Filesize
20.7MB

Download
memory/3956-8-0x00007FF692D00000-0x00007FF6941A9000-memory.dmp

Filesize
20.7MB

Download
memory/3956-9-0x00007FF692D00000-0x00007FF6941A9000-memory.dmp

Filesize
20.7MB

Download
memory/3956-28-0x00007FF692D00000-0x00007FF6941A9000-memory.dmp

Filesize
20.7MB

Download
memory/3956-6-0x00007FF692D00000-0x00007FF6941A9000-memory.dmp

Filesize
20.7MB

Download
memory/4420-50-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp

Filesize
20.7MB

Download
memory/4420-55-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp

Filesize
20.7MB

Download
memory/4420-114-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp

Filesize
20.7MB

Download
memory/4420-48-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp

Filesize
20.7MB

Download
memory/4420-49-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp

Filesize
20.7MB

Download
memory/4420-52-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp

Filesize
20.7MB

Download
memory/4420-53-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp

Filesize
20.7MB

Download
memory/4420-54-0x00007FF6BE9E0000-0x00007FF6BFE89000-memory.dmp

Filesize
20.7MB

Download
memory/4636-32-0x0000000000760000-0x000000000077E000-memory.dmp

Filesize
120KB

Download
memory/4636-42-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/4636-34-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/4636-39-0x0000000002B90000-0x0000000004B90000-memory.dmp

Filesize
32.0MB

Download