Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 01:03
Static task
static1
Behavioral task
behavioral1
Sample
30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe
Resource
win7-20240221-en
General
-
Target
30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe
-
Size
515KB
-
MD5
148b2c38cf0726535d760a703f803c80
-
SHA1
107503ca149f547d4745fe9b9a3fbae03d60126c
-
SHA256
30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d
-
SHA512
6b9c13d80fb24924604245f9046c28df75d009c6cd6f819ef2ac6e99a592acfc84473b4fcc6e2c1ccafd6001bb4a931a8ced6a968bd874e2ebf81cd8c714bdbd
-
SSDEEP
12288:EMbx504bFjsNfn8lmwaYy//2hWc8CYBMQI4aqNA:Lbw4bR689aYy//2hDPYBMQI4aqN
Malware Config
Extracted
xworm
127.0.0.1:7000
beshomandotestbesnd.run.place:7000
-
Install_directory
%ProgramData%
-
install_file
cmd.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
Extracted
redline
DOCX
beshomandotestbesnd.run.place:1111
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/1560-183-0x0000000008E50000-0x0000000008E5E000-memory.dmp disable_win_def -
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1560-44-0x0000000000400000-0x0000000000418000-memory.dmp family_xworm -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1560-179-0x0000000007680000-0x000000000769E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1560-179-0x0000000007680000-0x000000000769E000-memory.dmp family_sectoprat -
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1560-179-0x0000000007680000-0x000000000769E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1560-44-0x0000000000400000-0x0000000000418000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1560-183-0x0000000008E50000-0x0000000008E5E000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender -
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1560-183-0x0000000008E50000-0x0000000008E5E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender -
Detects executables using Telegram Chat Bot 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1560-44-0x0000000000400000-0x0000000000418000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TelegramChatBot -
Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 1540 powershell.exe 1992 powershell.exe 980 powershell.exe 2928 powershell.exe 3752 powershell.exe 4208 powershell.exe 2196 powershell.exe 2044 powershell.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.execmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation cmd.exe -
Drops startup file 2 IoCs
Processes:
30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cmd.lnk 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cmd.lnk 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe -
Executes dropped EXE 3 IoCs
Processes:
cmd.execmd.execmd.exepid process 1652 cmd.exe 2356 cmd.exe 2428 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "C:\\ProgramData\\cmd.exe" 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.execmd.exedescription pid process target process PID 644 set thread context of 1560 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe PID 1652 set thread context of 2356 1652 cmd.exe cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1564 schtasks.exe 3384 schtasks.exe 5056 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exepid process 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.execmd.exepowershell.exepowershell.exepid process 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 1992 powershell.exe 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 1992 powershell.exe 1992 powershell.exe 980 powershell.exe 980 powershell.exe 980 powershell.exe 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 2928 powershell.exe 2928 powershell.exe 3752 powershell.exe 3752 powershell.exe 4208 powershell.exe 4208 powershell.exe 2196 powershell.exe 2196 powershell.exe 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 1652 cmd.exe 2044 powershell.exe 2044 powershell.exe 1652 cmd.exe 1540 powershell.exe 1652 cmd.exe 1540 powershell.