orcus | 8667faa80b6d3e4126e5e9e60b6e2f755f5388c5554e7b6fd59bcd5a342326ad

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 08:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Orcus.exe
Size

3.0MB
MD5

37128f8c34f0e2112cb6c60d2fe8d4c6
SHA1

42d4240892b4fcb2b5332fb70210238aa4070f6a
SHA256

8667faa80b6d3e4126e5e9e60b6e2f755f5388c5554e7b6fd59bcd5a342326ad
SHA512

f0387c7f8d4d74fc378599918cee295abf14e0cc3983a4e1681a7d40ba4b5af519a0bfec7244d2e081588590e421711dc412b3e32cb17c0a6b9db9a0d0656b88
SSDEEP

49152:uBpEKO3T5adZKM0sz5otCeEvsDKx+msbfGGW8wlBKJwAypQxbxEo9JnCmmLNrZEu:uBptODUKTslWp2MpbfGGilIJPypSbxEt

Score

10^/10

orcus roblox defense_evasion discovery evasion persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

orcus

Botnet

Roblox

89.23.100.155:1337

Mutex

fa9ce586702b4090bcb834980fda0474

Attributes

autostart_method
Registry
enable_keylogger
true
install_path
%programfiles%\Windows\MpDefenderCore.exe
reconnect_delay
10000
registry_keyname
MpDefender
taskscheduler_taskname
MpDefender
watchdog_path
AppData\xdwdwatchdog.exe

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/memory/3856-25-0x000000001C2D0000-0x000000001C2DA000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

MpDefenderCore.exeOrcus.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	MpDefenderCore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	MpDefenderCore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	MpDefenderCore.exe

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

Orcus main payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/files/0x0009000000023cda-295.dat	family_orcus
behavioral2/files/0x0008000000023cc1-301.dat	family_orcus

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Orcus.exeMpDefenderCore.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	MpDefenderCore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	MpDefenderCore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	MpDefenderCore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe

Orcurs Rat Executable 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3856-76-0x000000001E750000-0x000000001EA52000-memory.dmp	orcus
behavioral2/files/0x0009000000023cda-295.dat	orcus
behavioral2/files/0x0008000000023cc1-301.dat	orcus

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Orcus.exeMpDefenderCore.exexdwdwatchdog.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Orcus.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	MpDefenderCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	xdwdwatchdog.exe

Executes dropped EXE 6 IoCs

Processes:

WindowsInput.exeWindowsInput.exeMpDefenderCore.exeMpDefenderCore.exexdwdwatchdog.exexdwdwatchdog.exe

pid	Process
2376	WindowsInput.exe
4160	WindowsInput.exe
4468	MpDefenderCore.exe
1636	MpDefenderCore.exe
3364	xdwdwatchdog.exe
2384	xdwdwatchdog.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Orcus.exeMpDefenderCore.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	MpDefenderCore.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MpDefenderCore.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MpDefender = "\"C:\\Program Files\\Windows\\MpDefenderCore.exe\""	MpDefenderCore.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Orcus.exeMpDefenderCore.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MpDefenderCore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	MpDefenderCore.exe

Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 2 IoCs

Possible Turn off User Account Control's privilege elevation for standard users.

defense_evasion persistence privilege_escalation

Executable Installer File Permissions Weakness

T1574.005

Processes:

Orcus.exeMpDefenderCore.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	MpDefenderCore.exe

Drops file in System32 directory 3 IoCs

Processes:

Orcus.exeWindowsInput.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsInput.exe	Orcus.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe.config	Orcus.exe
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe

Drops file in Program Files directory 3 IoCs

Processes:

Orcus.exe

description	ioc	Process
File created	C:\Program Files\Windows\MpDefenderCore.exe	Orcus.exe
File opened for modification	C:\Program Files\Windows\MpDefenderCore.exe	Orcus.exe
File created	C:\Program Files\Windows\MpDefenderCore.exe.config	Orcus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

xdwdwatchdog.exexdwdwatchdog.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xdwdwatchdog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xdwdwatchdog.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exexdwdwatchdog.exeMpDefenderCore.exe

pid	Process
4800	powershell.exe
4800	powershell.exe
1564	powershell.exe
1564	powershell.exe
2384	xdwdwatchdog.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
4468	MpDefenderCore.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe
2384	xdwdwatchdog.exe
2384	xdwdwatchdog.exe
4468	MpDefenderCore.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exeMpDefenderCore.exepowershell.exexdwdwatchdog.exexdwdwatchdog.exe

description	pid	Process
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeDebugPrivilege	4468	MpDefenderCore.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	3364	xdwdwatchdog.exe
Token: SeDebugPrivilege	2384	xdwdwatchdog.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

