stealc | 9373f8ad1f33c0286734265cb5e60e69627fb5fd8f2220c655e6afa2d6ebda06

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	za85BMvsxaM9pewVym8ppooy.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1688	netsh.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\International\Geo\Nation	Generations.pif

Executes dropped EXE 7 IoCs

pid	Process
2084	Generations.pif
2124	Generations.pif
2796	5mnHiBOXDl8xPSTXiufvomDD.exe
2540	47t5UUOrKXgw4Q8bMgzSwkn5.exe
2288	vJt0aRPpqpq8xPzLBeOlk2n8.exe
2004	za85BMvsxaM9pewVym8ppooy.exe
2376	krXt9_4imQkAZnjc1syWwmHz.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Wine	za85BMvsxaM9pewVym8ppooy.exe

Loads dropped DLL 17 IoCs

pid	Process
2884	cmd.exe
2084	Generations.pif
2124	Generations.pif
2124	Generations.pif
2124	Generations.pif
2124	Generations.pif
2124	Generations.pif
2124	Generations.pif
2124	Generations.pif
2124	Generations.pif
2124	Generations.pif
2124	Generations.pif
2124	Generations.pif
2124	Generations.pif
2124	Generations.pif
2124	Generations.pif
2124	Generations.pif

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
16	bitbucket.org
25	bitbucket.org
28	bitbucket.org
35	bitbucket.org
57	iplogger.org
60	iplogger.org

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ipinfo.io
8	ipinfo.io
12	api.myip.com
13	api.myip.com
135	api.ipify.org
4	api64.ipify.org
5	api64.ipify.org

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2576	powercfg.exe
2808	powercfg.exe
2344	powercfg.exe
900	powercfg.exe
2504	powercfg.exe
888	powercfg.exe
1968	powercfg.exe
2560	powercfg.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
2628	tasklist.exe
2784	tasklist.exe
2444	tasklist.exe
2596	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2084 set thread context of 2124	2084	Generations.pif	42

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\NeonPioneer	appFile_debump.exe
File opened for modification	C:\Windows\GpsPike	appFile_debump.exe
File opened for modification	C:\Windows\PerhapsEntities	appFile_debump.exe
File opened for modification	C:\Windows\WoodIsa	appFile_debump.exe
File opened for modification	C:\Windows\FightingFri	appFile_debump.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1500	sc.exe
2380	sc.exe
2564	sc.exe
2656	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Generations.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5mnHiBOXDl8xPSTXiufvomDD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	appFile_debump.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Generations.pif

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	Generations.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Generations.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Generations.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Generations.pif
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Generations.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Generations.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Generations.pif

