dcrat | 1b1fd567e4973e0c36be88aaf8613c4ac4f4137b8e1c4413b26a252b061265d9

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23/06/2024, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1b1fd567e4973e0c36be88aaf8613c4ac4f4137b8e1c4413b26a252b061265d9_NeikiAnalytics.exe
Size 6.2MB
Sample240623-23se4sxalg
SHA256 1b1fd567e4973e0c36be88aaf8613c4ac4f4137b8e1c4413b26a252b061265d9
MD5 a38dd1578d19d14ea367565479df8a10
SHA1 c6da3b5640e92cf1204621b681a8e373a6ee3d85
SHA512 224ef857bdff71610215a8bbd626ec67924c27202f678f5ae780ef21327c3bad98b0946a94cb7839040f3e5ab35b69d56512c002d8fca82858947ff3066a46ca
SSDEEP 196608:FFmHVVbrzB5LrnScgbs/czr2wOc8vU1vACjSVo3LeuxM:FWfLrnScgbs/6r2wU4Y03Leux
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion execution infostealer persistence pyinstaller rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	732	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4356	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3836	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3828	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3252	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	4492	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	4492	schtasks.exe	95

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Containerhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Containerhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Containerhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000d000000023450-30.dat	dcrat
behavioral2/files/0x0007000000023454-47.dat	dcrat
behavioral2/memory/952-49-0x0000000000DC0000-0x00000000011C2000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3360	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	1b1fd567e4973e0c36be88aaf8613c4ac4f4137b8e1c4413b26a252b061265d9_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	LoaderCheat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Containerhost.exe

