Malware Analysis Report

2024-10-10 10:05

Sample ID 240519-c9g6aaee4x
Target a61ecbd90edbc5cc26ed5bc4ab6064ed7ae966cbf517674458d1823746df2bfd
SHA256 a61ecbd90edbc5cc26ed5bc4ab6064ed7ae966cbf517674458d1823746df2bfd
Tags
dcrat umbral xworm execution infostealer rat stealer trojan spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a61ecbd90edbc5cc26ed5bc4ab6064ed7ae966cbf517674458d1823746df2bfd

Threat Level: Known bad

The file a61ecbd90edbc5cc26ed5bc4ab6064ed7ae966cbf517674458d1823746df2bfd was found to be: Known bad.

Malicious Activity Summary

dcrat umbral xworm execution infostealer rat stealer trojan spyware

Umbral

DcRat

Process spawned unexpected child process

Xworm

Detect Xworm Payload

Detect Umbral payload

DCRat payload

Drops file in Drivers directory

Command and Scripting Interpreter: PowerShell

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Detects videocard installed

Runs ping.exe

Views/modifies file attributes

Modifies registry class

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-19 02:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 02:46

Reported

2024-05-19 02:49

Platform

win7-20240221-en

Max time kernel

144s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe"

Signatures

DcRat

rat infostealer dcrat

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

Umbral

stealer umbral

Xworm

trojan rat xworm

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Internet Explorer\images\b75386f1303e64 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Windows Portable Devices\wininit.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Windows Portable Devices\56085415360792 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Windows Media Player\Media Renderer\dwm.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Windows Media Player\Media Renderer\6cb0b6c459d5d3 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Microsoft Analysis Services\audiodg.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Microsoft Analysis Services\42af1c969fbb7b C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Internet Explorer\images\taskhost.exe C:\perfdhcpSvc\Chainprovider.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\AppCompat\smss.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\AppCompat\69ddcba757bf72 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\LiveKernelReports\wininit.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\LiveKernelReports\56085415360792 C:\perfdhcpSvc\Chainprovider.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Umbral.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\perfdhcpSvc\Chainprovider.exe N/A
Token: SeDebugPrivilege N/A C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\cmd.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2176 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Nursultan (17).exe
PID 2176 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Nursultan (17).exe
PID 2176 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Nursultan (17).exe
PID 2176 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 2176 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 2176 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 2176 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 2176 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Umbral.exe
PID 2176 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Umbral.exe
PID 2176 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Umbral.exe
PID 2572 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 2572 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 2572 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 2572 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 1612 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\Nursultan.exe
PID 1612 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\Nursultan.exe
PID 1612 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\Nursultan.exe
PID 1612 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\LoaderMas.exe
PID 1612 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\LoaderMas.exe
PID 1612 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\LoaderMas.exe
PID 2640 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 2640 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 2640 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 2436 wrote to memory of 2816 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 2816 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 2816 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 2816 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1852 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 2816 wrote to memory of 1852 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 2816 wrote to memory of 1852 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 2816 wrote to memory of 1852 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 1852 wrote to memory of 2424 N/A C:\perfdhcpSvc\Chainprovider.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\cmd.exe
PID 1852 wrote to memory of 2424 N/A C:\perfdhcpSvc\Chainprovider.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\cmd.exe
PID 1852 wrote to memory of 2424 N/A C:\perfdhcpSvc\Chainprovider.exe C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\cmd.exe
PID 2444 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2444 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2444 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2444 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2444 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2444 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2444 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2444 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2444 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2444 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2444 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2444 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe

"C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe"

C:\Users\Admin\AppData\Roaming\Nursultan (17).exe

"C:\Users\Admin\AppData\Roaming\Nursultan (17).exe"

C:\Users\Admin\AppData\Roaming\t.bat

"C:\Users\Admin\AppData\Roaming\t.bat"

C:\Users\Admin\AppData\Roaming\Umbral.exe

"C:\Users\Admin\AppData\Roaming\Umbral.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\perfdhcpSvc\LUps3wjkA6jhdk7xRy8J55z2u.vbe"

