Malware Analysis Report

2024-10-10 10:03

Sample ID 240517-zgewsaab94
Target 3969991942bb5b6130977411ae258ab8.exe
SHA256 aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28
Tags
dcrat umbral xworm execution infostealer rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28

Threat Level: Known bad

The file 3969991942bb5b6130977411ae258ab8.exe was found to be: Known bad.

Malicious Activity Summary

dcrat umbral xworm execution infostealer rat spyware stealer trojan

Detect Umbral payload

DcRat

Process spawned unexpected child process

Umbral

Xworm

Detect Xworm Payload

DCRat payload

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Checks computer location settings

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Views/modifies file attributes

Modifies registry class

Creates scheduled task(s)

Runs ping.exe

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Detects videocard installed

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-17 20:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-17 20:41

Reported

2024-05-17 20:43

Platform

win7-20240508-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe"

Signatures

DcRat

rat infostealer dcrat

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

Umbral

stealer umbral

Xworm

trojan rat xworm

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Roaming\Umbral.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Photo Viewer\en-US\conhost.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\c5b4cb5e9653cc C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\6ccacd8608530f C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\7-Zip\Lang\conhost.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\7-Zip\Lang\088424020bedd6 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\6ccacd8608530f C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Windows Photo Viewer\en-US\088424020bedd6 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\services.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\101b941d020240 C:\perfdhcpSvc\Chainprovider.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\en-US\conhost.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\Idle.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Idle.exe C:\perfdhcpSvc\Chainprovider.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Umbral.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\perfdhcpSvc\Chainprovider.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1852 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\Nursultan (17).exe
PID 1852 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\Nursultan (17).exe
PID 1852 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\Nursultan (17).exe
PID 1852 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 1852 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 1852 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 1852 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 1852 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\Umbral.exe
PID 1852 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\Umbral.exe
PID 1852 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\Umbral.exe
PID 1372 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\Nursultan.exe
PID 1372 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\Nursultan.exe
PID 1372 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\Nursultan.exe
PID 1372 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\LoaderMas.exe
PID 1372 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\LoaderMas.exe
PID 1372 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\LoaderMas.exe
PID 2092 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 2092 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 2092 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 2092 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 1600 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 1600 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 1600 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 1600 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\system32\attrib.exe
PID 1600 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\system32\attrib.exe
PID 1600 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\system32\attrib.exe
PID 1600 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2672 wrote to memory of 756 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2672 wrote to memory of 756 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2672 wrote to memory of 756 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2672 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2672 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2672 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2436 wrote to memory of 584 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 584 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 584 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 584 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 584 wrote to memory of 3020 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 584 wrote to memory of 3020 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 584 wrote to memory of 3020 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 584 wrote to memory of 3020 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 1600 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2672 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2672 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2672 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2672 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2672 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2672 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 1600 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 1600 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 1600 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 1600 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 1600 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe

"C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe"

C:\Users\Admin\AppData\Roaming\Nursultan (17).exe

"C:\Users\Admin\AppData\Roaming\Nursultan (17).exe"

C:\Users\Admin\AppData\Roaming\t.bat

"C:\Users\Admin\AppData\Roaming\t.bat"

C:\Users\Admin\AppData\Roaming\Umbral.exe

"C:\Users\Admin\AppData\Roaming\Umbral.exe"

C:\Users\Admin\AppData\Roaming\Nursultan.exe

"C:\Users\Admin\AppData\Roaming\Nursultan.exe"

C:\Users\Admin\AppData\Roaming\LoaderMas.exe

"C:\Users\Admin\AppData\Roaming\LoaderMas.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\perfdhcpSvc\LUps3wjkA6jhdk7xRy8J55z2u.vbe"

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\system32\attrib.exe

"attrib.exe" +h +s "C:\Users\Admin\AppData\Roaming\Umbral.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Umbral.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\LoaderMas.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'LoaderMas.exe'

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\perfdhcpSvc\mStUjP0ksX5N.bat" "