Executes dropped EXE 4 IoCs

pid	Process
2680	main.exe
4660	LoaderCheat.exe
952	Containerhost.exe
4920	dllhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\main = "C:\\Windows\\System32\\main.exe"	1b1fd567e4973e0c36be88aaf8613c4ac4f4137b8e1c4413b26a252b061265d9_NeikiAnalytics.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Containerhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Containerhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
33	pastebin.com
34	pastebin.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\main.exe	1b1fd567e4973e0c36be88aaf8613c4ac4f4137b8e1c4413b26a252b061265d9_NeikiAnalytics.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\f3b6ecef712a24	Containerhost.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\AppxMetadata\services.exe	Containerhost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\38384e6a620884	Containerhost.exe
File created	C:\Program Files\ModifiableWindowsApps\fontdrvhost.exe	Containerhost.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\spoolsv.exe	Containerhost.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\csrss.exe	Containerhost.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\886983d96e3d3e	Containerhost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\SearchApp.exe	Containerhost.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe	Containerhost.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\5b884080fd4f94	Containerhost.exe
File created	C:\Program Files\Windows Multimedia Platform\Registry.exe	Containerhost.exe
File created	C:\Program Files\Windows Multimedia Platform\ee2ad38f3d4382	Containerhost.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\LanguageOverlayCache\spoolsv.exe	Containerhost.exe
File created	C:\Windows\Resources\Ease of Access Themes\RuntimeBroker.exe	Containerhost.exe
File created	C:\Windows\Resources\Ease of Access Themes\9e8d7a4ca61bd9	Containerhost.exe
File created	C:\Windows\uk-UA\SppExtComObj.exe	Containerhost.exe
File opened for modification	C:\Windows\uk-UA\SppExtComObj.exe	Containerhost.exe
File created	C:\Windows\uk-UA\e1ef82546f0b02	Containerhost.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\conhost.exe	Containerhost.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\088424020bedd6	Containerhost.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000e0000000233a3-22.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	LoaderCheat.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Containerhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
376	schtasks.exe
2688	schtasks.exe
2668	schtasks.exe
1908	schtasks.exe
1604	schtasks.exe
4488	schtasks.exe
4908	schtasks.exe
3252	schtasks.exe
1388	schtasks.exe
868	schtasks.exe
4428	schtasks.exe
732	schtasks.exe
3020	schtasks.exe
4508	schtasks.exe
4688	schtasks.exe
2960	schtasks.exe
4272	schtasks.exe
2100	schtasks.exe
112	schtasks.exe
1200	schtasks.exe
2788	schtasks.exe
1632	schtasks.exe
2956	schtasks.exe
1036	schtasks.exe
3064	schtasks.exe
4132	schtasks.exe
1532	schtasks.exe
4952	schtasks.exe
5032	schtasks.exe
2436	schtasks.exe
1840	schtasks.exe
212	schtasks.exe
2692	schtasks.exe
1488	schtasks.exe
2176	schtasks.exe
1828	schtasks.exe
3828	schtasks.exe
4484	schtasks.exe
956	schtasks.exe
1012	schtasks.exe
2220	schtasks.exe
3068	schtasks.exe
2496	schtasks.exe
4016	schtasks.exe
3836	schtasks.exe
3460	schtasks.exe
1804	schtasks.exe
4472	schtasks.exe
1428	schtasks.exe
4252	schtasks.exe
752	schtasks.exe
4356	schtasks.exe
556	schtasks.exe
2548	schtasks.exe
3340	schtasks.exe
4256	schtasks.exe
2540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3360	powershell.exe
3360	powershell.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
952	Containerhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe
4920	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4920	dllhost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	powershell.exe
Token: SeDebugPrivilege	952	Containerhost.exe
Token: SeDebugPrivilege	4920	dllhost.exe
Token: SeBackupPrivilege	3828	vssvc.exe
Token: SeRestorePrivilege	3828	vssvc.exe
Token: SeAuditPrivilege	3828	vssvc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 3360	4540	1b1fd567e4973e0c36be88aaf8613c4ac4f4137b8e1c4413b26a252b061265d9_NeikiAnalytics.exe	86
PID 4540 wrote to memory of 3360	4540	1b1fd567e4973e0c36be88aaf8613c4ac4f4137b8e1c4413b26a252b061265d9_NeikiAnalytics.exe	86
PID 4540 wrote to memory of 2680	4540	1b1fd567e4973e0c36be88aaf8613c4ac4f4137b8e1c4413b26a252b061265d9_NeikiAnalytics.exe	88
PID 4540 wrote to memory of 2680	4540	1b1fd567e4973e0c36be88aaf8613c4ac4f4137b8e1c4413b26a252b061265d9_NeikiAnalytics.exe	88
PID 4540 wrote to memory of 4660	4540	1b1fd567e4973e0c36be88aaf8613c4ac4f4137b8e1c4413b26a252b061265d9_NeikiAnalytics.exe	90
PID 4540 wrote to memory of 4660	4540	1b1fd567e4973e0c36be88aaf8613c4ac4f4137b8e1c4413b26a252b061265d9_NeikiAnalytics.exe	90
PID 4540 wrote to memory of 4660	4540	1b1fd567e4973e0c36be88aaf8613c4ac4f4137b8e1c4413b26a252b061265d9_NeikiAnalytics.exe	90
PID 4660 wrote to memory of 1388	4660	LoaderCheat.exe	93
PID 4660 wrote to memory of 1388	4660	LoaderCheat.exe	93
PID 4660 wrote to memory of 1388	4660	LoaderCheat.exe	93
PID 1388 wrote to memory of 1744	1388	WScript.exe	96
PID 1388 wrote to memory of 1744	1388	WScript.exe	96
PID 1388 wrote to memory of 1744	1388	WScript.exe	96
PID 1744 wrote to memory of 952	1744	cmd.exe	98
PID 1744 wrote to memory of 952	1744	cmd.exe	98
PID 952 wrote to memory of 2344	952	Containerhost.exe	157
PID 952 wrote to memory of 2344	952	Containerhost.exe	157
PID 2344 wrote to memory of 4896	2344	cmd.exe	159
PID 2344 wrote to memory of 4896	2344	cmd.exe	159
PID 2344 wrote to memory of 4920	2344	cmd.exe	162
PID 2344 wrote to memory of 4920	2344	cmd.exe	162

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Containerhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Containerhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Containerhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1b1fd567e4973e0c36be88aaf8613c4ac4f4137b8e1c4413b26a252b061265d9_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1b1fd567e4973e0c36be88aaf8613c4ac4f4137b8e1c4413b26a252b061265d9_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\main.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3360
- C:\Windows\System32\main.exe
  "C:\Windows\System32\main.exe"
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Users\Admin\AppData\Local\Temp\LoaderCheat.exe
  "C:\Users\Admin\AppData\Local\Temp\LoaderCheat.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Chainfontdrivercommon\7DA0rRy5BYBUWcNRP5GHO88fQe.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Chainfontdrivercommon\MeIPmAcW0PUqVssXh.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1744
    - - C:\Chainfontdrivercommon\Containerhost.exe
        
        "C:\Chainfontdrivercommon\Containerhost.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:952
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R3otf5C6o0.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4896
        