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exepowershell.exepowershell.exe30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exepowershell.exepowershell.exepowershell.exepowershell.execmd.exepowershell.exepowershell.execmd.exedescription pid process Token: SeDebugPrivilege 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe Token: SeDebugPrivilege 1992 powershell.exe Token: SeDebugPrivilege 980 powershell.exe Token: SeDebugPrivilege 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe Token: SeDebugPrivilege 2928 powershell.exe Token: SeDebugPrivilege 3752 powershell.exe Token: SeDebugPrivilege 4208 powershell.exe Token: SeDebugPrivilege 2196 powershell.exe Token: SeDebugPrivilege 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe Token: SeDebugPrivilege 1652 cmd.exe Token: SeDebugPrivilege 2044 powershell.exe Token: SeDebugPrivilege 1540 powershell.exe Token: SeDebugPrivilege 2356 cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exepid process 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.execmd.exedescription pid process target process PID 644 wrote to memory of 1992 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 644 wrote to memory of 1992 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 644 wrote to memory of 1992 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 644 wrote to memory of 980 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 644 wrote to memory of 980 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 644 wrote to memory of 980 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 644 wrote to memory of 1564 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe schtasks.exe PID 644 wrote to memory of 1564 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe schtasks.exe PID 644 wrote to memory of 1564 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe schtasks.exe PID 644 wrote to memory of 1560 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe PID 644 wrote to memory of 1560 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe PID 644 wrote to memory of 1560 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe PID 644 wrote to memory of 1560 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe PID 644 wrote to memory of 1560 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe PID 644 wrote to memory of 1560 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe PID 644 wrote to memory of 1560 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe PID 644 wrote to memory of 1560 644 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe PID 1560 wrote to memory of 2928 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 1560 wrote to memory of 2928 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 1560 wrote to memory of 2928 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 1560 wrote to memory of 3752 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 1560 wrote to memory of 3752 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 1560 wrote to memory of 3752 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 1560 wrote to memory of 4208 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 1560 wrote to memory of 4208 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 1560 wrote to memory of 4208 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 1560 wrote to memory of 2196 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 1560 wrote to memory of 2196 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 1560 wrote to memory of 2196 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe powershell.exe PID 1560 wrote to memory of 3384 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe schtasks.exe PID 1560 wrote to memory of 3384 