MpDefenderCore.exe

pid	Process
4468	MpDefenderCore.exe

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

MpDefenderCore.exe

pid	Process
4468	MpDefenderCore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MpDefenderCore.exe

pid	Process
4468	MpDefenderCore.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

Orcus.execsc.exeMpDefenderCore.exexdwdwatchdog.exe

description	pid	Process	procid_target
PID 3856 wrote to memory of 4660	3856	Orcus.exe	87
PID 3856 wrote to memory of 4660	3856	Orcus.exe	87
PID 4660 wrote to memory of 1928	4660	csc.exe	89
PID 4660 wrote to memory of 1928	4660	csc.exe	89
PID 3856 wrote to memory of 2376	3856	Orcus.exe	90
PID 3856 wrote to memory of 2376	3856	Orcus.exe	90
PID 3856 wrote to memory of 4800	3856	Orcus.exe	94
PID 3856 wrote to memory of 4800	3856	Orcus.exe	94
PID 3856 wrote to memory of 4468	3856	Orcus.exe	110
PID 3856 wrote to memory of 4468	3856	Orcus.exe	110
PID 4468 wrote to memory of 1564	4468	MpDefenderCore.exe	112
PID 4468 wrote to memory of 1564	4468	MpDefenderCore.exe	112
PID 4468 wrote to memory of 3364	4468	MpDefenderCore.exe	114
PID 4468 wrote to memory of 3364	4468	MpDefenderCore.exe	114
PID 4468 wrote to memory of 3364	4468	MpDefenderCore.exe	114
PID 3364 wrote to memory of 2384	3364	xdwdwatchdog.exe	116
PID 3364 wrote to memory of 2384	3364	xdwdwatchdog.exe	116
PID 3364 wrote to memory of 2384	3364	xdwdwatchdog.exe	116

System policy modification 1 TTPs 14 IoCs

evasion

Modify Registry

T1112

Processes:

Orcus.exeMpDefenderCore.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	MpDefenderCore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	MpDefenderCore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	MpDefenderCore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	MpDefenderCore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	MpDefenderCore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	MpDefenderCore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	MpDefenderCore.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Orcus.exe
"C:\Users\Admin\AppData\Local\Temp\Orcus.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3856
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vpbcti95.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA15.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDA14.tmp"
    3⤵
    PID:1928
- C:\Windows\SysWOW64\WindowsInput.exe
  "C:\Windows\SysWOW64\WindowsInput.exe" --install
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4800
- C:\Program Files\Windows\MpDefenderCore.exe
  "C:\Program Files\Windows\MpDefenderCore.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Hijack Execution Flow: Executable Installer File Permissions Weakness
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1564
- - C:\Users\Admin\AppData\Roaming\xdwdwatchdog.exe
    "C:\Users\Admin\AppData\Roaming\xdwdwatchdog.exe" /launchSelfAndExit "C:\Program Files\Windows\MpDefenderCore.exe" 4468 /protectFile
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3364
  - - C:\Users\Admin\AppData\Roaming\xdwdwatchdog.exe
      "C:\Users\Admin\AppData\Roaming\xdwdwatchdog.exe" /watchProcess "C:\Program Files\Windows\MpDefenderCore.exe" 4468 "/protectFile"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2384

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe"
1⤵
- Executes dropped EXE
PID:4160

C:\Program Files\Windows\MpDefenderCore.exe
"C:\Program Files\Windows\MpDefenderCore.exe"
1⤵
- Executes dropped EXE
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows\MpDefenderCore.exe

Filesize
3.0MB

MD5
37128f8c34f0e2112cb6c60d2fe8d4c6

SHA1
42d4240892b4fcb2b5332fb70210238aa4070f6a

SHA256
8667faa80b6d3e4126e5e9e60b6e2f755f5388c5554e7b6fd59bcd5a342326ad

SHA512
f0387c7f8d4d74fc378599918cee295abf14e0cc3983a4e1681a7d40ba4b5af519a0bfec7244d2e081588590e421711dc412b3e32cb17c0a6b9db9a0d0656b88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\1385.exe

