Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
26/06/2024, 17:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CHEAT roblox.exe
Resource
win7-20240419-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
CHEAT roblox.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target CHEAT roblox.exe
- Size 10.8MB
- Sample240626-v5hkcsvclg
- SHA256 5e329adce16be480d39671fc56fcffbbb75e5efcf0a9114f95304f70c3367ae9
- MD5 83b46d45f4de148426c0ad0afb237c89
- SHA1 a11b1eb468cbe6833bd63f5b731cfef30c2965f4
- SHA512 f17f0f4a7171bc582ea1f3dca0671a714e3eac1690622a181d511b87740c972cc98900867123e55d3ebba5e19264af72a323c3bb0cfa3da17dd8e0bcf0036c8f
- SSDEEP 196608:Zqw7wi468T8Xc9tlINy9hxmAudIbqdaCV4uyR6fb8ofmr8ej9gI7z/z:NR4XT8sblI+gH8MfbLWgI7z7
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
resource yara_rule behavioral2/files/0x00070000000234f0-4.dat dcrat behavioral2/files/0x000a0000000234e8-19.dat dcrat behavioral2/files/0x0008000000023383-27.dat dcrat behavioral2/files/0x00070000000234f1-33.dat dcrat - Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation temp.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation system.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation kiler.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation kiler.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation CHEAT roblox.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation appdata.exe - Drops startup file 9 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiler.exe kiler.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiler.exe kiler.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiler.exe kiler.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiler.exe kiler.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiler.url kiler.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiler.url kiler.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiler.exe kiler.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiler.exe kiler.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiler.url kiler.exe - Executes dropped EXE 9 IoCs
pid Process 4492 C.exe 3488 appdata.exe 724 temp.exe 3472 system.exe 2952 kiler.exe 1936 kiler.exe 4384 kiler.exe 116 kiler.exe 3828 kiler.exe - Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiler.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\kiler.exe\" .." kiler.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kiler.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\kiler.exe\" .." kiler.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiler.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\kiler.exe\" .." kiler.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kiler.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\kiler.exe\" .." kiler.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiler.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\kiler.exe\" .." kiler.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kiler.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\kiler.exe\" .." kiler.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Delays execution with timeout.exe 1 IoCs
pid Process 3944 timeout.exe - Kills process with taskkill 12 IoCs