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
988	schtasks.exe
2060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2084	Generations.pif
2084	Generations.pif
2084	Generations.pif
2084	Generations.pif
2084	Generations.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	tasklist.exe
Token: SeDebugPrivilege	2628	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2084	Generations.pif
2084	Generations.pif
2084	Generations.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2084	Generations.pif
2084	Generations.pif
2084	Generations.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2884	3052	appFile_debump.exe	30
PID 3052 wrote to memory of 2884	3052	appFile_debump.exe	30
PID 3052 wrote to memory of 2884	3052	appFile_debump.exe	30
PID 3052 wrote to memory of 2884	3052	appFile_debump.exe	30
PID 2884 wrote to memory of 2596	2884	cmd.exe	32
PID 2884 wrote to memory of 2596	2884	cmd.exe	32
PID 2884 wrote to memory of 2596	2884	cmd.exe	32
PID 2884 wrote to memory of 2596	2884	cmd.exe	32
PID 2884 wrote to memory of 2692	2884	cmd.exe	33
PID 2884 wrote to memory of 2692	2884	cmd.exe	33
PID 2884 wrote to memory of 2692	2884	cmd.exe	33
PID 2884 wrote to memory of 2692	2884	cmd.exe	33
PID 2884 wrote to memory of 2628	2884	cmd.exe	35
PID 2884 wrote to memory of 2628	2884	cmd.exe	35
PID 2884 wrote to memory of 2628	2884	cmd.exe	35
PID 2884 wrote to memory of 2628	2884	cmd.exe	35
PID 2884 wrote to memory of 2676	2884	cmd.exe	36
PID 2884 wrote to memory of 2676	2884	cmd.exe	36
PID 2884 wrote to memory of 2676	2884	cmd.exe	36
PID 2884 wrote to memory of 2676	2884	cmd.exe	36
PID 2884 wrote to memory of 2816	2884	cmd.exe	37
PID 2884 wrote to memory of 2816	2884	cmd.exe	37
PID 2884 wrote to memory of 2816	2884	cmd.exe	37
PID 2884 wrote to memory of 2816	2884	cmd.exe	37
PID 2884 wrote to memory of 2224	2884	cmd.exe	38
PID 2884 wrote to memory of 2224	2884	cmd.exe	38
PID 2884 wrote to memory of 2224	2884	cmd.exe	38
PID 2884 wrote to memory of 2224	2884	cmd.exe	38
PID 2884 wrote to memory of 444	2884	cmd.exe	39
PID 2884 wrote to memory of 444	2884	cmd.exe	39
PID 2884 wrote to memory of 444	2884	cmd.exe	39
PID 2884 wrote to memory of 444	2884	cmd.exe	39
PID 2884 wrote to memory of 2084	2884	cmd.exe	40
PID 2884 wrote to memory of 2084	2884	cmd.exe	40
PID 2884 wrote to memory of 2084	2884	cmd.exe	40
PID 2884 wrote to memory of 2084	2884	cmd.exe	40
PID 2884 wrote to memory of 2916	2884	cmd.exe	41
PID 2884 wrote to memory of 2916	2884	cmd.exe	41
PID 2884 wrote to memory of 2916	2884	cmd.exe	41
PID 2884 wrote to memory of 2916	2884	cmd.exe	41
PID 2084 wrote to memory of 2124	2084	Generations.pif	42
PID 2084 wrote to memory of 2124	2084	Generations.pif	42
PID 2084 wrote to memory of 2124	2084	Generations.pif	42
PID 2084 wrote to memory of 2124	2084	Generations.pif	42
PID 2084 wrote to memory of 2124	2084	Generations.pif	42
PID 2084 wrote to memory of 2124	2084	Generations.pif	42
PID 2124 wrote to memory of 2796	2124	Generations.pif	44
PID 2124 wrote to memory of 2796	2124	Generations.pif	44
PID 2124 wrote to memory of 2796	2124	Generations.pif	44
PID 2124 wrote to memory of 2796	2124	Generations.pif	44
PID 2124 wrote to memory of 2540	2124	Generations.pif	45
PID 2124 wrote to memory of 2540	2124	Generations.pif	45
PID 2124 wrote to memory of 2540	2124	Generations.pif	45
PID 2124 wrote to memory of 2540	2124	Generations.pif	45
PID 2124 wrote to memory of 2288	2124	Generations.pif	46
PID 2124 wrote to memory of 2288	2124	Generations.pif	46
PID 2124 wrote to memory of 2288	2124	Generations.pif	46
PID 2124 wrote to memory of 2288	2124	Generations.pif	46
PID 2124 wrote to memory of 2004	2124	Generations.pif	48
PID 2124 wrote to memory of 2004	2124	Generations.pif	48
PID 2124 wrote to memory of 2004	2124	Generations.pif	48
PID 2124 wrote to memory of 2004	2124	Generations.pif	48
PID 2124 wrote to memory of 1968	2124	Generations.pif	96
PID 2124 wrote to memory of 1968	2124	Generations.pif	96

C:\Users\Admin\AppData\Local\Temp\appFile_debump.exe
"C:\Users\Admin\AppData\Local\Temp\appFile_debump.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Integral Integral.bat & Integral.bat
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2692
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2628
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2676
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 193415
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2816
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "assessmentsfiftyottawamid" Cite
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2224
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Showcase + ..\Anniversary + ..\Refurbished + ..\Marina + ..\Cam + ..\Allocation + ..\Yemen + ..\Alter + ..\Gov + ..\Caring + ..\Counseling + ..\Receive + ..\Tops + ..\Artistic + ..\Estates + ..\Carolina + ..\Ri + ..\Cardiff + ..\Conspiracy + ..\Family + ..\Hostels + ..\Safely + ..\Messaging + ..\Weeks + ..\Delegation V
    3⤵
    - System Location Discovery: System Language Discovery
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\193415\Generations.pif
    Generations.pif V
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\193415\Generations.pif
      C:\Users\Admin\AppData\Local\Temp\193415\Generations.pif
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:2124
    - - C:\Users\Admin\Documents\iofolko5\5mnHiBOXDl8xPSTXiufvomDD.exe
        
        C:\Users\Admin\Documents\iofolko5\5mnHiBOXDl8xPSTXiufvomDD.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\is-I4G8U.tmp\5mnHiBOXDl8xPSTXiufvomDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-I4G8U.tmp\5mnHiBOXDl8xPSTXiufvomDD.tmp" /SL5="$501D2,3352420,56832,C:\Users\Admin\Documents\iofolko5\5mnHiBOXDl8xPSTXiufvomDD.exe"
        6⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32.exe
        
        "C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32.exe" -i
        7⤵
        
        PID:1576
    - - C:\Users\Admin\Documents\iofolko5\47t5UUOrKXgw4Q8bMgzSwkn5.exe
        
        C:\Users\Admin\Documents\iofolko5\47t5UUOrKXgw4Q8bMgzSwkn5.exe
        5⤵
        Executes dropped EXE
        
        PID:2540
    - - C:\Users\Admin\Documents\iofolko5\vJt0aRPpqpq8xPzLBeOlk2n8.exe
        
        C:\Users\Admin\Documents\iofolko5\vJt0aRPpqpq8xPzLBeOlk2n8.exe
        5⤵
        Executes dropped EXE
        
        PID:2288
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:2788
    - - C:\Users\Admin\Documents\iofolko5\za85BMvsxaM9pewVym8ppooy.exe
        
