rhadamanthys | d92446ebe791e563e3db4d04adb539740b37e6b85b29df275c0bc17c9b41a990

Analysis

max time kernel
106s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
InjectToolInstaller.exe
Size 145.9MB
Sample240603-kpbf1aaf88
SHA256 60b0e73f6e060004e86c951d7908cb3b85b3834d41b37d21f18aa577ec6f30fc
MD5 867252881aabdd58ff570ae1b072cd37
SHA1 045738fad2893093ee032fa8832b509040411723
SHA512 915edfe4c338c15bd02e9a86516b603749f7685922203b669ecd833593eccae68d1ef2189bfb4623aa1cfa04f659070df628049274a1851327b6152b50e75ea2
SSDEEP 1572864:b/STiMZrPE+yqPONDf3/1FGipBeowfrnjD62hHLCd/5H:OZzE2OZv1FGiDerTXF9O3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys execution stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5016 created 2564	5016	insta3d311.exe	42

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2064	powershell.exe
3140	powershell.exe
2992	powershell.exe
5728	powershell.exe
2004	powershell.exe
3440	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	InjectToolInstaller.exe

Executes dropped EXE 3 IoCs

pid	Process
4536	data.exe
4300	insta3d311.exe
5016	insta3d311.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4300 set thread context of 5016	4300	insta3d311.exe	154

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5808	5016	WerFault.exe	154
2972	5016	WerFault.exe	154

Runs net.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
2708	PING.EXE
6028	PING.EXE
5156	PING.EXE
1160	PING.EXE
2116	PING.EXE
452	PING.EXE
3752	PING.EXE
376	PING.EXE
1788	PING.EXE
6088	PING.EXE
4144	PING.EXE
3364	PING.EXE
4268	PING.EXE
4620	PING.EXE
2528	PING.EXE
5588	PING.EXE
5884	PING.EXE
5320	PING.EXE
2888	PING.EXE
2656	PING.EXE
4848	PING.EXE
6064	PING.EXE
2120	PING.EXE
3748	PING.EXE
3232	PING.EXE
5528	PING.EXE
5584	PING.EXE
5220	PING.EXE
2652	PING.EXE
2668	PING.EXE
5664	PING.EXE
4704	PING.EXE
4396	PING.EXE
4384	PING.EXE
3332	PING.EXE
3080	PING.EXE
3716	PING.EXE
5748	PING.EXE
5960	PING.EXE
5596	PING.EXE
5168	PING.EXE
5788	PING.EXE
3820	PING.EXE
5244	PING.EXE
2656	PING.EXE
2276	PING.EXE
3244	PING.EXE
4536	PING.EXE
724	PING.EXE
908	PING.EXE
5196	PING.EXE
5704	PING.EXE
5516	PING.EXE
6140	PING.EXE
676	PING.EXE
5984	PING.EXE
4576	PING.EXE
5128	PING.EXE
5920	PING.EXE
2960	PING.EXE
5156	PING.EXE
4324	PING.EXE
4300	PING.EXE
5060	PING.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5728	powershell.exe
5728	powershell.exe
2004	powershell.exe
2004	powershell.exe
3440	powershell.exe
3440	powershell.exe
2064	powershell.exe
2064	powershell.exe
3140	powershell.exe
3140	powershell.exe
2992	powershell.exe
2992	powershell.exe
5016	insta3d311.exe
5016	insta3d311.exe
5700	dialer.exe
5700	dialer.exe
5700	dialer.exe
5700	dialer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5728	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	4300	insta3d311.exe
Token: SeDebugPrivilege	4300	insta3d311.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 3596	1140	InjectToolInstaller.exe	91
PID 1140 wrote to memory of 3596	1140	InjectToolInstaller.exe	91
PID 1140 wrote to memory of 3596	1140	InjectToolInstaller.exe	91
PID 3596 wrote to memory of 3492	3596	cmd.exe	94
PID 3596 wrote to memory of 3492	3596	cmd.exe	94
PID 3596 wrote to memory of 3492	3596	cmd.exe	94
PID 3492 wrote to memory of 2512	3492	cmd.exe	96
PID 3492 wrote to memory of 2512	3492	cmd.exe	96
PID 3492 wrote to memory of 2512	3492	cmd.exe	96
PID 2512 wrote to memory of 5268	2512	cmd.exe	98
PID 2512 wrote to memory of 5268	2512	cmd.exe	98
PID 2512 wrote to memory of 5268	2512	cmd.exe	98
PID 5268 wrote to memory of 5252	5268	net.exe	99
PID 5268 wrote to memory of 5252	5268	net.exe	99
PID 5268 wrote to memory of 5252	5268	net.exe	99
PID 3492 wrote to memory of 5220	3492	cmd.exe	100
PID 3492 wrote to memory of 5220	3492	cmd.exe	100
PID 3492 wrote to memory of 5220	3492	cmd.exe	100
PID 2512 wrote to memory of 5680	2512	cmd.exe	101
PID 2512 wrote to memory of 5680	2512	cmd.exe	101
PID 2512 wrote to memory of 5680	2512	cmd.exe	101
PID 5680 wrote to memory of 5712	5680	cmd.exe	103
PID 5680 wrote to memory of 5712	5680	cmd.exe	103
PID 5680 wrote to memory of 5712	5680	cmd.exe	103
PID 5712 wrote to memory of 5720	5712	net.exe	104
PID 5712 wrote to memory of 5720	5712	net.exe	104
PID 5712 wrote to memory of 5720	5712	net.exe	104
PID 5680 wrote to memory of 5728	5680	cmd.exe	105
PID 5680 wrote to memory of 5728	5680	cmd.exe	105
PID 5680 wrote to memory of 5728	5680	cmd.exe	105
PID 3492 wrote to memory of 5748	3492	cmd.exe	106
PID 3492 wrote to memory of 5748	3492	cmd.exe	106
PID 3492 wrote to memory of 5748	3492	cmd.exe	106
PID 3492 wrote to memory of 6088	3492	cmd.exe	107
PID 3492 wrote to memory of 6088	3492	cmd.exe	107
PID 3492 wrote to memory of 6088	3492	cmd.exe	107
PID 3492 wrote to memory of 5960	3492	cmd.exe	108
PID 3492 wrote to memory of 5960	3492	cmd.exe	108
PID 3492 wrote to memory of 5960	3492	cmd.exe	108
PID 3492 wrote to memory of 6028	3492	cmd.exe	109
PID 3492 wrote to memory of 6028	3492	cmd.exe	109
PID 3492 wrote to memory of 6028	3492	cmd.exe	109
PID 3492 wrote to memory of 3080	3492	cmd.exe	110
PID 3492 wrote to memory of 3080	3492	cmd.exe	110
PID 3492 wrote to memory of 3080	3492	cmd.exe	110
PID 5680 wrote to memory of 2004	5680	cmd.exe	111
PID 5680 wrote to memory of 2004	5680	cmd.exe	111
PID 5680 wrote to memory of 2004	5680	cmd.exe	111
PID 3492 wrote to memory of 4300	3492	cmd.exe	112
PID 3492 wrote to memory of 4300	3492	cmd.exe	112
PID 3492 wrote to memory of 4300	3492	cmd.exe	112
PID 3492 wrote to memory of 724	3492	cmd.exe	113
PID 3492 wrote to memory of 724	3492	cmd.exe	113
PID 3492 wrote to memory of 724	3492	cmd.exe	113
PID 5680 wrote to memory of 3440	5680	cmd.exe	114
PID 5680 wrote to memory of 3440	5680	cmd.exe	114
PID 5680 wrote to memory of 3440	5680	cmd.exe	114
PID 3492 wrote to memory of 5588	3492	cmd.exe	115
PID 3492 wrote to memory of 5588	3492	cmd.exe	115
PID 3492 wrote to memory of 5588	3492	cmd.exe	115
PID 5680 wrote to memory of 2064	5680	cmd.exe	116
PID 5680 wrote to memory of 2064	5680	cmd.exe	116
PID 5680 wrote to memory of 2064	5680	cmd.exe	116
PID 3492 wrote to memory of 2652	3492	cmd.exe	117