pid Process 4000 TASKKILL.exe 1408 TASKKILL.exe 4236 TASKKILL.exe 3128 TASKKILL.exe 3840 TASKKILL.exe 3468 TASKKILL.exe 4572 TASKKILL.exe 4060 taskkill.exe 4620 TASKKILL.exe 704 TASKKILL.exe 516 taskkill.exe 1476 TASKKILL.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings temp.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings C.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings system.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings appdata.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4972 schtasks.exe 876 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe 2952 kiler.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 2952 kiler.exe Token: SeDebugPrivilege 4000 TASKKILL.exe Token: SeDebugPrivilege 4572 TASKKILL.exe Token: 33 2952 kiler.exe Token: SeIncBasePriorityPrivilege 2952 kiler.exe Token: 33 2952 kiler.exe Token: SeIncBasePriorityPrivilege 2952 kiler.exe Token: 33 2952 kiler.exe Token: SeIncBasePriorityPrivilege 2952 kiler.exe Token: SeDebugPrivilege 1408 TASKKILL.exe Token: SeDebugPrivilege 4620 TASKKILL.exe Token: SeDebugPrivilege 1936 kiler.exe Token: 33 2952 kiler.exe Token: SeIncBasePriorityPrivilege 2952 kiler.exe Token: 33 2952 kiler.exe Token: SeIncBasePriorityPrivilege 2952 kiler.exe Token: 33 2952 kiler.exe Token: SeIncBasePriorityPrivilege 2952 kiler.exe Token: 33 2952 kiler.exe Token: SeIncBasePriorityPrivilege 2952 kiler.exe Token: SeDebugPrivilege 1592 taskmgr.exe Token: SeSystemProfilePrivilege 1592 taskmgr.exe Token: SeCreateGlobalPrivilege 1592 taskmgr.exe Token: 33 2952 kiler.exe Token: SeIncBasePriorityPrivilege 2952 kiler.exe Token: 33 2952 kiler.exe Token: SeIncBasePriorityPrivilege 2952 kiler.exe Token: 33 2952 kiler.exe Token: SeIncBasePriorityPrivilege 2952 kiler.exe Token: SeDebugPrivilege 4384 kiler.exe Token: SeDebugPrivilege 4236 TASKKILL.exe Token: SeDebugPrivilege 704 TASKKILL.exe Token: 33 2952 kiler.exe Token: SeIncBasePriorityPrivilege 2952 kiler.exe Token: SeDebugPrivilege 116 kiler.exe Token: SeDebugPrivilege 3128 TASKKILL.exe Token: SeDebugPrivilege 3840 TASKKILL.exe Token: 33 4384 kiler.exe Token: SeIncBasePriorityPrivilege 4384 kiler.exe Token: SeDebugPrivilege 3828 kiler.exe Token: SeDebugPrivilege 1476 TASKKILL.exe Token: SeDebugPrivilege 3468 TASKKILL.exe - Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3216 wrote to memory of 4492 3216 CHEAT roblox.exe 83 PID 3216 wrote to memory of 4492 3216 CHEAT roblox.exe 83 PID 3216 wrote to memory of 4492 3216 CHEAT roblox.exe 83 PID 3216 wrote to memory of 3488 3216 CHEAT roblox.exe 85 PID 3216 wrote to memory of 3488 3216 CHEAT roblox.exe 85 PID 3216 wrote to memory of 3488 3216 CHEAT roblox.exe 85 PID 3216 wrote to memory of 724 3216 CHEAT roblox.exe 86 PID 3216 wrote to memory of 724 3216 CHEAT roblox.exe 86 PID 3216 wrote to memory of 724 3216 CHEAT roblox.exe 86 PID 3216 wrote to memory of 3472 3216 CHEAT roblox.exe 87 PID 3216 wrote to memory of 3472 3216 CHEAT roblox.exe 87 PID 3216 wrote to memory of 3472 3216 CHEAT roblox.exe 87 PID 3216 wrote to memory of 848 3216 CHEAT roblox.exe 88 PID 3216 wrote to memory of 848 3216 CHEAT roblox.exe 88 PID 3216 wrote to memory of 2952 3216 CHEAT roblox.exe 90 PID 3216 wrote to memory of 2952 3216 CHEAT roblox.exe 90 PID 3216 wrote to memory of 2952 3216 CHEAT roblox.exe 90 PID 2952 wrote to memory of 4000 2952 kiler.exe 92 PID 2952 wrote to memory of 4000 2952 kiler.exe 92 PID 2952 wrote to memory of 4000 2952 kiler.exe 92 PID 2952 wrote to memory of 4572 2952 