C:\perfdhcpSvc\Chainprovider.exe

"C:\perfdhcpSvc\Chainprovider.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\en-US\conhost.exe'" /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\en-US\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\perfdhcpSvc\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\perfdhcpSvc\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\perfdhcpSvc\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Nurik\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Nurik\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Nurik\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Nurik\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Nurik\cmd.exe'" /rl HIGHEST /f

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Nurik\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "ChainproviderC" /sc MINUTE /mo 8 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\Chainprovider.exe'" /f

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Chainprovider" /sc ONLOGON /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\Chainprovider.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "ChainproviderC" /sc MINUTE /mo 8 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\Chainprovider.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Idle.exe'" /f

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\conhost.exe'" /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\perfdhcpSvc\Chainprovider.exe

"C:\perfdhcpSvc\Chainprovider.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WMICW" /sc MINUTE /mo 7 /tr "'C:\Nurik\WMIC.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WMIC" /sc ONLOGON /tr "'C:\Nurik\WMIC.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WMICW" /sc MINUTE /mo 13 /tr "'C:\Nurik\WMIC.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\conhost.exe'" /f

C:\Windows\system32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Roaming\Umbral.exe" && pause

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WMICW" /sc MINUTE /mo 12 /tr "'C:\Nurik\WMIC.exe'" /f

C:\Windows\system32\PING.EXE

ping localhost

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WMIC" /sc ONLOGON /tr "'C:\Nurik\WMIC.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WMICW" /sc MINUTE /mo 7 /tr "'C:\Nurik\WMIC.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\Idle.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FHohgUYXub.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\7-Zip\Lang\conhost.exe

"C:\Program Files\7-Zip\Lang\conhost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 a0948305.xsph.ru udp
RU 141.8.192.103:80 a0948305.xsph.ru tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp

Files

memory/1852-0-0x000007FEF5C73000-0x000007FEF5C74000-memory.dmp

memory/1852-1-0x0000000000B80000-0x0000000001F50000-memory.dmp

C:\Users\Admin\AppData\Roaming\Nursultan (17).exe

MD5 ed965403e795c3b563d67c734472ad93
SHA1 6b8b929239d5ef8f1f546c591c67acaf560de4dc
SHA256 6b7473e7177ef0666f6afe36b257d0730dababefc209ee1c5f2da319dbe1633d
SHA512 bd860103c5ac1bcc02bfefc669616a1b0103dfb3c611b0e4499cf4b1fc67d49c9cd57c1839936b75e0f0008aec0f84cb0af712feb334957972661405a137f649

memory/1372-9-0x0000000000F50000-0x000000000218A000-memory.dmp

C:\Users\Admin\AppData\Roaming\t.bat

MD5 d85bd59cf0808fb894f60773e1594a0a
SHA1 84b9d205f3ae6ca4f8f1bb938ee8b4d452444cde
SHA256 f3ef597673421e514d7fed82b40d65386c3811c4a8f5553afd59fc632bca8746
SHA512 225788e3e98449f53e6206c585315a37c9ff6ed0b5425b2a98e50c7ac45ab3c187ccf7626f126ba300bd8dbdf89c864e89f85d6264edc89281745b081ec58f97

memory/1372-14-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Umbral.exe

MD5 f48ef033300ec9fd3c77afff5c20e95f
SHA1 22d6125b980474b3f54937003a765cdd5352f9a8
SHA256 72ee11a905ca278130f02397422b4cc4944851065ce0072f9888b70c5ad40f1e
SHA512 847ee8cdb14879089c861168d6be90325304df490668a38447b37772423e6dab5e32a5df344ceb58410d3b24cf25cd7221e8768951e5aca14820996a1e8304bc

memory/1600-21-0x0000000000D90000-0x0000000000DD0000-memory.dmp

C:\Users\Admin\AppData\Roaming\LoaderMas.exe

MD5 a0dbdf3af38ead2237ccb781a098a431
SHA1 1434296af6c5530eb036718e860490e0adc3321a
SHA256 6f483da6b36646bf6f33db0c210bd3683ff29428a44d916a2f26a4240c1a9901
SHA512 dd7dc91a2e09b0c3906efbb486fb84d0289dc61338afd75d203f1ab2f49556c9523a8a9abc913363a45dde8194f5b2ee9d3d659807250047331944c39006edc3