C:\Users\Admin\AppData\Roaming\Nursultan.exe

"C:\Users\Admin\AppData\Roaming\Nursultan.exe"

C:\Users\Admin\AppData\Roaming\LoaderMas.exe

"C:\Users\Admin\AppData\Roaming\LoaderMas.exe"

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\perfdhcpSvc\mStUjP0ksX5N.bat" "

C:\perfdhcpSvc\Chainprovider.exe

"C:\perfdhcpSvc\Chainprovider.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\perfdhcpSvc\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\perfdhcpSvc\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\perfdhcpSvc\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "NursultanN" /sc MINUTE /mo 11 /tr "'C:\Nurik\Nursultan.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Nursultan" /sc ONLOGON /tr "'C:\Nurik\Nursultan.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "NursultanN" /sc MINUTE /mo 8 /tr "'C:\Nurik\Nursultan.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\AppCompat\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\AppCompat\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\AppCompat\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\LiveKernelReports\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Windows\LiveKernelReports\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Nurik\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Nurik\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Nurik\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\images\taskhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\images\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\cmd.exe'" /rl HIGHEST /f

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\cmd.exe

"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\cmd.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\LoaderMas.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'LoaderMas.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

Network

Country Destination Domain Proto
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 a0948305.xsph.ru udp
RU 141.8.192.103:80 a0948305.xsph.ru tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp

Files

memory/2176-0-0x000007FEF5713000-0x000007FEF5714000-memory.dmp

memory/2176-1-0x0000000000D90000-0x0000000002160000-memory.dmp

C:\Users\Admin\AppData\Roaming\Nursultan (17).exe

MD5 ed965403e795c3b563d67c734472ad93
SHA1 6b8b929239d5ef8f1f546c591c67acaf560de4dc
SHA256 6b7473e7177ef0666f6afe36b257d0730dababefc209ee1c5f2da319dbe1633d
SHA512 bd860103c5ac1bcc02bfefc669616a1b0103dfb3c611b0e4499cf4b1fc67d49c9cd57c1839936b75e0f0008aec0f84cb0af712feb334957972661405a137f649

memory/1612-9-0x0000000000A80000-0x0000000001CBA000-memory.dmp

C:\Users\Admin\AppData\Roaming\t.bat

MD5 d85bd59cf0808fb894f60773e1594a0a
SHA1 84b9d205f3ae6ca4f8f1bb938ee8b4d452444cde
SHA256 f3ef597673421e514d7fed82b40d65386c3811c4a8f5553afd59fc632bca8746
SHA512 225788e3e98449f53e6206c585315a37c9ff6ed0b5425b2a98e50c7ac45ab3c187ccf7626f126ba300bd8dbdf89c864e89f85d6264edc89281745b081ec58f97

C:\Users\Admin\AppData\Roaming\Umbral.exe

MD5 f48ef033300ec9fd3c77afff5c20e95f
SHA1 22d6125b980474b3f54937003a765cdd5352f9a8
SHA256 72ee11a905ca278130f02397422b4cc4944851065ce0072f9888b70c5ad40f1e
SHA512 847ee8cdb14879089c861168d6be90325304df490668a38447b37772423e6dab5e32a5df344ceb58410d3b24cf25cd7221e8768951e5aca14820996a1e8304bc

memory/2640-19-0x0000000000D90000-0x0000000000DD0000-memory.dmp

C:\perfdhcpSvc\LUps3wjkA6jhdk7xRy8J55z2u.vbe

MD5 00b53f3e200522631227cac1a07e0646
SHA1 a0c69d58c7ca10f5fd5e1320b1b2f92081d7fcfe
SHA256 486c050aadc42906113b0c5c8485dff36b0187f343a732542608a91b0565146c
SHA512 22241ae8a31c7e564c9fb652947e4fe17f80c6e94dfe1a3bb5890f6eb97797ee32ccfff5d647eef02bda31bd47c5d95521cd0c6349a01e501e6e064ea6306243