Filesize
3.0MB

MD5
f477cbf08bd39c9ca7e9672e06545a3f

SHA1
49351258ee224e27ea0e748ee9cc2a0d7df1393c

SHA256
2572ccef469dee92808c1a17fcf8e1dbe8ce7da7add84924b2e260a30d2f66ff

SHA512
96625a508c92e26f1df4d4f9f5cac9faeddafdf724f58eeb87c1fdcef28b346b44a16da7a945945560965a449045cf945f6e4f500e289ccbb69b8cdeefb1bb19

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESDA15.tmp

Filesize
1KB

MD5
d7d2c92cd98711453451a3fb6e3a702a

SHA1
d96d43f8d9f9ed434c3d8103b34cfa6111309adb

SHA256
8bb6a867a3d0c34fc4e825f2bd8abc7556a413977e5579cb6dce603c89a06028

SHA512
1b8d8eccee4ce7a823730b3645958353b6e8e6cb62e545e24246b33bc61fbc58347f5272c83b4f562cee94a0094f4602e8e81dc692f0eda9af722c52a9ddb199

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rgggr3wl.2bd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\vpbcti95.dll

Filesize
76KB

MD5
8de5cea1358027044f76d2390586e148

SHA1
83685748a480032b46571e6fddbe82ece3d1683b

SHA256
cb35565d4e11c9fbaf0731b9cd9fd9802faedafeee6310d9b731cd7108d78342

SHA512
01aae0777886f93f1fe6b3533240e7ffb4a28bcdbfb1f6043389ccdbc17401649284309161f74ee37aecec093599bbd35b52c8e5eed2bcaf894c115287813808

Download Submit
C:\Users\Admin\AppData\Roaming\xdwdwatchdog.exe

Filesize
9KB

MD5
7a195b6c9de2d5cab015f649da6931a1

SHA1
89f7372dd92a90a8e13b74ee512b464412e4cf9b

SHA256
30183935449a625c2a61f6342dc3b9907028194173f2e3d594eaa3126ee316bc

SHA512
3c2aeef85b51e7f955072fba042bcedf8dd0b66ad813def58c0134355665ba56a713d58005a322561c62be5777d0adea2803da214459f362f22fe2a0dba5a1c7

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe

Filesize
21KB

MD5
f6285edd247fa58161be33f8cf662d31

SHA1
e2b49bca43cd0bd6cc1eee582ba58f0ed6de1470

SHA256
bc16993d1a774793044ca37eb2ce84ecbdb5c578e3c710ed82879e07dcef2fec

SHA512
6f3e6073a1dafc679da1caa4a4c9cb7cc2da79c3f81034d7b7b7b1d855fd5421cbb517a7d3f9520f49d4d3b7f9577f4f8f92486994c8b78fabff5033b390a788

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe.config

Filesize
349B

MD5
89817519e9e0b4e703f07e8c55247861

SHA1
4636de1f6c997a25c3190f73f46a3fd056238d78

SHA256
f40dfaa50dcbff93611d45607009158f798e9cd845170939b1d6088a7d10ee13

SHA512
b017cb7a522b9c6794f3691cb7266ec82f565a90d7d07cc9beb53b939d2e9bf34275bc25f6f32d9a9c7136a0aab2189d9556af7244450c610d11ed7a4f584ba3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCDA14.tmp

Filesize
676B

MD5
f8f718bbe095157e8456392d9aeece04

SHA1
12e766f37cf16c595c050f29d14600959e3c6e7e

SHA256
6db189bea41354b0cba3da9b80a222adde3ef1551c7213810dbb1f7f7ccf25b4

SHA512
0230db5c429875e1b03685a64d31f981a5f750a077f83a98ae1674d42fbe210c36b6b82fef130a1baa6c12ce49ff9309369651fd5cab95c7f51c29705d7fecda

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vpbcti95.0.cs

Filesize
208KB

MD5
08fbb8126a1f8f5ace212252148c5059

SHA1
3376549ba938b6b007e247e9eb81dcdc351a2435

SHA256
e99d003ff0d3ff5ef5da2c77a7a027d0fdd5255a41ddba40ecec6c9ac42b6228

SHA512
fc45a76248db452ce9e047f24bff1b30bea67f903d45494013edf9802fbee54aa121b4b322867211a079f55a3d56edecd16b5b67c136ad4049dcc3594d713113

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vpbcti95.cmdline

Filesize
349B

MD5
734fdff5b2850910479e1b55735ac9c4

SHA1
2bcbb0e62eac8c459dfe2e12ba10ec0d9e9ea1ed

SHA256
4ff01815c009845ad8a41884f3902483b8da360ed56a51f343d3104ec5cd473f

SHA512
682e5180aaeff781e402065d91a2cb15b8a568796476e67eb0153cf14752602f7b041e82630b39aabb75333cafbbfff427c7dc65fe4c70fc60aa2b37baa7d0a0