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe schtasks.exe PID 1560 wrote to memory of 3384 1560 30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe schtasks.exe PID 1652 wrote to memory of 2044 1652 cmd.exe powershell.exe PID 1652 wrote to memory of 2044 1652 cmd.exe powershell.exe PID 1652 wrote to memory of 2044 1652 cmd.exe powershell.exe PID 1652 wrote to memory of 1540 1652 cmd.exe powershell.exe PID 1652 wrote to memory of 1540 1652 cmd.exe powershell.exe PID 1652 wrote to memory of 1540 1652 cmd.exe powershell.exe PID 1652 wrote to memory of 5056 1652 cmd.exe schtasks.exe PID 1652 wrote to memory of 5056 1652 cmd.exe schtasks.exe PID 1652 wrote to memory of 5056 1652 cmd.exe schtasks.exe PID 1652 wrote to memory of 2356 1652 cmd.exe cmd.exe PID 1652 wrote to memory of 2356 1652 cmd.exe cmd.exe PID 1652 wrote to memory of 2356 1652 cmd.exe cmd.exe PID 1652 wrote to memory of 2356 1652 cmd.exe cmd.exe PID 1652 wrote to memory of 2356 1652 cmd.exe cmd.exe PID 1652 wrote to memory of 2356 1652 cmd.exe cmd.exe PID 1652 wrote to memory of 2356 1652 cmd.exe cmd.exe PID 1652 wrote to memory of 2356 1652 cmd.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe"C:\Users\Admin\AppData\Local\Temp\30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DzmQEVPXhX.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DzmQEVPXhX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7753.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe"C:\Users\Admin\AppData\Local\Temp\30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe"2⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\cmd.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'cmd.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "cmd" /tr "C:\ProgramData\cmd.exe"3⤵
- Creates scheduled task(s)
-
C:\ProgramData\cmd.exeC:\ProgramData\cmd.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\cmd.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DzmQEVPXhX.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DzmQEVPXhX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD472.tmp"2⤵
- Creates scheduled task(s)
-
C:\ProgramData\cmd.exe"C:\ProgramData\cmd.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\cmd.exeC:\ProgramData\cmd.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\cmd.exeFilesize
515KB
MD5148b2c38cf0726535d760a703f803c80
SHA1107503ca149f547d4745fe9b9a3fbae03d60126c
SHA25630a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d
SHA5126b9c13d80fb24924604245f9046c28df75d009c6cd6f819ef2ac6e99a592acfc84473b4fcc6e2c1ccafd6001bb4a931a8ced6a968bd874e2ebf81cd8c714bdbd
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cmd.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD5124edf3ad57549a6e475f3bc4e6cfe51
SHA180f5187eeebb4a304e9caa0ce66fcd78c113d634
SHA256638c51e173ca6b3469494a7e2e0b656021a761f77b4a83f3e430e82e7b9af675
SHA512b6c1a9051feeffad54ba1092fd799d34a9578368d7e66b31780fe478c1def0eb4094dce2879003f7389f2f9d86b94a3ef3975e78092a604597841c9b8db120ee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD52f530fe69763359284ca52b19a0f8a67
SHA191dc820889dce2ff70a26281af3f886e6f03522f
SHA2568ccd94a5e09802af641e499cb24f2f8bb729f8574184484b28f56cfeb1dd65c3
SHA512d1bb90ab1dee9f9b3e702e0308f5055336b2fb5a717d6392e8b22dc4f44ea8521be2af021e214135b80fbd2c5fe649488c276a189050680c7f6bea1ce32ab059
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD55fb884b45ca060bbec75967810944237
SHA1f60b194e10a8885e416926bca4cfe0221beae11a
SHA256e55ef12509bf4a5df19ef9982b4ef25fc9d2475bd438292f9a03bf3a172af3d8
SHA5121af0608bb1663b806b8e2773bd13e6c4f455d418ad9789aefaa83577b5d04c04fd791b95301b9039bfca0d31ff4b20681cc1aa33ab61ecfe1cacb022078b1d46
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5672d679d0e538434476522e103be05ef
SHA153ae92ff4ae9e65be78b38f32ad0c97346d4481f
SHA25642025d1d93f24696be3db551e5acc5e7bc2d238b1e2074d5ff676120a589c257