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2564
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5700

C:\Users\Admin\AppData\Local\Temp\InjectToolInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\InjectToolInstaller.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zS474C0957\run.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\installer.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\1.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Windows\SysWOW64\net.exe
        
        NET FILE
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5268
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 FILE
        6⤵
        
        PID:5252
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C "C:\Users\Admin\AppData\Local\Temp\1.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5680
      - C:\Windows\SysWOW64\net.exe
        
        NET FILE
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5712
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 FILE
        7⤵
        
        PID:5720
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\Admin\Appdata\Local" -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5728
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\Admin\Appdata\Local" -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\Admin\Appdata\Local" -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3440
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\Admin\Appdata\Local" -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\Admin\Appdata\Local" -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3140
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\Admin\Appdata\Local" -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2992
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        Runs ping.exe
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\data.exe
        
        C:\Users\Admin\AppData\Local\Temp\data.exe -p"bfeuebfmd9AD" -d"C:\Users\Admin\AppData\Local\Temp\"
        6⤵
        Executes dropped EXE
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\insta3d311.exe
        
        C:\Users\Admin\AppData\Local\Temp\insta3d311.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\insta3d311.exe
        
        "C:\Users\Admin\AppData\Local\Temp\insta3d311.exe"
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 444
        8⤵
        Program crash
        
        PID:5808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 440
        8⤵
        Program crash
        
        PID:2972
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5220
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5748
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:6088
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5960
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:6028
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:3080
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:4300
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:724
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5588
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:2652
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:4384
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:4848
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:4576
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:4144
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:3364
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5128
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5156
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:6140
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:4268
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:2668
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:1160
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5596
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:3820
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5244
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:2656
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5060
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:676
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:6064
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5984
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5664
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5168
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5920
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:4704
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5788
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      PID:4136
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:2116
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:908
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:3332
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5528
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:452
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      PID:3312
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:4396
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5884
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5584
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5196
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:4620
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:2960
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:376
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:3752
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5320
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:2528
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:2276
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:3244
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5704
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:2120
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5156
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:5516
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:2888
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:4324
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:2656
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:4536
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:3748
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:1788
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:2708
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5016 -ip 5016
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5016 -ip 5016
1⤵
PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...