kiler.exe 93 PID 2952 wrote to memory of 4572 2952 kiler.exe 93 PID 2952 wrote to memory of 4572 2952 kiler.exe 93 PID 4492 wrote to memory of 5020 4492 C.exe 96 PID 4492 wrote to memory of 5020 4492 C.exe 96 PID 4492 wrote to memory of 5020 4492 C.exe 96 PID 3472 wrote to memory of 2804 3472 system.exe 98 PID 3472 wrote to memory of 2804 3472 system.exe 98 PID 3472 wrote to memory of 2804 3472 system.exe 98 PID 3488 wrote to memory of 4064 3488 appdata.exe 97 PID 3488 wrote to memory of 4064 3488 appdata.exe 97 PID 3488 wrote to memory of 4064 3488 appdata.exe 97 PID 724 wrote to memory of 1260 724 temp.exe 99 PID 724 wrote to memory of 1260 724 temp.exe 99 PID 724 wrote to memory of 1260 724 temp.exe 99 PID 848 wrote to memory of 3944 848 cmd.exe 101 PID 848 wrote to memory of 3944 848 cmd.exe 101 PID 2952 wrote to memory of 4060 2952 kiler.exe 112 PID 2952 wrote to memory of 4060 2952 kiler.exe 112 PID 2952 wrote to memory of 4060 2952 kiler.exe 112 PID 2952 wrote to memory of 2932 2952 kiler.exe 114 PID 2952 wrote to memory of 2932 2952 kiler.exe 114 PID 2952 wrote to memory of 2932 2952 kiler.exe 114 PID 2952 wrote to memory of 4972 2952 kiler.exe 116 PID 2952 wrote to memory of 4972 2952 kiler.exe 116 PID 2952 wrote to memory of 4972 2952 kiler.exe 116 PID 1936 wrote to memory of 1408 1936 kiler.exe 122 PID 1936 wrote to memory of 1408 1936 kiler.exe 122 PID 1936 wrote to memory of 1408 1936 kiler.exe 122 PID 1936 wrote to memory of 4620 1936 kiler.exe 123 PID 1936 wrote to memory of 4620 1936 kiler.exe 123 PID 1936 wrote to memory of 4620 1936 kiler.exe 123 PID 4384 wrote to memory of 704 4384 kiler.exe 135 PID 4384 wrote to memory of 704 4384 kiler.exe 135 PID 4384 wrote to memory of 704 4384 kiler.exe 135 PID 4384 wrote to memory of 4236 4384 kiler.exe 137 PID 4384 wrote to memory of 4236 4384 kiler.exe 137 PID 4384 wrote to memory of 4236 4384 kiler.exe 137 PID 2952 wrote to memory of 116 2952 kiler.exe 139 PID 2952 wrote to memory of 116 2952 kiler.exe 139 PID 2952 wrote to memory of 116 2952 kiler.exe 139 PID 116 wrote to memory of 3840 116 kiler.exe 140 PID 116 wrote to memory of 3840 116 kiler.exe 140 PID 116 wrote to memory of 3840 116 kiler.exe 140
Processes
-
C:\Users\Admin\AppData\Local\Temp\CHEAT roblox.exe"C:\Users\Admin\AppData\Local\Temp\CHEAT roblox.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\C.exe"C:\Users\Admin\AppData\Local\Temp\C.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\BlockproviderComponentweb\LzYuX9pzQxeIw.vbe"3⤵PID:5020
-
-
-
C:\Users\Admin\AppData\Local\Temp\appdata.exe"C:\Users\Admin\AppData\Local\Temp\appdata.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\BlockproviderComponentweb\FlrU2Sw3hI88Kq0oMKFqlJBcKKk7.vbe"3⤵PID:4064
-
-
-
C:\Users\Admin\AppData\Local\Temp\temp.exe"C:\Users\Admin\AppData\Local\Temp\temp.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BlockproviderComponentweb\rLN2CzC2BGDm0saFwwqZ.vbe"3⤵PID:1260
-
-
-
C:\Users\Admin\AppData\Local\Temp\system.exe"C:\Users\Admin\AppData\Local\Temp\system.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProviderwebRuntimebrokerDll\AzoUH9rmryPf4YVykgERWga1ZsG.vbe"3⤵PID:2804
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bat.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\system32\timeout.exetimeout 53⤵
- Delays execution with timeout.exe
PID:3944
-
-
-
C:\Users\Admin\AppData\Local\Temp\kiler.exe"C:\Users\Admin\AppData\Local\Temp\kiler.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4000
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im Wireshark.exe3⤵
- Kills process with taskkill
PID:4060
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f3⤵PID:2932
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\kiler.exe3⤵
- Scheduled Task/Job: Scheduled Task
PID:4972
-
-
C:\Users\Admin\AppData\Local\Temp\kiler.exe"C:\Users\Admin\AppData\Local\Temp\kiler.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3840
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3128
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kiler.exeC:\Users\Admin\AppData\Local\Temp\kiler.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1408
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4620
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1592
-
C:\Users\Admin\AppData\Local\Temp\kiler.exeC:\Users\Admin\AppData\Local\Temp\kiler.exe1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:704
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4236
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im Wireshark.exe2⤵
- Kills process with taskkill
PID:516
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:1808
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\kiler.exe2⤵
- Scheduled Task/Job: Scheduled Task
PID:876
-
-
C:\Users\Admin\AppData\Local\Temp\kiler.exe"C:\Users\Admin\AppData\Local\Temp\kiler.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3828 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3468
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\BlockproviderComponentweb\LzYuX9pzQxeIw.vbe
- Size 224B
- SHA256 b0ebc32dafa29a57b91c73ac0b89242da68d40cd470c262d4cc0361ba0cd8b95
- MD5 ac65a75f2ee29bca1ced3f4279f35192
- SHA1 905f99dc033b80377da593dfaa03ca9dea86521b
- SHA512 8ddfbc73ce949e48b270fd1717fe42d035c54d14cbb17f1764e98ae17305d26bc246deb254b0d439f314133e574b6c2bd8b1f1611cbf07eecbb569251f4c6206
- MD5 SHA1 SHA512
- Path C:\ProviderwebRuntimebrokerDll\AzoUH9rmryPf4YVykgERWga1ZsG.vbe
- Size 227B
- SHA256 c21e88d44eb247ab02667e37de05d2e10ecc27bdfdc0f380778494570b5377db
- MD5 4a854cad3f93b3e5c68443bedd1f8de1
- SHA1 b71b93f98f49c7d334a09c80bac424db005913de
- SHA512 b5a0db320eeecb1ab7c72376d3cf42f1c2c9aa659456dcad1f66696b6d0c0b83daa46b04e993d69aa7f0ac8ad4324a1a86e3e3d7dbd41d39d8e727e80a6c7541
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\kiler.exe.log
- Size 319B
- SHA256 d182dd648c92e41cd62dccc65f130c07f0a96c03b32f907c3d1218e9aa5bda03
- MD5 824ba7b7eed8b900a98dd25129c4cd83
- SHA1 54478770b2158000ef365591d42977cb854453a1
- SHA512 ae4f3a9673711ecb6cc5d06874c587341d5094803923b53b6e982278fa64549d7acf866de165e23750facd55da556b6794c0d32f129f4087529c73acd4ffb11e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\BlockproviderComponentweb\rLN2CzC2BGDm0saFwwqZ.vbe
- Size 214B
- SHA256 25f85a5bcaed5fadfba4b5368f224468e602e8991225b1fc2176cec26672cd81
- MD5 c6e17f78ef2cab853baa01a81f114972
- SHA1 246165f27b7d3d2ac642c5230f7ca09e39dd36a6
- SHA512 84384b504dfceb204d15b8961f25ac40b6747014a4a4eb7b1ed2948c5d90e36db782c11d034f18f8cf18e53d3c6635d7d0fc6bb43866a464a24e02695dc13061
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\C.exe
- Size 3.1MB
- SHA256 fb1ad76b6875612578539b3bf70c93438165465dd6b4cd128a692cfed974e5f7