C:\Users\Admin\AppData\Roaming\Nursultan.exe

MD5 e504e3fc36fe4d6f182c98923979a779
SHA1 3ba9f1a9a15b79639a20cfcf79c9de31d15a17a6
SHA256 70b7b95bb952b3325476867307fc5bd4df5769b97bbcdd8b60e7b46e1b38e4a0
SHA512 63bbbc3ccf14b2846df64b8edae52b6431df52aa9e03569a28ca239ab02db94bf79ca8a0a30529e35a04ee5845768d752b99e6ce3830ab440c57850180ad1647

memory/2672-31-0x0000000000080000-0x0000000000096000-memory.dmp

memory/1372-30-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

C:\perfdhcpSvc\LUps3wjkA6jhdk7xRy8J55z2u.vbe

MD5 00b53f3e200522631227cac1a07e0646
SHA1 a0c69d58c7ca10f5fd5e1320b1b2f92081d7fcfe
SHA256 486c050aadc42906113b0c5c8485dff36b0187f343a732542608a91b0565146c
SHA512 22241ae8a31c7e564c9fb652947e4fe17f80c6e94dfe1a3bb5890f6eb97797ee32ccfff5d647eef02bda31bd47c5d95521cd0c6349a01e501e6e064ea6306243

memory/2764-51-0x0000000077A60000-0x0000000077A62000-memory.dmp

memory/2764-49-0x0000000077A60000-0x0000000077A62000-memory.dmp

memory/2764-47-0x0000000077A60000-0x0000000077A62000-memory.dmp

memory/1068-52-0x00000000027E0000-0x00000000027E8000-memory.dmp

memory/1068-46-0x000000001B7B0000-0x000000001BA92000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 7219d4d13093e048d0d942521dcff4a6
SHA1 c47e08076dc39e04b9a7940a75c2a4d1e4eae2bb
SHA256 e9ba3ee64d0c0e1974b1ee361efd318a48a01372e45a30c6b813f95fe44064fb
SHA512 8691b30e5af83d4dbd49b690485822f0bdcbc85b5a58fc6be1e2644f5abd9d5eef9148d4606461f30c1e504d725b5e2e415e5de49f55c2ad5cf93286be359889

memory/1428-58-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

memory/1428-64-0x0000000001FE0000-0x0000000001FE8000-memory.dmp

memory/2764-65-0x0000000140000000-0x0000000142153000-memory.dmp

memory/1920-76-0x0000000002990000-0x0000000002998000-memory.dmp

memory/1920-75-0x000000001B670000-0x000000001B952000-memory.dmp

C:\perfdhcpSvc\mStUjP0ksX5N.bat

MD5 a9330c6da12d90d5d956ae2bbcf017d7
SHA1 7ebaa14eed80db6d9f0c0c0f1ecab1a9c3f61410
SHA256 b49853470383dce14680f656aca7ea449b1d6aabb3f18d4165ebd7e3e7545393
SHA512 557c91cc1cc0d7309f50e286644a2da543c0283d4a1659f7d31554282ddc48b5f972d98d5a01433078fdbe6cc813bb6f7c120e2307fae48c5d81be44ae823228

C:\perfdhcpSvc\Chainprovider.exe

MD5 d2ec227ddac047e735393e58e742fd44
SHA1 7aae5c76378f7cfcff8bb983695fa4c2577a20e2
SHA256 0e679527f2df9f87d33c82023256fac276c36006579d2d71877ccab4be847cce
SHA512 5a11b292a574bd2ca6c225af1e4c9f95004a49ce816cc59a73d4ab6e2a0b007a58ab56e5e0c004901c3ebe4ec06054e6e801f8e659711856857add6d43f38979

memory/3020-83-0x0000000000320000-0x00000000003F6000-memory.dmp

memory/2484-97-0x000000001B5B0000-0x000000001B892000-memory.dmp

memory/2484-98-0x0000000001E50000-0x0000000001E58000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2956-111-0x000000001B7B0000-0x000000001BA92000-memory.dmp

memory/2956-115-0x0000000001D80000-0x0000000001D88000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\FHohgUYXub.bat