        C:\Chainfontdrivercommon\dllhost.exe
        
        "C:\Chainfontdrivercommon\dllhost.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\uk-UA\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\uk-UA\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\uk-UA\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Chainfontdrivercommon\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Chainfontdrivercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Chainfontdrivercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Documents\My Videos\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Documents\My Videos\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Chainfontdrivercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Chainfontdrivercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Chainfontdrivercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Users\Default\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Users\Default\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\Resources\Ease of Access Themes\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\Resources\Ease of Access Themes\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Chainfontdrivercommon\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Chainfontdrivercommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Chainfontdrivercommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Music\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Default\Music\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Music\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7DA0rRy5BYBUWcNRP5GHO88fQe.vbe

Path C:\Chainfontdrivercommon\7DA0rRy5BYBUWcNRP5GHO88fQe.vbe
Size 215B
SHA256 8d07183303e703a89a5f18ad86b509597f037ce4106c0cb770d021812c747815
MD5 ed0ce32380d5ccd707a74eb00ed189b3
SHA1 48df25ea99848dc0fc7b6501a36d18a27c8432c2
SHA512 f2499b572835c8c3642d4c3ee0b8fd10e64f162e2f5a26bc1fbd5c82cbdadedfd7c86ccf7ae0e62fa4f76d9febaa94b80ed9ea653c913757767160cd833becb6
MD5 SHA1 SHA512

Submit Download

Containerhost.exe

Path C:\Chainfontdrivercommon\Containerhost.exe
Size 4.0MB
SHA256 c00dde166376fc4676f6f6099915ca2843622def5612d211259f126b45db668e
MD5 c6097df804dc50f93b1495fd8933c8a5
SHA1 64b13fbd74f32f9906fd31b629878b59e39602aa
SHA512 5d8873a5141ae9eadb93302de6bcdc9b6c2aba36fc9b491800ac1cb819b21925dafd2cb1448b73e7132cdc3213b2e6eb022bcd74849e78e1388fad74a1eaa050
SSDEEP 98304:ytQuhhwKuAXRBZLxbtFBVlw2ZpqxugSD5u/rWk:ytQuTjBRvLV/nK6sxuNQ/rWk
MD5 SHA1 SHA512 SSDEEP

Submit Download

MeIPmAcW0PUqVssXh.bat

Path C:\Chainfontdrivercommon\MeIPmAcW0PUqVssXh.bat
Size 44B
SHA256 ba726c31509d1668c6b7cf1bd6b3a00994f0256d11935b0c9ff4926ecd2b21a8
MD5 5868fc7d337c12f8cb6c765d75eebb88
SHA1 1f1e6480700a30e316f299284d021c0243790596
SHA512 b760cba39340e6fe567002ad781ef055548ecbd9aa747feac29a21939e819b036354972012b2d0873de10f9b7b2750c8625dca4e2168be63fc878db6005e7353
MD5 SHA1 SHA512

Submit Download

LoaderCheat.exe

Path C:\Users\Admin\AppData\Local\Temp\LoaderCheat.exe
Size 4.3MB
SHA256 4ce2b183e0f3ed1320f7f426fbe2e84f0813aaee57c73a56ed097e89202aca07
MD5 def22c5a86fdcd367c28b9cdd9741d2c
SHA1 8ab3a558274290a0d3597fb90ca3accee24a8e57
SHA512 acdb92bc6f4840704aa7d00a2186876f23f0f613d972a782b65480c6382f3dafc2613febdbecbd1e253f6e0d44896f923eb78245410cb51496c9dd30a73404c5
SSDEEP 98304:4byohtQuhhwKuAXRBZLxbtFBVlw2ZpqxugSD5u/rWkw:4WohtQuTjBRvLV/nK6sxuNQ/rWkw
MD5 SHA1 SHA512 SSDEEP

Submit Download

R3otf5C6o0.bat

Path C:\Users\Admin\AppData\Local\Temp\R3otf5C6o0.bat
Size 201B
SHA256 dcb722426dc369af709397b0d15bab59af9380d5ec85c7b2b35f010c99ea1cd3
MD5 1f0f973df69091c4b777b9ad582a95ba
SHA1 09aa7dbd13014bdb8bc4b1eb9ba094dba2a6eabc
SHA512 91ee70f03a8c4cdbfb24ea7ca6e259f71ef9fe8c13b4550c8bf8e10f47b1347272fc927eef29b4e2f0bca58c0a89e6bf1589129640834eadcbf2d438243db2f1
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_e5i3ojxy.hbv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e5i3ojxy.hbv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

main.exe

Path C:\Windows\System32\main.exe
Size 2.2MB
SHA256 9266a745fed485f90b228b9ebe69f9311362913b1a955f391798819e9df04c2e
MD5 26d68e48d06dd88ab6b0eba9a94f286e
SHA1 8672ab40385a874afc969f13ed5b8722f058445c
SHA512 b3049ba2c0b874dea93409d45ed344a21b54f7d90dbe2351dc09de739e3de14db891c1acc2cdae15b123034839af6e1dab9b1bb873ac4dc77bced1a906668eab
SSDEEP 49152:qigJK8c6fMBoUw9RunFIYPQxhDzQNdzFjny9aLp5fbm9xbsPQLx:qioK8dMBoUVnuYwhnQjzFry9aLP6xbgK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/952-58-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