- MD5 918f850b87799087aab3391985a3c81a
- SHA1 9ff3cb6d0d3694d10acdda212826b9ffb7759f78
- SHA512 ca1abdfc6a2007f516c46d8446c76e0e02c1087ceb38827e41c84f352b17175a7c4ffac18cc2283a7fb690324685a2acb1b310f234f755aafa1bcdc645bbbf1a
- SSDEEP 98304:UbZVh6nMYilqdVyNNjOwn2cvPYNbtuc5p4Pw8l:UtQM3A+NjOOSLucXb8l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\appdata.exe
- Size 3.1MB
- SHA256 0813184d94537f7f52e27a48733ce01ab3f8a40c807f8b1e3e876a0857270b98
- MD5 84d84c88f059dcc80c8b8269bda163d0
- SHA1 94ca3cdba45a6961a19162cfc9eaa85a65be21ea
- SHA512 778ee47a7ee2967ffaa101d2de287be8545adfbd26e1d7f9944d8b3f5c238751bb48aa73f64ea1d1180692b383792281504bd6d54ec9446f2396fed4090255fc
- SSDEEP 49152:UbA30ZS5NxAsiy2UVy3GR8ST6YnrhVxhtoIOwI3Xbm4RR61yuqqm:UbdEqs4GLWywUI3q4RR9uhm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\bat.bat
- Size 182B
- SHA256 1c10664cec33a5199bf1d088c87576056c0e2471f2c7e7424c73cc9f9fe495bc
- MD5 770788fb3e3cecfdb52e213077f32f43
- SHA1 c6187493b794ec91641755d2304c7d9c56b41ad5
- SHA512 3a3f4bd5f5a7dc7f59f5e12f14d2ae7dbce6c94feec9384348a94af5dbe488fb0adf3be11a72ef6021bfd4ff92037dfd94d17d122c0018d092abb0e08c80e2dc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\kiler.exe
- Size 249KB
- SHA256 77d822158965fe6c07d02d6fd22590f2fd5b67b0fb2f1f0b080bf8f627687c63
- MD5 8bb7f3314ffb6329e0a2e94489df2579
- SHA1 33abb1c5671a8a08e45712a7417ccba94cac8f61
- SHA512 1ca4b92ded899e01550f0fbb362842692137f72e63301453880fb39e342d9b8be98c35b53cb50821009c33fe3a2ab986ecfdf4dee80e04f31669f20e2caa1193
- SSDEEP 3072:oa8mjXNiz3XE1dXl9FAmAMvtF/2QyS+LD2Dv+GHF+aabl2d09vKKp2DFsqzV4IOw:Cm+8XvDv7gNILHg/bV9vKeLNw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\system.exe
- Size 3.1MB
- SHA256 7d0a7d85531fa4e95cad06073ce5fc918c1a1607f8b7c3da9ea0d765d3ab9dad
- MD5 3a8e20e9b2e9f923d8c7f73e0a4cf725
- SHA1 300070b3025f282e63af63a4751762e6309dbd95
- SHA512 8892c7cce62bd29d40b66415a1847fec2cf75c181ec3ddcc8e628db4775cf2fb5de0505eb61ce44c36813462c48a18945ed53f9bf7c2734a202194ed3c932d8a
- SSDEEP 49152:UbA30y7K1YHcrwOQ1rxqjSMk4fxiaJjvsZfFdFjLhe60EzvbntBYdN7N:Ubr17QxqWMDfcaJjUVdLhedETbnYdZN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\temp.exe
- Size 3.1MB
- SHA256 3cb7f2e31e0d726f91631cdc0a44e8c97282e48a23a76521346df13f159d6e16
- MD5 7d43fffdbeb71e7ff79251ebf8b558a7
- SHA1 00ef8701369d0308bc50876e75db78f803cccaa0
- SHA512 78971890e29f929bd9913ebbfff5f324590b82582be168427e939f123d9f9f1ee264643b0489deb12711e41d58e6bfd0678ab63fcfc4a945a01909aad8b04da4
- SSDEEP 98304:UbqxjQCA6jUC0ktgFM2fvjj5NJL06TpWsGVt0Gg:U2xhUIWFM2fvx06TosWGt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\BlockproviderComponentweb\FlrU2Sw3hI88Kq0oMKFqlJBcKKk7.vbe
- Size 215B
- SHA256 32eaa92211f658207acdfa9cf61ffb6ec96330e6918d35943c3562a8323bcc37
- MD5 f31a6303fa711859b55f1823d797c287
- SHA1 8a56aaf8ed61bbee69334a1bdb6330351c448102
- SHA512 a9e9b9ebe96e79cc49e441896eb80af50aafd378c9f52cf5bfd50feae7b2a54369ceb47fe186a054ee1f30e70bf0507189de71c871a55c05e9a92d0c2ac12d02
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiler.url
- Size 176B
- SHA256 b1168edad659c2a5f478ef7630a94ed9cd47e98ed32d91007669a0f3e2f591ce
- MD5 f3bef6f768b1fd27ddb071aa8826658a
- SHA1 cbc09d06ee7a59c424ba776b6d20f91bac797cdd
- SHA512 74f26b66c8bf9c778497f18d97f66f24c7ff9c8a9570b8efdbd460f5f452ab36df835f7719822bf23b8e850434ade1960fc9144a0b3d4ff2411b16ae24c57d0c
- MD5 SHA1 SHA512