\Users\Admin\AppData\Roaming\Nursultan.exe

MD5 e504e3fc36fe4d6f182c98923979a779
SHA1 3ba9f1a9a15b79639a20cfcf79c9de31d15a17a6
SHA256 70b7b95bb952b3325476867307fc5bd4df5769b97bbcdd8b60e7b46e1b38e4a0
SHA512 63bbbc3ccf14b2846df64b8edae52b6431df52aa9e03569a28ca239ab02db94bf79ca8a0a30529e35a04ee5845768d752b99e6ce3830ab440c57850180ad1647

C:\Users\Admin\AppData\Roaming\LoaderMas.exe

MD5 a0dbdf3af38ead2237ccb781a098a431
SHA1 1434296af6c5530eb036718e860490e0adc3321a
SHA256 6f483da6b36646bf6f33db0c210bd3683ff29428a44d916a2f26a4240c1a9901
SHA512 dd7dc91a2e09b0c3906efbb486fb84d0289dc61338afd75d203f1ab2f49556c9523a8a9abc913363a45dde8194f5b2ee9d3d659807250047331944c39006edc3

memory/2444-38-0x0000000000EA0000-0x0000000000EB6000-memory.dmp

memory/1612-39-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

memory/1800-45-0x00000000773A0000-0x00000000773A2000-memory.dmp

memory/1800-43-0x00000000773A0000-0x00000000773A2000-memory.dmp

memory/1800-41-0x00000000773A0000-0x00000000773A2000-memory.dmp

memory/1800-47-0x0000000140000000-0x0000000142153000-memory.dmp

C:\perfdhcpSvc\mStUjP0ksX5N.bat

MD5 a9330c6da12d90d5d956ae2bbcf017d7
SHA1 7ebaa14eed80db6d9f0c0c0f1ecab1a9c3f61410
SHA256 b49853470383dce14680f656aca7ea449b1d6aabb3f18d4165ebd7e3e7545393
SHA512 557c91cc1cc0d7309f50e286644a2da543c0283d4a1659f7d31554282ddc48b5f972d98d5a01433078fdbe6cc813bb6f7c120e2307fae48c5d81be44ae823228

\perfdhcpSvc\Chainprovider.exe

MD5 d2ec227ddac047e735393e58e742fd44
SHA1 7aae5c76378f7cfcff8bb983695fa4c2577a20e2
SHA256 0e679527f2df9f87d33c82023256fac276c36006579d2d71877ccab4be847cce
SHA512 5a11b292a574bd2ca6c225af1e4c9f95004a49ce816cc59a73d4ab6e2a0b007a58ab56e5e0c004901c3ebe4ec06054e6e801f8e659711856857add6d43f38979

memory/1852-55-0x0000000000B10000-0x0000000000BE6000-memory.dmp

memory/2424-88-0x00000000013D0000-0x00000000014A6000-memory.dmp

memory/2920-93-0x000000001B520000-0x000000001B802000-memory.dmp

memory/2920-94-0x0000000001F50000-0x0000000001F58000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 56f317391a611d8dc997d594012a3c5d
SHA1 1623bbcd445d6299cad4b19e87ac77ccc52ffb7f
SHA256 0bea959750e230358aa4ea7e725f1a84776e35bb6d9f8926d840715cd5c68179
SHA512 4e9d2d0f6a9d471e0059318109f56268b7030403555a966e7ae2fe289fc50eac9ac3b8d98321085ebeade5868eb1cf9ed60dc5a17941937f162e1335ebfff718

memory/1676-100-0x000000001B640000-0x000000001B922000-memory.dmp

memory/1676-101-0x0000000002870000-0x0000000002878000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-19 02:46

Reported

2024-05-19 02:49

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe"

