orcus | c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-09-2024 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exe
Size

3.0MB
MD5

5487d71c19c09ded835191e89feba640
SHA1

6c13f1e61e8cf66ae728a53c49497899def41092
SHA256

c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2
SHA512

0d17303a9bc1903d298eb5d6cc8d1d36bfa1950c9fe14d8d03623381c5d4f75f5e6eb376474b4d67081906630459be4374a980992622515b3646170b8b8f6181
SSDEEP

49152:dsFN8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmwWncFf0I74gu3+SM:do0wGGzBjryX82uypSb9ndo9JCm

Score

10^/10

orcus discovery rat spyware stealer

Malware Config

Extracted

Family

orcus

voidsystems.duckdns.org:23210

Mutex

db2de9eb436a494988e51052087353b5

Attributes

autostart_method
TaskScheduler
enable_keylogger
false
install_path
%programfiles%\KernelGuard\SafeGuard.exe
reconnect_delay
10000
registry_keyname
KernelEncryptionProtocolKEP
taskscheduler_taskname
SafeGuard
watchdog_path
AppData\KernelAntiLoopGuard

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcurs Rat Executable 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2032-1-0x0000000001010000-0x000000000130C000-memory.dmp	orcus
C:\Program Files\KernelGuard\SafeGuard.exe	orcus
behavioral1/memory/2608-29-0x0000000000CB0000-0x0000000000FAC000-memory.dmp	orcus

Executes dropped EXE 4 IoCs

Processes:

WindowsInput.exeWindowsInput.exeSafeGuard.exeSafeGuard.exe

pid process

2804 WindowsInput.exe
2764 WindowsInput.exe
2608 SafeGuard.exe
448 SafeGuard.exe

pid	process
2804	WindowsInput.exe
2764	WindowsInput.exe
2608	SafeGuard.exe
448	SafeGuard.exe

Drops file in System32 directory 3 IoCs

Processes:

c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exeWindowsInput.exe

description	ioc	process
File created	C:\Windows\SysWOW64\WindowsInput.exe	c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe.config	c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exe
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe

Drops file in Program Files directory 3 IoCs

Processes:

c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exe

description	ioc	process
File created	C:\Program Files\KernelGuard\SafeGuard.exe	c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exe
File opened for modification	C:\Program Files\KernelGuard\SafeGuard.exe	c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exe
File created	C:\Program Files\KernelGuard\SafeGuard.exe.config	c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

AcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 18 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

SafeGuard.exe

pid	process
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe
2608	SafeGuard.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2756 AcroRd32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SafeGuard.exe

description pid process

Token: SeDebugPrivilege 2608 SafeGuard.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2756 AcroRd32.exe
2756 AcroRd32.exe