Download Submit
memory/2376-43-0x0000000000BC0000-0x0000000000BD2000-memory.dmp

Filesize
72KB

Download
memory/2376-44-0x00000000023F0000-0x000000000242C000-memory.dmp

Filesize
240KB

Download
memory/2376-42-0x00007FF992263000-0x00007FF992265000-memory.dmp

Filesize
8KB

Download
memory/2376-41-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/3856-109-0x000000001E580000-0x000000001E5BE000-memory.dmp

Filesize
248KB

Download
memory/3856-117-0x000000001E200000-0x000000001E21E000-memory.dmp

Filesize
120KB

Download
memory/3856-27-0x000000001D950000-0x000000001D970000-memory.dmp

Filesize
128KB

Download
memory/3856-26-0x000000001D5E0000-0x000000001D5E8000-memory.dmp

Filesize
32KB

Download
memory/3856-24-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download
memory/3856-23-0x000000001C2B0000-0x000000001C2C2000-memory.dmp

Filesize
72KB

Download
memory/3856-21-0x000000001D5C0000-0x000000001D5D6000-memory.dmp

Filesize
88KB

Download
memory/3856-1-0x00007FF995C60000-0x00007FF996601000-memory.dmp

Filesize
9.6MB

Download
memory/3856-2-0x00007FF995C60000-0x00007FF996601000-memory.dmp

Filesize
9.6MB

Download
memory/3856-3-0x0000000001C80000-0x0000000001CDC000-memory.dmp

Filesize
368KB

Download
memory/3856-4-0x0000000001C20000-0x0000000001C2E000-memory.dmp

Filesize
56KB

Download
memory/3856-6-0x000000001D040000-0x000000001D0DC000-memory.dmp

Filesize
624KB

Download
memory/3856-65-0x000000001DC20000-0x000000001DC2E000-memory.dmp

Filesize
56KB

Download
memory/3856-66-0x000000001DC20000-0x000000001DCA4000-memory.dmp

Filesize
528KB

Download
memory/3856-67-0x00007FF995F15000-0x00007FF995F16000-memory.dmp

Filesize
4KB

Download
memory/3856-68-0x00007FF995C60000-0x00007FF996601000-memory.dmp

Filesize
9.6MB

Download
memory/3856-69-0x000000001DC60000-0x000000001DC68000-memory.dmp

Filesize
32KB

Download
memory/3856-70-0x000000001E210000-0x000000001E218000-memory.dmp

Filesize
32KB

Download
memory/3856-71-0x000000001E210000-0x000000001E218000-memory.dmp

Filesize
32KB

Download
memory/3856-72-0x000000001E210000-0x000000001E21C000-memory.dmp

Filesize
48KB

Download
memory/3856-73-0x000000001E210000-0x000000001E21A000-memory.dmp

Filesize
40KB

Download
memory/3856-74-0x000000001E440000-0x000000001E470000-memory.dmp

Filesize
192KB

Download
memory/3856-75-0x000000001E4C0000-0x000000001E534000-memory.dmp

Filesize
464KB

Download
memory/3856-76-0x000000001E750000-0x000000001EA52000-memory.dmp

Filesize
3.0MB

Download
memory/3856-89-0x000000001E0B0000-0x000000001E168000-memory.dmp

Filesize
736KB

Download
memory/3856-81-0x000000001E0B0000-0x000000001E162000-memory.dmp

Filesize
712KB

Download
memory/3856-91-0x00007FF995C60000-0x00007FF996601000-memory.dmp

Filesize
9.6MB

Download
memory/3856-92-0x000000001E440000-0x000000001E460000-memory.dmp

Filesize
128KB

Download
memory/3856-93-0x000000001E210000-0x000000001E21E000-memory.dmp

Filesize
56KB

Download
memory/3856-94-0x000000001E4E0000-0x000000001E574000-memory.dmp

Filesize
592KB

Download
memory/3856-95-0x0000000140000000-0x000000014002C000-memory.dmp

Filesize
176KB

Download
memory/3856-101-0x000000001E200000-0x000000001E218000-memory.dmp

Filesize
96KB

Download
memory/3856-102-0x000000001E200000-0x000000001E216000-memory.dmp

Filesize
88KB

Download