        C:\Users\Admin\Documents\iofolko5\za85BMvsxaM9pewVym8ppooy.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Identifies Wine through registry keys
        
        PID:2004
    - - C:\Users\Admin\Documents\iofolko5\PBIMm509Xl6OMO8vtm3soA09.exe
        
        C:\Users\Admin\Documents\iofolko5\PBIMm509Xl6OMO8vtm3soA09.exe
        5⤵
        
        PID:1968
    - - C:\Users\Admin\Documents\iofolko5\krXt9_4imQkAZnjc1syWwmHz.exe
        
        C:\Users\Admin\Documents\iofolko5\krXt9_4imQkAZnjc1syWwmHz.exe
        5⤵
        Executes dropped EXE
        
        PID:2376
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminIJKFCFHJDB.exe"
        7⤵
        
        PID:2264
        
        C:\Users\AdminIJKFCFHJDB.exe
        
        "C:\Users\AdminIJKFCFHJDB.exe"
        8⤵
        
        PID:880
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        9⤵
        
        PID:1040
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        9⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminCFIEBKEHCA.exe"
        7⤵
        
        PID:1208
        
        C:\Users\AdminCFIEBKEHCA.exe
        
        "C:\Users\AdminCFIEBKEHCA.exe"
        8⤵
        
        PID:2576
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        9⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminCAKKJKKECF.exe"
        7⤵
        
        PID:444
        
        C:\Users\AdminCAKKJKKECF.exe
        
        "C:\Users\AdminCAKKJKKECF.exe"
        8⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe" -i
        9⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe
        
        C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe -i
        10⤵
        
        PID:1916
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
        11⤵
        Modifies Windows Firewall
        
        PID:1688
    - - C:\Users\Admin\Documents\iofolko5\UllTAQxWHpJA7c01r8CQpd6j.exe
        
        C:\Users\Admin\Documents\iofolko5\UllTAQxWHpJA7c01r8CQpd6j.exe
        5⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Malewmf\MFDBG.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Malewmf\MFDBG.exe"
        6⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Malewmf\FDWDZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker
        7⤵
        
        PID:2036
    - - C:\Users\Admin\Documents\iofolko5\Azn4o1JIiOg12PHBULd7A2Oc.exe
        
        C:\Users\Admin\Documents\iofolko5\Azn4o1JIiOg12PHBULd7A2Oc.exe
        5⤵
        
        PID:1476
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:2680
    - - C:\Users\Admin\Documents\iofolko5\eusiWodR9RbmWI1F8i0CO5hC.exe
        
        C:\Users\Admin\Documents\iofolko5\eusiWodR9RbmWI1F8i0CO5hC.exe
        5⤵
        
        PID:2168
    - - C:\Users\Admin\Documents\iofolko5\XcJzFoXuna31Coa2XqzgJ9dc.exe
        
        C:\Users\Admin\Documents\iofolko5\XcJzFoXuna31Coa2XqzgJ9dc.exe
        5⤵
        
        PID:1808
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        Power Settings
        
        PID:2344
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        Power Settings
        
        PID:2808
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        Power Settings
        
        PID:2576
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        Power Settings
        
        PID:2560
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "RRTELIGS"
        6⤵
        Launches sc.exe
        
        PID:1500
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "RRTELIGS" binpath= "C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:2380
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:2656
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "RRTELIGS"
        6⤵
        Launches sc.exe
        
        PID:2564
    - - C:\Users\Admin\Documents\iofolko5\1OOHaMuEXj4Uz5nBIksJ7nwE.exe
        
        C:\Users\Admin\Documents\iofolko5\1OOHaMuEXj4Uz5nBIksJ7nwE.exe
        5⤵
        
        PID:2176
      - C:\Users\Admin\Documents\iofolko5\1OOHaMuEXj4Uz5nBIksJ7nwE.exe
        
        "C:\Users\Admin\Documents\iofolko5\1OOHaMuEXj4Uz5nBIksJ7nwE.exe"
        6⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:988
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2060
    - - C:\Users\Admin\Documents\iofolko5\IXRbv3HOflsrMkuZo1MDZtiY.exe
        
        C:\Users\Admin\Documents\iofolko5\IXRbv3HOflsrMkuZo1MDZtiY.exe
        5⤵
        
        PID:1956
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Kai Kai.bat & Kai.bat
        6⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:2784
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        7⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:2444
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        7⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 714589
        7⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "MonkeyBeginningHurricanePhi" Underground
        7⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Witness + ..\Currency + ..\Eating + ..\Salary + ..\Nn + ..\Derived + ..\Preceding + ..\Journalism + ..\Disk E
        7⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\714589\Customized.pif
        
        Customized.pif E
        7⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 15
        7⤵
        
        PID:304
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2916

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1501996316-1859573496576104356-281719047-393364156-5220548921263921556-620811357"
1⤵
PID:2072

C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe
C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe
1⤵
PID:1056
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:1968
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:888
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:2504
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:900
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1936
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:1604

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1852225305-20994823375790783912002822212-31961062616167207271915992815190622587"
1⤵
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion