Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
31/05/2024, 18:45
General
- Target PK SEARCH 1.2.exe
- Size 8.3MB
- Sample240531-xd97eaab22
- SHA256 30ec0a2d9d0564bb7596326733902c73b69c5ab3572a84e1c077c680372f2cc3
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
-
pksearch
C2
-
186.26.107.205:4400
Mutex
-
zifbymzliwgywfwv
Attributes
-
delay
1
-
install
true
-
install_file
PK SEARCH.exe
-
install_folder
%Temp%
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- VenomRAT 2 IoCs
Detects VenomRAT.
- Async RAT payload 1 IoCs
- Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"8⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"9⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"10⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"11⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"12⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"13⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"14⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"15⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"16⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"17⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"18⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"19⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"20⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"21⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"22⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"26⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"28⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"30⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"32⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"38⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"42⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"44⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"45⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"46⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"48⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"49⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"50⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"51⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"52⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"53⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"54⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"55⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"56⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"57⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"58⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"59⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"61⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"62⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"63⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"64⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"65⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"65⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH.exe"66⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"C:\Users\Admin\AppData\Local\Temp\PK SEARCH 1.2.exe"66⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
PK SEARCH 1.2.exe.log
PK SEARCH.exe.log
PK SEARCH.exe
DataLogs.conf
memory/1928-0-0x00007FF83E493000-0x00007FF83E495000-memory.dmp
memory/1928-1-0x00000000009C0000-0x0000000001218000-memory.dmp
memory/1928-10-0x00007FF83E490000-0x00007FF83EF51000-memory.dmp
memory/1928-19-0x00007FF83E490000-0x00007FF83EF51000-memory.dmp
memory/4240-21-0x00007FF83E490000-0x00007FF83EF51000-memory.dmp
memory/4240-24-0x00007FF83E490000-0x00007FF83EF51000-memory.dmp
memory/4912-20-0x00007FF83E490000-0x00007FF83EF51000-memory.dmp
memory/4912-18-0x00007FF83E490000-0x00007FF83EF51000-memory.dmp
memory/4912-14-0x0000000000E70000-0x0000000000E88000-memory.dmp
memory/4912-36-0x00007FF83E490000-0x00007FF83EF51000-memory.dmp
memory/4912-38-0x00007FF83E490000-0x00007FF83EF51000-memory.dmp
memory/4912-89-0x000000001C4B0000-0x000000001C526000-memory.dmp
memory/4912-90-0x000000001CCF0000-0x000000001CE12000-memory.dmp
memory/4912-91-0x000000001C450000-0x000000001C46E000-memory.dmp
memory/4912-130-0x000000001BF60000-0x000000001BF82000-memory.dmp