Signatures

DcRat

rat infostealer dcrat

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

Umbral

stealer umbral

Xworm

trojan rat xworm

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Roaming\Umbral.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\t.bat N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Nursultan (17).exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\perfdhcpSvc\Chainprovider.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\perfdhcpSvc\Chainprovider.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Windows Defender\it-IT\sysmon.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\it-IT\sysmon.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Windows Portable Devices\powershell.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Windows Portable Devices\e978f868350d50 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Windows Sidebar\RuntimeBroker.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\0a1fd5f707cd16 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files (x86)\Windows Defender\it-IT\121e5b5079f7c0 C:\perfdhcpSvc\Chainprovider.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\RuntimeBroker.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Windows Sidebar\9e8d7a4ca61bd9 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Windows Sidebar\Shared Gadgets\Umbral.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Windows Sidebar\Shared Gadgets\6feec19d54a440 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\sppsvc.exe C:\perfdhcpSvc\Chainprovider.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Registry.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\ee2ad38f3d4382 C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\PrintDialog\Assets\csrss.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\PrintDialog\Assets\886983d96e3d3e C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\ServiceProfiles\wininit.exe C:\perfdhcpSvc\Chainprovider.exe N/A
File created C:\Windows\ServiceProfiles\56085415360792 C:\perfdhcpSvc\Chainprovider.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\t.bat N/A
Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings C:\perfdhcpSvc\Chainprovider.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Umbral.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\perfdhcpSvc\Chainprovider.exe N/A
N/A N/A C:\perfdhcpSvc\Chainprovider.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\perfdhcpSvc\Chainprovider.exe N/A
N/A N/A C:\perfdhcpSvc\Chainprovider.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
N/A N/A C:\Users\Public\LoaderMas.exe N/A
N/A N/A C:\Users\Public\LoaderMas.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Umbral.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\perfdhcpSvc\Chainprovider.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\perfdhcpSvc\Chainprovider.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4492 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Nursultan (17).exe
PID 4492 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Nursultan (17).exe
PID 4492 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 4492 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 4492 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\t.bat
PID 4492 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Umbral.exe
PID 4492 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe C:\Users\Admin\AppData\Roaming\Umbral.exe
PID 964 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 964 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 964 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Roaming\t.bat C:\Windows\SysWOW64\WScript.exe
PID 4528 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Conhost.exe
PID 4528 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Conhost.exe
PID 3224 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\Nursultan.exe
PID 3224 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\Nursultan.exe
PID 3224 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\LoaderMas.exe
PID 3224 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Roaming\Nursultan (17).exe C:\Users\Admin\AppData\Roaming\LoaderMas.exe
PID 4528 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\SYSTEM32\attrib.exe
PID 4528 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\SYSTEM32\attrib.exe
PID 4528 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\system32\schtasks.exe
PID 4528 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\system32\schtasks.exe
PID 4528 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4744 wrote to memory of 4912 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4744 wrote to memory of 4912 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4744 wrote to memory of 4912 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4912 wrote to memory of 3828 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 4912 wrote to memory of 3828 N/A C:\Windows\SysWOW64\cmd.exe C:\perfdhcpSvc\Chainprovider.exe
PID 3564 wrote to memory of 8 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3564 wrote to memory of 8 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 740 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 740 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3828 wrote to memory of 3116 N/A C:\perfdhcpSvc\Chainprovider.exe C:\perfdhcpSvc\Chainprovider.exe
PID 3828 wrote to memory of 3116 N/A C:\perfdhcpSvc\Chainprovider.exe C:\perfdhcpSvc\Chainprovider.exe
PID 3564 wrote to memory of 428 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3564 wrote to memory of 428 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4528 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4528 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4528 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4528 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4528 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4528 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3564 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3564 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3116 wrote to memory of 1240 N/A C:\perfdhcpSvc\Chainprovider.exe C:\Windows\System32\cmd.exe
PID 3116 wrote to memory of 1240 N/A C:\perfdhcpSvc\Chainprovider.exe C:\Windows\System32\cmd.exe
PID 1240 wrote to memory of 4900 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1240 wrote to memory of 4900 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4528 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4528 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 3564 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3564 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Roaming\LoaderMas.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\SYSTEM32\cmd.exe
PID 4528 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Roaming\Umbral.exe C:\Windows\SYSTEM32\cmd.exe
PID 1464 wrote to memory of 936 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 1464 wrote to memory of 936 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 1240 wrote to memory of 1516 N/A C:\Windows\System32\cmd.exe C:\Users\Public\LoaderMas.exe
PID 1240 wrote to memory of 1516 N/A C:\Windows\System32\cmd.exe C:\Users\Public\LoaderMas.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe

"C:\Users\Admin\AppData\Local\Temp\aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe"

C:\Users\Admin\AppData\Roaming\Nursultan (17).exe

"C:\Users\Admin\AppData\Roaming\Nursultan (17).exe"

C:\Users\Admin\AppData\Roaming\t.bat

"C:\Users\Admin\AppData\Roaming\t.bat"

C:\Users\Admin\AppData\Roaming\Umbral.exe

"C:\Users\Admin\AppData\Roaming\Umbral.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\perfdhcpSvc\LUps3wjkA6jhdk7xRy8J55z2u.vbe"

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Users\Admin\AppData\Roaming\Nursultan.exe

"C:\Users\Admin\AppData\Roaming\Nursultan.exe"

C:\Users\Admin\AppData\Roaming\LoaderMas.exe

"C:\Users\Admin\AppData\Roaming\LoaderMas.exe"

C:\Windows\SYSTEM32\attrib.exe

"attrib.exe" +h +s "C:\Users\Admin\AppData\Roaming\Umbral.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Umbral.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\perfdhcpSvc\mStUjP0ksX5N.bat" "

C:\perfdhcpSvc\Chainprovider.exe

"C:\perfdhcpSvc\Chainprovider.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\sysmon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\sysmon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\sysmon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\powershell.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\powershell.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\powershell.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\sihost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Cookies\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\Cookies\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Cookies\services.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\LoaderMas.exe'

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Windows\ServiceProfiles\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\wininit.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\ServiceProfiles\wininit.exe'" /rl HIGHEST /f

C:\perfdhcpSvc\Chainprovider.exe

"C:\perfdhcpSvc\Chainprovider.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "UmbralU" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\Umbral.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Umbral" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\Umbral.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "UmbralU" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\Umbral.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\perfdhcpSvc\backgroundTaskHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\perfdhcpSvc\backgroundTaskHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\perfdhcpSvc\backgroundTaskHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Registry.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Registry.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'LoaderMas.exe'

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Nurik\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Nurik\services.exe'" /rl HIGHEST /f

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Nurik\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\root\rsod\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\rsod\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\root\rsod\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "LoaderMasL" /sc MINUTE /mo 7 /tr "'C:\Users\Public\LoaderMas.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "LoaderMas" /sc ONLOGON /tr "'C:\Users\Public\LoaderMas.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "LoaderMasL" /sc MINUTE /mo 9 /tr "'C:\Users\Public\LoaderMas.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\perfdhcpSvc\unsecapp.exe'" /f

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\perfdhcpSvc\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\perfdhcpSvc\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\PrintDialog\Assets\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\PrintDialog\Assets\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\PrintDialog\Assets\csrss.exe'" /rl HIGHEST /f

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "UmbralU" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Searches\Umbral.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Umbral" /sc ONLOGON /tr "'C:\Users\Admin\Searches\Umbral.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "UmbralU" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Searches\Umbral.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\perfdhcpSvc\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\perfdhcpSvc\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\perfdhcpSvc\services.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lEEmdmcqAW.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Roaming\Umbral.exe" && pause

C:\Windows\system32\PING.EXE

ping localhost

C:\Users\Public\LoaderMas.exe

"C:\Users\Public\LoaderMas.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 232.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 a0948305.xsph.ru udp
RU 141.8.192.103:80 a0948305.xsph.ru tcp
US 8.8.8.8:53 103.192.8.141.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
N/A 127.0.0.1:30683 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
N/A 127.0.0.1:30683 tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
N/A 127.0.0.1:30683 tcp
N/A 127.0.0.1:30683 tcp
US 8.8.8.8:53 24.173.189.20.in-addr.arpa udp
N/A 127.0.0.1:30683 tcp

Files

memory/4492-0-0x00007FFFE3423000-0x00007FFFE3425000-memory.dmp

memory/4492-1-0x0000000000DD0000-0x00000000021A0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Nursultan (17).exe