MD5 9a464aef60cc0f26023f2b631b46f218
SHA1 7b9664462e50e8e6ebb11c3ce3404ffb6074f7e2
SHA256 12f0fa31baeb6c483cfb0973403cc7ee14e223db3580dc528db77e209332c8a8
SHA512 54b95270074e78b95e50a2206f92870e6a163bc864d6b3d34fd483c7194857f75b9365a4997c8aa07bb64ab960e645204c0d27c8fad1f13d7c1b1cd2b5f3d243

memory/2568-166-0x0000000000F60000-0x0000000001036000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-17 20:41

Reported

2024-05-17 20:43

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe"

Signatures

DcRat

rat infostealer dcrat

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

Umbral

stealer umbral

Xworm

trojan rat xworm

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Roaming\Umbral.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\t.bat N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Nursultan (17).exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\perfdhcpSvc\Chainprovider.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Windows Defender\it-IT\55b276f4edf653 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Windows Portable Devices\csrss.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Windows Portable Devices\886983d96e3d3e C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsass.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\6203df4a6bafc7 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Windows Portable Devices\WmiPrvSE.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Windows Portable Devices\24dbde2999530e C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Windows Defender\it-IT\StartMenuExperienceHost.exe C:\perfdhcpSvc\Chainprovider.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\bcastdvr\conhost.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\bcastdvr\088424020bedd6 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\twain_32\StartMenuExperienceHost.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\twain_32\55b276f4edf653 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\IdentityCRL\lsass.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\IdentityCRL\6203df4a6bafc7 C:\perfdhcpSvc\Chainprovider.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\t.bat N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\perfdhcpSvc\Chainprovider.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Umbral.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\perfdhcpSvc\Chainprovider.exe N/A
N/A N/A C:\perfdhcpSvc\Chainprovider.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\perfdhcpSvc\Chainprovider.exe N/A
N/A N/A C:\perfdhcpSvc\Chainprovider.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\perfdhcpSvc\Chainprovider.exe N/A
N/A N/A C:\perfdhcpSvc\Chainprovider.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
N/A N/A C:\perfdhcpSvc\StartMenuExperienceHost.exe N/A
N/A N/A C:\perfdhcpSvc\StartMenuExperienceHost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Umbral.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\perfdhcpSvc\Chainprovider.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1288 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\Nursultan (17).exe
PID 1288 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\Nursultan (17).exe
PID 1288 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 1288 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 1288 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 1288 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\Umbral.exe
PID 1288 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe C:\Users\Admin\AppData\Roaming\Umbral.exe
PID 4552 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 4552 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 4552 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 3768 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 3768 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 3768 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\SYSTEM32\attrib.exe
PID 3768 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\SYSTEM32\attrib.exe
PID 3768 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3768 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2460 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\Nursultan.exe
PID 2460 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\Nursultan.exe
PID 2460 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\LoaderMas.exe
PID 2460 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\LoaderMas.exe
PID 3768 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3768 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 2796 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4920 wrote to memory of 2796 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4920 wrote to memory of 2796 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 4404 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 2796 wrote to memory of 4404 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 3768 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3768 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3768 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3768 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4404 wrote to memory of 1760 N/A C:\perfdhcpSvc\Chainprovider.exe C:\Windows\System32\cmd.exe
PID 4404 wrote to memory of 1760 N/A C:\perfdhcpSvc\Chainprovider.exe C:\Windows\System32\cmd.exe
PID 1760 wrote to memory of 1168 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1760 wrote to memory of 1168 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1816 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3768 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 3768 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 3768 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 3768 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 3768 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 3768 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 3768 wrote to memory of 960 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3768 wrote to memory of 960 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3768 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 3768 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 3768 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\SYSTEM32\cmd.exe
PID 3768 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\SYSTEM32\cmd.exe
PID 4836 wrote to memory of 3740 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 4836 wrote to memory of 3740 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 1760 wrote to memory of 4932 N/A C:\Windows\System32\cmd.exe C:\perfdhcpSvc\StartMenuExperienceHost.exe
PID 1760 wrote to memory of 4932 N/A C:\Windows\System32\cmd.exe C:\perfdhcpSvc\StartMenuExperienceHost.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe

"C:\Users\Admin\AppData\Local\Temp\3969991942bb5b6130977411ae258ab8.exe"

C:\Users\Admin\AppData\Roaming\Nursultan (17).exe

"C:\Users\Admin\AppData\Roaming\Nursultan (17).exe"

C:\Users\Admin\AppData\Roaming\t.bat

"C:\Users\Admin\AppData\Roaming\t.bat"

C:\Users\Admin\AppData\Roaming\Umbral.exe

"C:\Users\Admin\AppData\Roaming\Umbral.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\perfdhcpSvc\LUps3wjkA6jhdk7xRy8J55z2u.vbe"

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Users\Admin\AppData\Roaming\Nursultan.exe

"C:\Users\Admin\AppData\Roaming\Nursultan.exe"

C:\Windows\SYSTEM32\attrib.exe

"attrib.exe" +h +s "C:\Users\Admin\AppData\Roaming\Umbral.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Umbral.exe'

C:\Users\Admin\AppData\Roaming\LoaderMas.exe

"C:\Users\Admin\AppData\Roaming\LoaderMas.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\perfdhcpSvc\mStUjP0ksX5N.bat" "

C:\perfdhcpSvc\Chainprovider.exe

"C:\perfdhcpSvc\Chainprovider.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\perfdhcpSvc\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\perfdhcpSvc\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\perfdhcpSvc\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\bcastdvr\conhost.exe'" /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\LoaderMas.exe'

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\bcastdvr\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\bcastdvr\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\perfdhcpSvc\OfficeClickToRun.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\perfdhcpSvc\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\perfdhcpSvc\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Nurik\WmiPrvSE.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Nurik\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Nurik\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\perfdhcpSvc\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\perfdhcpSvc\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\perfdhcpSvc\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Windows\twain_32\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\twain_32\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Windows\twain_32\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsass.exe'" /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Nurik\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Nurik\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Nurik\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'LoaderMas.exe'

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\IdentityCRL\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Windows\IdentityCRL\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\WmiPrvSE.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OOOQfReeqn.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Roaming\Umbral.exe" && pause

C:\Windows\system32\PING.EXE

ping localhost

C:\perfdhcpSvc\StartMenuExperienceHost.exe

"C:\perfdhcpSvc\StartMenuExperienceHost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 233.128.159.162.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
BE 2.17.107.122:443 www.bing.com tcp
US 8.8.8.8:53 122.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 a0948305.xsph.ru udp
RU 141.8.192.103:80 a0948305.xsph.ru tcp
US 8.8.8.8:53 103.192.8.141.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
N/A 127.0.0.1:30683 tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
US 8.8.8.8:53 30.73.42.20.in-addr.arpa udp

Files

memory/1288-0-0x00007FFF66DE3000-0x00007FFF66DE5000-memory.dmp

memory/1288-1-0x0000000000E70000-0x0000000002240000-memory.dmp

C:\Users\Admin\AppData\Roaming\Nursultan (17).exe

MD5 ed965403e795c3b563d67c734472ad93
SHA1 6b8b929239d5ef8f1f546c591c67acaf560de4dc
SHA256 6b7473e7177ef0666f6afe36b257d0730dababefc209ee1c5f2da319dbe1633d
SHA512 bd860103c5ac1bcc02bfefc669616a1b0103dfb3c611b0e4499cf4b1fc67d49c9cd57c1839936b75e0f0008aec0f84cb0af712feb334957972661405a137f649

C:\Users\Admin\AppData\Roaming\t.bat

MD5 d85bd59cf0808fb894f60773e1594a0a
SHA1 84b9d205f3ae6ca4f8f1bb938ee8b4d452444cde
SHA256 f3ef597673421e514d7fed82b40d65386c3811c4a8f5553afd59fc632bca8746
SHA512 225788e3e98449f53e6206c585315a37c9ff6ed0b5425b2a98e50c7ac45ab3c187ccf7626f126ba300bd8dbdf89c864e89f85d6264edc89281745b081ec58f97

C:\Users\Admin\AppData\Roaming\Umbral.exe

MD5 f48ef033300ec9fd3c77afff5c20e95f
SHA1 22d6125b980474b3f54937003a765cdd5352f9a8
SHA256 72ee11a905ca278130f02397422b4cc4944851065ce0072f9888b70c5ad40f1e
SHA512 847ee8cdb14879089c861168d6be90325304df490668a38447b37772423e6dab5e32a5df344ceb58410d3b24cf25cd7221e8768951e5aca14820996a1e8304bc

memory/2460-31-0x00007FFF66DE0000-0x00007FFF678A1000-memory.dmp

memory/2460-30-0x00000000000F0000-0x000000000132A000-memory.dmp

memory/3768-33-0x00007FFF66DE0000-0x00007FFF678A1000-memory.dmp

memory/3768-27-0x0000027D57A80000-0x0000027D57AC0000-memory.dmp

C:\perfdhcpSvc\LUps3wjkA6jhdk7xRy8J55z2u.vbe

MD5 00b53f3e200522631227cac1a07e0646
SHA1 a0c69d58c7ca10f5fd5e1320b1b2f92081d7fcfe
SHA256 486c050aadc42906113b0c5c8485dff36b0187f343a732542608a91b0565146c
SHA512 22241ae8a31c7e564c9fb652947e4fe17f80c6e94dfe1a3bb5890f6eb97797ee32ccfff5d647eef02bda31bd47c5d95521cd0c6349a01e501e6e064ea6306243

C:\Users\Admin\AppData\Roaming\Nursultan.exe

MD5 e504e3fc36fe4d6f182c98923979a779
SHA1 3ba9f1a9a15b79639a20cfcf79c9de31d15a17a6
SHA256 70b7b95bb952b3325476867307fc5bd4df5769b97bbcdd8b60e7b46e1b38e4a0
SHA512 63bbbc3ccf14b2846df64b8edae52b6431df52aa9e03569a28ca239ab02db94bf79ca8a0a30529e35a04ee5845768d752b99e6ce3830ab440c57850180ad1647

C:\Users\Admin\AppData\Roaming\LoaderMas.exe

MD5 a0dbdf3af38ead2237ccb781a098a431
SHA1 1434296af6c5530eb036718e860490e0adc3321a
SHA256 6f483da6b36646bf6f33db0c210bd3683ff29428a44d916a2f26a4240c1a9901
SHA512 dd7dc91a2e09b0c3906efbb486fb84d0289dc61338afd75d203f1ab2f49556c9523a8a9abc913363a45dde8194f5b2ee9d3d659807250047331944c39006edc3

memory/2460-62-0x00007FFF66DE0000-0x00007FFF678A1000-memory.dmp

memory/1816-61-0x00000000001F0000-0x0000000000206000-memory.dmp

memory/3212-73-0x0000028F12F00000-0x0000028F12F22000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eveoqp2p.ozg.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 52afa702b34ab802e2ecd71d9539c829
SHA1 6a6f18158c82910e158d7e27972486c6e4dc5c93
SHA256 992fefff5236c174b6dd74b76a2c5c0d33470bec786ee4b30f5577aea27b8025
SHA512 5e42fead63b34fb62e4173e83e11110543583aece41f736c007d8512e8f23b6713140c9233bf99f9b9d1c3302a2f526bd4d33ed1ce1f777c9e0d9dea25e37639