Download

memory/952-62-0x000000001C600000-0x000000001C656000-memory.dmp

Download

memory/952-74-0x000000001C850000-0x000000001C85E000-memory.dmp

Download

memory/952-75-0x000000001C860000-0x000000001C868000-memory.dmp

Download

memory/952-76-0x000000001C970000-0x000000001C978000-memory.dmp

Download

memory/952-77-0x000000001C980000-0x000000001C988000-memory.dmp

Download

memory/952-79-0x000000001C9A0000-0x000000001C9AC000-memory.dmp

Download

memory/952-72-0x000000001C9B0000-0x000000001C9B8000-memory.dmp

Download

memory/952-49-0x0000000000DC0000-0x00000000011C2000-memory.dmp

Download

memory/952-50-0x0000000003340000-0x000000000334E000-memory.dmp

Download

memory/952-51-0x00000000033B0000-0x00000000033B8000-memory.dmp

Download

memory/952-52-0x00000000033C0000-0x00000000033DC000-memory.dmp

Download

memory/952-53-0x000000001BE60000-0x000000001BEB0000-memory.dmp

Download

memory/952-54-0x000000001BE10000-0x000000001BE18000-memory.dmp

Download

memory/952-56-0x000000001BE40000-0x000000001BE48000-memory.dmp

Download

memory/952-57-0x000000001BE50000-0x000000001BE62000-memory.dmp

Download

memory/952-55-0x000000001BE20000-0x000000001BE36000-memory.dmp

Download

memory/952-78-0x000000001C990000-0x000000001C99A000-memory.dmp

Download

memory/952-59-0x000000001C5C0000-0x000000001C5C8000-memory.dmp

Download

memory/952-60-0x000000001C5D0000-0x000000001C5E0000-memory.dmp

Download

memory/952-61-0x000000001C5F0000-0x000000001C5FA000-memory.dmp

Download

memory/952-73-0x000000001C840000-0x000000001C84C000-memory.dmp

Download

memory/952-63-0x000000001C650000-0x000000001C65C000-memory.dmp

Download

memory/952-66-0x000000001C680000-0x000000001C692000-memory.dmp

Download

memory/952-65-0x000000001C670000-0x000000001C678000-memory.dmp

Download

memory/952-64-0x000000001C660000-0x000000001C66C000-memory.dmp

Download

memory/952-67-0x000000001CBE0000-0x000000001D108000-memory.dmp

Download

memory/952-69-0x000000001C6C0000-0x000000001C6CC000-memory.dmp

Download

memory/952-68-0x000000001C6B0000-0x000000001C6B8000-memory.dmp

Download

memory/952-71-0x000000001C730000-0x000000001C73C000-memory.dmp

Download

memory/952-70-0x000000001C6D0000-0x000000001C6D8000-memory.dmp

Download

memory/3360-7-0x00000161FCD10000-0x00000161FCD32000-memory.dmp

Download

memory/3360-12-0x00007FFB24020000-0x00007FFB24AE1000-memory.dmp

Download

memory/3360-13-0x00007FFB24020000-0x00007FFB24AE1000-memory.dmp

Download

memory/3360-14-0x00007FFB24020000-0x00007FFB24AE1000-memory.dmp

Download

memory/3360-17-0x00007FFB24020000-0x00007FFB24AE1000-memory.dmp

Download

memory/4540-23-0x00007FFB24020000-0x00007FFB24AE1000-memory.dmp

Download

memory/4540-0-0x00007FFB24023000-0x00007FFB24025000-memory.dmp

Download

memory/4540-36-0x00007FFB24020000-0x00007FFB24AE1000-memory.dmp

Download

memory/4540-1-0x00000000001C0000-0x00000000007FA000-memory.dmp

Download

memory/4920-127-0x000000001C180000-0x000000001C192000-memory.dmp

Download

memory/4920-181-0x000000001ED20000-0x000000001EEC9000-memory.dmp

Download