MD5 ed965403e795c3b563d67c734472ad93
SHA1 6b8b929239d5ef8f1f546c591c67acaf560de4dc
SHA256 6b7473e7177ef0666f6afe36b257d0730dababefc209ee1c5f2da319dbe1633d
SHA512 bd860103c5ac1bcc02bfefc669616a1b0103dfb3c611b0e4499cf4b1fc67d49c9cd57c1839936b75e0f0008aec0f84cb0af712feb334957972661405a137f649

C:\Users\Admin\AppData\Roaming\t.bat

MD5 d85bd59cf0808fb894f60773e1594a0a
SHA1 84b9d205f3ae6ca4f8f1bb938ee8b4d452444cde
SHA256 f3ef597673421e514d7fed82b40d65386c3811c4a8f5553afd59fc632bca8746
SHA512 225788e3e98449f53e6206c585315a37c9ff6ed0b5425b2a98e50c7ac45ab3c187ccf7626f126ba300bd8dbdf89c864e89f85d6264edc89281745b081ec58f97

C:\Users\Admin\AppData\Roaming\Umbral.exe

MD5 f48ef033300ec9fd3c77afff5c20e95f
SHA1 22d6125b980474b3f54937003a765cdd5352f9a8
SHA256 72ee11a905ca278130f02397422b4cc4944851065ce0072f9888b70c5ad40f1e
SHA512 847ee8cdb14879089c861168d6be90325304df490668a38447b37772423e6dab5e32a5df344ceb58410d3b24cf25cd7221e8768951e5aca14820996a1e8304bc

memory/4528-29-0x000001B22E170000-0x000001B22E1B0000-memory.dmp

memory/3224-30-0x00007FFFE3420000-0x00007FFFE3EE1000-memory.dmp

memory/3224-32-0x00000000009F0000-0x0000000001C2A000-memory.dmp

C:\perfdhcpSvc\LUps3wjkA6jhdk7xRy8J55z2u.vbe

MD5 00b53f3e200522631227cac1a07e0646
SHA1 a0c69d58c7ca10f5fd5e1320b1b2f92081d7fcfe
SHA256 486c050aadc42906113b0c5c8485dff36b0187f343a732542608a91b0565146c
SHA512 22241ae8a31c7e564c9fb652947e4fe17f80c6e94dfe1a3bb5890f6eb97797ee32ccfff5d647eef02bda31bd47c5d95521cd0c6349a01e501e6e064ea6306243

C:\Users\Admin\AppData\Roaming\Nursultan.exe

MD5 e504e3fc36fe4d6f182c98923979a779
SHA1 3ba9f1a9a15b79639a20cfcf79c9de31d15a17a6
SHA256 70b7b95bb952b3325476867307fc5bd4df5769b97bbcdd8b60e7b46e1b38e4a0
SHA512 63bbbc3ccf14b2846df64b8edae52b6431df52aa9e03569a28ca239ab02db94bf79ca8a0a30529e35a04ee5845768d752b99e6ce3830ab440c57850180ad1647

C:\Users\Admin\AppData\Roaming\LoaderMas.exe

MD5 a0dbdf3af38ead2237ccb781a098a431
SHA1 1434296af6c5530eb036718e860490e0adc3321a
SHA256 6f483da6b36646bf6f33db0c210bd3683ff29428a44d916a2f26a4240c1a9901
SHA512 dd7dc91a2e09b0c3906efbb486fb84d0289dc61338afd75d203f1ab2f49556c9523a8a9abc913363a45dde8194f5b2ee9d3d659807250047331944c39006edc3

memory/3564-60-0x0000000000550000-0x0000000000566000-memory.dmp

memory/3224-61-0x00007FFFE3420000-0x00007FFFE3EE1000-memory.dmp

memory/1796-67-0x000002D5EF1E0000-0x000002D5EF202000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g3nr0p44.ymp.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