C:\perfdhcpSvc\mStUjP0ksX5N.bat

MD5 a9330c6da12d90d5d956ae2bbcf017d7
SHA1 7ebaa14eed80db6d9f0c0c0f1ecab1a9c3f61410
SHA256 b49853470383dce14680f656aca7ea449b1d6aabb3f18d4165ebd7e3e7545393
SHA512 557c91cc1cc0d7309f50e286644a2da543c0283d4a1659f7d31554282ddc48b5f972d98d5a01433078fdbe6cc813bb6f7c120e2307fae48c5d81be44ae823228

C:\perfdhcpSvc\Chainprovider.exe

MD5 d2ec227ddac047e735393e58e742fd44
SHA1 7aae5c76378f7cfcff8bb983695fa4c2577a20e2
SHA256 0e679527f2df9f87d33c82023256fac276c36006579d2d71877ccab4be847cce
SHA512 5a11b292a574bd2ca6c225af1e4c9f95004a49ce816cc59a73d4ab6e2a0b007a58ab56e5e0c004901c3ebe4ec06054e6e801f8e659711856857add6d43f38979

memory/3768-92-0x0000027D71F50000-0x0000027D71FA0000-memory.dmp

memory/3768-91-0x0000027D72270000-0x0000027D722E6000-memory.dmp

memory/3768-96-0x0000027D59810000-0x0000027D5982E000-memory.dmp

memory/4404-97-0x0000000000CE0000-0x0000000000DB6000-memory.dmp

memory/5016-112-0x00007FFF85290000-0x00007FFF85292000-memory.dmp

memory/5016-115-0x0000000140000000-0x0000000142153000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 985b3105d8889886d6fd953575c54e08
SHA1 0f9a041240a344d82bac0a180520e7982c15f3cd
SHA256 5178fdd457eb3eb25c8f72ed4c22c582a83de0d324db66d0446d660f226e944d
SHA512 0fd59bc4886b70aa3b7eeeaa23229b7fdc93410ca7f8452860e4a1bbda2559eaa5e4b05c3ec2d85f7d648daf3c16741f4c2c18f2dd3bae4cc4a4e57ae4f665b0

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d8cb3e9459807e35f02130fad3f9860d
SHA1 5af7f32cb8a30e850892b15e9164030a041f4bd6
SHA256 2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
SHA512 045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184

C:\Users\Admin\AppData\Local\Temp\OOOQfReeqn.bat

MD5 e78f932d0eff4899edfc22da5cc43704
SHA1 4915fa24356875484286faa7e551dda9cf9307a2
SHA256 476251c5b0021bb2ecbe2f051dc83d31f48df444f1067cf093742e69dadf504f
SHA512 4b7b2efc604267663b34784b189bd1e91d9453d7c1fa1a4bc721357fad332bed46573ce854c55dd25fff018187195c79ac1886d895abb9d44ce2a78ed5d8ffe4

memory/3768-190-0x0000027D59850000-0x0000027D5985A000-memory.dmp

memory/3768-191-0x0000027D71FA0000-0x0000027D71FB2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 0256bd284691ed0fc502ef3c8a7e58dc
SHA1 dcdf69dc8ca8bf068f65d20ef1563bbe283e2413
SHA256 e2fb83098e114084f51ed7187334f861ce670051046c39f338928296ca9a49cf
SHA512 c5b29c1e0a15ddb68b0579848066774fa7cdc6f35087bbbf47c05a5c0dcc1eb3e61b2ddadfbded8c1ed9820e637596a9f08a97db8fb18000d168e6b159060c42

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ba169f4dcbbf147fe78ef0061a95e83b
SHA1 92a571a6eef49fff666e0f62a3545bcd1cdcda67
SHA256 5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1
SHA512 8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

memory/3768-235-0x00007FFF66DE0000-0x00007FFF678A1000-memory.dmp