pid	process
2756	AcroRd32.exe

description	pid	process
Token: SeDebugPrivilege	2608	SafeGuard.exe

pid	process
2756	AcroRd32.exe
2756	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exetaskeng.exeSafeGuard.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 2032 wrote to memory of 2804	2032	c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exe	WindowsInput.exe
PID 2032 wrote to memory of 2804	2032	c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exe	WindowsInput.exe
PID 2032 wrote to memory of 2804	2032	c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exe	WindowsInput.exe
PID 2032 wrote to memory of 2608	2032	c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exe	SafeGuard.exe
PID 2032 wrote to memory of 2608	2032	c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exe	SafeGuard.exe
PID 2032 wrote to memory of 2608	2032	c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exe	SafeGuard.exe
PID 2620 wrote to memory of 448	2620	taskeng.exe	SafeGuard.exe
PID 2620 wrote to memory of 448	2620	taskeng.exe	SafeGuard.exe
PID 2620 wrote to memory of 448	2620	taskeng.exe	SafeGuard.exe
PID 2608 wrote to memory of 2340	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 2340	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 2340	2608	SafeGuard.exe	rundll32.exe
PID 2340 wrote to memory of 2756	2340	rundll32.exe	AcroRd32.exe
PID 2340 wrote to memory of 2756	2340	rundll32.exe	AcroRd32.exe
PID 2340 wrote to memory of 2756	2340	rundll32.exe	AcroRd32.exe
PID 2340 wrote to memory of 2756	2340	rundll32.exe	AcroRd32.exe
PID 2608 wrote to memory of 1132	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 1132	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 1132	2608	SafeGuard.exe	rundll32.exe
PID 1132 wrote to memory of 2216	1132	rundll32.exe	AcroRd32.exe
PID 1132 wrote to memory of 2216	1132	rundll32.exe	AcroRd32.exe
PID 1132 wrote to memory of 2216	1132	rundll32.exe	AcroRd32.exe
PID 1132 wrote to memory of 2216	1132	rundll32.exe	AcroRd32.exe
PID 2608 wrote to memory of 2292	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 2292	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 2292	2608	SafeGuard.exe	rundll32.exe
PID 2292 wrote to memory of 2420	2292	rundll32.exe	AcroRd32.exe
PID 2292 wrote to memory of 2420	2292	rundll32.exe	AcroRd32.exe
PID 2292 wrote to memory of 2420	2292	rundll32.exe	AcroRd32.exe
PID 2292 wrote to memory of 2420	2292	rundll32.exe	AcroRd32.exe
PID 2608 wrote to memory of 2140	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 2140	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 2140	2608	SafeGuard.exe	rundll32.exe
PID 2140 wrote to memory of 1652	2140	rundll32.exe	AcroRd32.exe
PID 2140 wrote to memory of 1652	2140	rundll32.exe	AcroRd32.exe
PID 2140 wrote to memory of 1652	2140	rundll32.exe	AcroRd32.exe
PID 2140 wrote to memory of 1652	2140	rundll32.exe	AcroRd32.exe
PID 2608 wrote to memory of 1624	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 1624	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 1624	2608	SafeGuard.exe	rundll32.exe
PID 1624 wrote to memory of 1616	1624	rundll32.exe	AcroRd32.exe
PID 1624 wrote to memory of 1616	1624	rundll32.exe	AcroRd32.exe
PID 1624 wrote to memory of 1616	1624	rundll32.exe	AcroRd32.exe
PID 1624 wrote to memory of 1616	1624	rundll32.exe	AcroRd32.exe
PID 2608 wrote to memory of 2236	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 2236	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 2236	2608	SafeGuard.exe	rundll32.exe
PID 2236 wrote to memory of 1696	2236	rundll32.exe	AcroRd32.exe
PID 2236 wrote to memory of 1696	2236	rundll32.exe	AcroRd32.exe
PID 2236 wrote to memory of 1696	2236	rundll32.exe	AcroRd32.exe
PID 2236 wrote to memory of 1696	2236	rundll32.exe	AcroRd32.exe
PID 2608 wrote to memory of 1792	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 1792	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 1792	2608	SafeGuard.exe	rundll32.exe
PID 1792 wrote to memory of 2024	1792	rundll32.exe	AcroRd32.exe
PID 1792 wrote to memory of 2024	1792	rundll32.exe	AcroRd32.exe
PID 1792 wrote to memory of 2024	1792	rundll32.exe	AcroRd32.exe
PID 1792 wrote to memory of 2024	1792	rundll32.exe	AcroRd32.exe
PID 2608 wrote to memory of 1104	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 1104	2608	SafeGuard.exe	rundll32.exe
PID 2608 wrote to memory of 1104	2608	SafeGuard.exe	rundll32.exe
PID 1104 wrote to memory of 468	1104	rundll32.exe	AcroRd32.exe
PID 1104 wrote to memory of 468	1104	rundll32.exe	AcroRd32.exe
PID 1104 wrote to memory of 468	1104	rundll32.exe	AcroRd32.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exe
"C:\Users\Admin\AppData\Local\Temp\c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WindowsInput.exe
  "C:\Windows\SysWOW64\WindowsInput.exe" --install
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2804
- C:\Program Files\KernelGuard\SafeGuard.exe
  "C:\Program Files\KernelGuard\SafeGuard.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2756
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2216
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2420
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1652
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1616
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1696
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2024
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:468
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    PID:856
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:576
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    PID:1548
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1700
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    PID:2168
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2692
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    PID:2700
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2380
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    PID:2552
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2452
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    PID:2976
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1848
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    PID:2672
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1872
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    PID:2132
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2208
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    PID:2200
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2368
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    - Modifies registry class
    PID:2364
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1280
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard
    3⤵
    PID:964