memory/4528-89-0x000001B2488D0000-0x000001B248946000-memory.dmp

memory/4528-90-0x000001B248950000-0x000001B2489A0000-memory.dmp

memory/4528-91-0x000001B22E800000-0x000001B22E81E000-memory.dmp

C:\perfdhcpSvc\mStUjP0ksX5N.bat

MD5 a9330c6da12d90d5d956ae2bbcf017d7
SHA1 7ebaa14eed80db6d9f0c0c0f1ecab1a9c3f61410
SHA256 b49853470383dce14680f656aca7ea449b1d6aabb3f18d4165ebd7e3e7545393
SHA512 557c91cc1cc0d7309f50e286644a2da543c0283d4a1659f7d31554282ddc48b5f972d98d5a01433078fdbe6cc813bb6f7c120e2307fae48c5d81be44ae823228

C:\perfdhcpSvc\Chainprovider.exe

MD5 d2ec227ddac047e735393e58e742fd44
SHA1 7aae5c76378f7cfcff8bb983695fa4c2577a20e2
SHA256 0e679527f2df9f87d33c82023256fac276c36006579d2d71877ccab4be847cce
SHA512 5a11b292a574bd2ca6c225af1e4c9f95004a49ce816cc59a73d4ab6e2a0b007a58ab56e5e0c004901c3ebe4ec06054e6e801f8e659711856857add6d43f38979

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c9b6705519e1eef08f86c4ba5f4286f3
SHA1 6c6b179e452ecee2673a1d4fe128f1c06f70577f
SHA256 0f9cad44a79126871580e19b01dc3f880c5173b1faaf8b9018d5d1f829714705
SHA512 6d8f85a7a8b0b124530f36a157cd0441b5c1eacdc35e274af9fbf0569d03d1d5e468651a5b2425f0215c282ecfa7b1ffeaeeaf18612822f00bd14306d30640c7

memory/3828-118-0x0000000000BB0000-0x0000000000C86000-memory.dmp

memory/3100-127-0x00007FF8018B0000-0x00007FF8018B2000-memory.dmp

memory/3100-131-0x0000000140000000-0x0000000142153000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 88be3bc8a7f90e3953298c0fdbec4d72
SHA1 f4969784ad421cc80ef45608727aacd0f6bf2e4b
SHA256 533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a
SHA512 4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Chainprovider.exe.log

MD5 7f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1 d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256 519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA512 8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 4eca582877fff3abc42079f583f982af
SHA1 d084a5d61da23a81a4f13d0eac10f48fbde8b61b
SHA256 fe13f58df91c349f796584295109f730dad7f4eb29bcca5e5b58e7f444aa4ab4
SHA512 ad164f3ed95cfcc2a3c359e9891a723296871f5372a05a61888ed708ba346d903ca5229143a504bdfc7f2d487a58c418aeaedcd0c412ad25371cdf0f8d1d1c6f

memory/4528-172-0x000001B248890000-0x000001B2488A2000-memory.dmp

memory/4528-171-0x000001B248860000-0x000001B24886A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9c740b7699e2363ac4ecdf496520ca35
SHA1 aa8691a8c56500d82c5fc8c35209bc6fe50ab1d9
SHA256 be96c91b62ba9ba7072ab89e66543328c9e4395150f9dbe8067332d94a3ecc61
SHA512 8885683f96353582eb871209e766e7eba1a72a2837ce27ea298b7b5b169621d1fa3fce25346b6bfd258b52642644234da9559d4e765a2023a5a5fc1f544cc7af

C:\Users\Admin\AppData\Local\Temp\lEEmdmcqAW.bat

MD5 359a0ea7b6f421d9e0023c6961c66690
SHA1 d9eeb36d482c2da0b4e1d8e1e72492b2725822d2
SHA256 8da91e72c1c14a6ca8d7f0e47c8bc91f8b4286082a15a788a8816a836e45aa9c
SHA512 324ada4d0bb298f21c0f81d5e185cd6ec35617726f2822365c4a99ce169c4e4ba7336396cd45999d6f6efab2029ba63fd8139fee29b9c13bd942027e42ae921a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 22310ad6749d8cc38284aa616efcd100
SHA1 440ef4a0a53bfa7c83fe84326a1dff4326dcb515
SHA256 55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
SHA512 2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def