SHA5123a157da56e2e576d400a8dc98f62803330dd0637b364172f8a6feaa93b771acfe8de865e1aa3ed2f1928c28bba636c1db0748d1d93f26284751b9e2ff4615221
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD588940ab8cd6b1de9022be531c7364903
SHA1530f8d4017f22d3a45f61a97aa3911b788860562
SHA25685dbcbb447908313e75e1a893d53939a2c2c2234b8c0170f7fe4569a432e8b17
SHA5126a2cb4363b9a4be5bdfd05890941564ccec38ef1e9a888cc11ad83f4fbcdba63d026e77b31ef2ebc4e641c569f1522216d0c9cedf4814acd9107da4954ce45bf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
15KB
MD5ee4e482ccc5d0d6097cf9fe7db6a81fb
SHA16163390e9df6191732001377564c7009559bf6f5
SHA256a6138cd93aa305df63c9878fa8652b21d2a9c1d4ccdb05d33d09af88d8c09ffe
SHA5120bb0c7de57f324b999e4c25b1f2a0cc32d357ba7629f0417a507a1c4edef44090cfb3d3b0dde0eb3db2996598757628d326078b3e3693dd03fad3b2cd8c84dc5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5f3addef1cb403d907e161be53380d0ea
SHA1911c81932c4079eb07140942cbdcff89b7d6e759
SHA256ec7e4f5d589009fc9ed83b6746b612ba3d295d05aff29576ed6f4389ae2ee07d
SHA512e081cdb701834d18b449aac8ca607009fd24fc002cb00759071c451e3782f58d35fdd2c8ffaedb51998dc0c08dbb0a07e255964f1eec643f144199da6ebbb353
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yozyftnv.uxm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp7753.tmpFilesize
1KB
MD5fe39377304e5cc1e2a728f63dcf70c18
SHA1eb8f20badfc04e38a872004d962133f379de9e69
SHA2568edf7f6d800fb82f733370b6e9583b304b05cef4dbadd25113a5b1e74fb49388
SHA5129d115783d530666e4c0c7887beb507158c8a0f3e3b76cde9cf84be6cd0d747dd30e8269136d0960e9495b493f71fabb93eed6bc8bc57dae40c7362007ff89b77
-
C:\Users\Admin\AppData\Local\Temp\tmpF609.tmpFilesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
C:\Users\Admin\AppData\Local\Temp\tmpF62E.tmpFilesize
100KB
MD5bfbf67a3ad4b5c0f7804f85d1f449a80
SHA1110780a35d61de23b5fcb7b9e75a3ed07deb7838
SHA2562a38ab429847061aa3c614982e801e2e7139977a227466ce5ee61fa382a2bc2e
SHA51277bd3011b5d0074af16b93a5ab1967379a0a032bbf43c1e7b6ef205aeb27454e079c94e419bea6f7d730dc84b632e44250203a508fcdcd864ada9888381f4fdd
-
C:\Users\Admin\AppData\Local\Temp\tmpF669.tmpFilesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
C:\Users\Admin\AppData\Local\Temp\tmpF67F.tmpFilesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
C:\Users\Admin\AppData\Local\Temp\tmpF695.tmpFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\Users\Admin\AppData\Local\Temp\tmpF6CF.tmpFilesize
96KB
MD5d367ddfda80fdcf578726bc3b0bc3e3c
SHA123fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA2560b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA51240e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77
-
memory/644-7-0x0000000005E60000-0x0000000005E70000-memory.dmpFilesize
64KB
-
memory/644-9-0x000000000AB30000-0x000000000ABCC000-memory.dmpFilesize
624KB
-
memory/644-8-0x0000000006C50000-0x0000000006CAA000-memory.dmpFilesize
360KB
-
memory/644-0-0x000000007465E000-0x000000007465F000-memory.dmpFilesize
4KB
-
memory/644-6-0x00000000084D0000-0x00000000084EA000-memory.dmpFilesize
104KB
-
memory/644-46-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/644-5-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/644-4-0x00000000057C0000-0x00000000057CA000-memory.dmpFilesize
40KB
-
memory/644-3-0x00000000057D0000-0x0000000005862000-memory.dmpFilesize
584KB
-
memory/644-2-0x0000000005E70000-0x0000000006414000-memory.dmpFilesize
5.6MB
-
memory/644-1-0x0000000000D40000-0x0000000000DC8000-memory.dmpFilesize
544KB
-
memory/980-62-0x000000006F070000-0x000000006F0BC000-memory.dmpFilesize
304KB
-
memory/980-75-0x0000000007BA0000-0x0000000007BAE000-memory.dmpFilesize
56KB
-
memory/1560-183-0x0000000008E50000-0x0000000008E5E000-memory.dmpFilesize
56KB
-
memory/1560-209-0x000000000C4D0000-0x000000000C4E4000-memory.dmpFilesize
80KB
-
memory/1560-367-0x000000000B880000-0x000000000B89E000-memory.dmpFilesize