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe"
1⤵
- Executes dropped EXE
PID:2764

C:\Windows\system32\taskeng.exe
taskeng.exe {C6E1AD70-8246-4577-9071-1DF1E48BF373} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Program Files\KernelGuard\SafeGuard.exe
  "C:\Program Files\KernelGuard\SafeGuard.exe"
  2⤵
  - Executes dropped EXE
  PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\KernelGuard\SafeGuard.exe

Filesize
3.0MB

MD5
5487d71c19c09ded835191e89feba640

SHA1
6c13f1e61e8cf66ae728a53c49497899def41092

SHA256
c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2

SHA512
0d17303a9bc1903d298eb5d6cc8d1d36bfa1950c9fe14d8d03623381c5d4f75f5e6eb376474b4d67081906630459be4374a980992622515b3646170b8b8f6181

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1c45404ccb4d2ffbd43294329ef60431

SHA1
31b8a8d860b823d3d76ca20da69e191bec075a71

SHA256
91bed08c31c1fa6a0865b799df1f384c335776964ce464218110d9dff98e6c03

SHA512
3df7a50ef987307d5a6ecaf46d6c8e4c0c138f5c168a500f7ad64d3200ee9d2fb6378dee088823391275900c7cd368e8227dc53964a0929299cc4b9364620772

Download Submit
C:\Users\Admin\AppData\Roaming\KernelAntiLoopGuard

Filesize
9KB

MD5
8ace06702ec59d170ca2b31f95812e0f

SHA1
de36712adf9b67d0b4c99d12eb59361adfc5473f

SHA256
f74d37fae8e3fb82eff8d6acf755687d9fb38403c38512ad794f16d5b471ce45

SHA512
5d4dc9ad439f66a17f286800559f1ad13f798cf633eaa7319f41691f2d11a519cccab568e0dd2cadebe4258f51d760fab9ca67e7ecb6c97ff496c9308de6cec5

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe

Filesize
21KB

MD5
a80be96476032d2eaa901d180fe9fb73

SHA1
f378d0bc5fefb9ea0b5006f020091ffcbcd7acec

SHA256
d6075c1ed6f285f5de01ce0cc6a817b59054da8b19f20bc7081cfe7fb2b1af42

SHA512
210c0c4c845b416a601015fba5ccd2a3e8a4b81d3b4c5e0491b07bd0dcad938d9b118728bb1abc21eb73c5f9263a3c08e1822ece91002a2d1f0983857f0192ea

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe.config

Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2032-4-0x000007FEF5E20000-0x000007FEF680C000-memory.dmp

Filesize
9.9MB

Download
memory/2032-5-0x00000000001F0000-0x0000000000202000-memory.dmp

Filesize
72KB

Download
memory/2032-30-0x000007FEF5E20000-0x000007FEF680C000-memory.dmp

Filesize
9.9MB

Download
memory/2032-2-0x0000000000140000-0x000000000019C000-memory.dmp

Filesize
368KB

Download
memory/2032-3-0x00000000001B0000-0x00000000001BE000-memory.dmp

Filesize
56KB

Download
memory/2032-0-0x000007FEF5E23000-0x000007FEF5E24000-memory.dmp

Filesize
4KB

Download
memory/2032-1-0x0000000001010000-0x000000000130C000-memory.dmp

Filesize
3.0MB

Download
memory/2608-31-0x00000000024C0000-0x0000000002518000-memory.dmp

Filesize
352KB

Download
memory/2608-29-0x0000000000CB0000-0x0000000000FAC000-memory.dmp

Filesize
3.0MB

Download
memory/2608-32-0x0000000002550000-0x0000000002568000-memory.dmp

Filesize
96KB

Download
memory/2608-33-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/2804-18-0x000007FEF5E20000-0x000007FEF680C000-memory.dmp

Filesize
9.9MB

Download
memory/2804-14-0x000007FEF5E20000-0x000007FEF680C000-memory.dmp

Filesize
9.9MB

Download
memory/2804-15-0x000007FEF5E20000-0x000007FEF680C000-memory.dmp

Filesize
9.9MB

Download
memory/2804-13-0x0000000001090000-0x000000000109C000-memory.dmp

Filesize
48KB

Download