120KB
-
memory/1560-366-0x000000000BC70000-0x000000000BCE6000-memory.dmpFilesize
472KB
-
memory/1560-211-0x000000000C800000-0x000000000CD2C000-memory.dmpFilesize
5.2MB
-
memory/1560-210-0x000000000BAA0000-0x000000000BC62000-memory.dmpFilesize
1.8MB
-
memory/1560-208-0x000000000C4A0000-0x000000000C4B1000-memory.dmpFilesize
68KB
-
memory/1560-207-0x000000000C3A0000-0x000000000C443000-memory.dmpFilesize
652KB
-
memory/1560-197-0x000000000A9A0000-0x000000000ACF4000-memory.dmpFilesize
3.3MB
-
memory/1560-196-0x000000000A890000-0x000000000A99A000-memory.dmpFilesize
1.0MB
-
memory/1560-195-0x0000000009F30000-0x0000000009F7A000-memory.dmpFilesize
296KB
-
memory/1560-194-0x0000000009DD0000-0x0000000009DF2000-memory.dmpFilesize
136KB
-
memory/1560-184-0x0000000009240000-0x000000000928C000-memory.dmpFilesize
304KB
-
memory/1560-182-0x0000000009030000-0x000000000906C000-memory.dmpFilesize
240KB
-
memory/1560-181-0x0000000008E90000-0x0000000008EA2000-memory.dmpFilesize
72KB
-
memory/1560-180-0x0000000009400000-0x0000000009A18000-memory.dmpFilesize
6.1MB
-
memory/1560-179-0x0000000007680000-0x000000000769E000-memory.dmpFilesize
120KB
-
memory/1560-44-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1992-22-0x0000000005490000-0x00000000054F6000-memory.dmpFilesize
408KB
-
memory/1992-21-0x00000000053A0000-0x0000000005406000-memory.dmpFilesize
408KB
-
memory/1992-47-0x0000000006A80000-0x0000000006AB2000-memory.dmpFilesize
200KB
-
memory/1992-10-0x0000000004520000-0x0000000004556000-memory.dmpFilesize
216KB
-
memory/1992-60-0x0000000007460000-0x0000000007ADA000-memory.dmpFilesize
6.5MB
-
memory/1992-12-0x0000000004D00000-0x0000000005328000-memory.dmpFilesize
6.2MB
-
memory/1992-58-0x0000000006AC0000-0x0000000006ADE000-memory.dmpFilesize
120KB
-
memory/1992-78-0x0000000007140000-0x0000000007148000-memory.dmpFilesize
32KB
-
memory/1992-11-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/1992-77-0x0000000007160000-0x000000000717A000-memory.dmpFilesize
104KB
-
memory/1992-13-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/1992-33-0x0000000005EF0000-0x0000000005F3C000-memory.dmpFilesize
304KB
-
memory/1992-73-0x00000000070A0000-0x0000000007136000-memory.dmpFilesize
600KB
-
memory/1992-74-0x0000000007020000-0x0000000007031000-memory.dmpFilesize
68KB
-
memory/1992-84-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/1992-59-0x0000000006AE0000-0x0000000006B83000-memory.dmpFilesize
652KB
-
memory/1992-48-0x000000006F070000-0x000000006F0BC000-memory.dmpFilesize
304KB
-
memory/1992-14-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/1992-15-0x0000000004C30000-0x0000000004C52000-memory.dmpFilesize
136KB
-
memory/1992-72-0x0000000006E90000-0x0000000006E9A000-memory.dmpFilesize
40KB
-
memory/1992-76-0x0000000007060000-0x0000000007074000-memory.dmpFilesize
80KB
-
memory/1992-61-0x0000000006E20000-0x0000000006E3A000-memory.dmpFilesize
104KB
-
memory/1992-32-0x0000000005AD0000-0x0000000005AEE000-memory.dmpFilesize
120KB
-
memory/1992-30-0x0000000005500000-0x0000000005854000-memory.dmpFilesize
3.3MB
-
memory/2196-164-0x000000006FC60000-0x000000006FCAC000-memory.dmpFilesize
304KB
-
memory/2928-107-0x00000000077D0000-0x0000000007873000-memory.dmpFilesize
652KB
-
memory/2928-109-0x0000000007B00000-0x0000000007B14000-memory.dmpFilesize
80KB
-
memory/2928-85-0x0000000005ED0000-0x0000000006224000-memory.dmpFilesize
3.3MB
-
memory/2928-96-0x00000000068D0000-0x000000000691C000-memory.dmpFilesize
304KB
-
memory/2928-97-0x000000006FC60000-0x000000006FCAC000-memory.dmpFilesize
304KB
-
memory/2928-108-0x0000000007AC0000-0x0000000007AD1000-memory.dmpFilesize
68KB
-
memory/3752-121-0x000000006FC60000-0x000000006FCAC000-memory.dmpFilesize
304KB
-
memory/4208-141-0x00000000058F0000-0x0000000005C44000-memory.dmpFilesize
3.3MB
-
memory/4208-143-0x000000006FC60000-0x000000006FCAC000-memory.dmpFilesize
304KB