memory/3856-103-0x000000001E580000-0x000000001E5AA000-memory.dmp

Filesize
168KB

Download
memory/3856-104-0x000000001DCA0000-0x000000001DCA8000-memory.dmp

Filesize
32KB

Download
memory/3856-105-0x000000001DCA0000-0x000000001DCAC000-memory.dmp

Filesize
48KB

Download
memory/3856-106-0x000000001E200000-0x000000001E220000-memory.dmp

Filesize
128KB

Download
memory/3856-107-0x000000001E580000-0x000000001E5A6000-memory.dmp

Filesize
152KB

Download
memory/3856-108-0x000000001E580000-0x000000001E5C0000-memory.dmp

Filesize
256KB

Download
memory/3856-0-0x00007FF995F15000-0x00007FF995F16000-memory.dmp

Filesize
4KB

Download
memory/3856-110-0x000000001E580000-0x000000001E5AC000-memory.dmp

Filesize
176KB

Download
memory/3856-111-0x000000001DCA0000-0x000000001DCA8000-memory.dmp

Filesize
32KB

Download
memory/3856-112-0x000000001DCA0000-0x000000001DCAA000-memory.dmp

Filesize
40KB

Download
memory/3856-113-0x000000001E580000-0x000000001E5A4000-memory.dmp

Filesize
144KB

Download
memory/3856-114-0x000000001E580000-0x000000001E5A8000-memory.dmp

Filesize
160KB

Download
memory/3856-116-0x000000001DCA0000-0x000000001DCAA000-memory.dmp

Filesize
40KB

Download
memory/3856-115-0x000000001DCA0000-0x000000001DCAC000-memory.dmp

Filesize
48KB

Download
memory/3856-25-0x000000001C2D0000-0x000000001C2DA000-memory.dmp

Filesize
40KB

Download
memory/3856-118-0x000000001E200000-0x000000001E21E000-memory.dmp

Filesize
120KB

Download
memory/3856-119-0x000000001DCA0000-0x000000001DCA8000-memory.dmp

Filesize
32KB

Download
memory/3856-120-0x000000001DCA0000-0x000000001DCAA000-memory.dmp

Filesize
40KB

Download
memory/3856-121-0x000000001DCA0000-0x000000001DCAE000-memory.dmp

Filesize
56KB

Download
memory/3856-122-0x000000001E200000-0x000000001E214000-memory.dmp

Filesize
80KB

Download
memory/3856-123-0x000000001DCA0000-0x000000001DCB0000-memory.dmp

Filesize
64KB

Download
memory/3856-124-0x000000001DCA0000-0x000000001DCAC000-memory.dmp

Filesize
48KB

Download
memory/3856-125-0x000000001E580000-0x000000001E5A8000-memory.dmp

Filesize
160KB

Download
memory/3856-126-0x000000001DCA0000-0x000000001DCAA000-memory.dmp

Filesize
40KB

Download
memory/3856-127-0x000000001DCA0000-0x000000001DCAC000-memory.dmp

Filesize
48KB

Download
memory/3856-128-0x000000001DCA0000-0x000000001DCAC000-memory.dmp

Filesize
48KB

Download
memory/3856-129-0x000000001DCA0000-0x000000001DCAC000-memory.dmp

Filesize
48KB

Download
memory/3856-130-0x000000001E200000-0x000000001E214000-memory.dmp

Filesize
80KB

Download
memory/3856-131-0x000000001E200000-0x000000001E218000-memory.dmp

Filesize
96KB

Download
memory/3856-132-0x000000001DCA0000-0x000000001DCAC000-memory.dmp

Filesize
48KB

Download
memory/3856-133-0x000000001DCA0000-0x000000001DCAC000-memory.dmp

Filesize
48KB

Download
memory/3856-134-0x000000001DCA0000-0x000000001DCAC000-memory.dmp

Filesize
48KB

Download
memory/3856-135-0x000000001DCA0000-0x000000001DCB0000-memory.dmp

Filesize
64KB

Download
memory/3856-136-0x000000001DCA0000-0x000000001DCAE000-memory.dmp

Filesize
56KB

Download
memory/3856-137-0x000000001E580000-0x000000001E5A2000-memory.dmp

Filesize
136KB

Download
memory/3856-138-0x000000001E200000-0x000000001E21C000-memory.dmp

Filesize
112KB

Download
memory/3856-152-0x000000001E200000-0x000000001E214000-memory.dmp

Filesize
80KB

Download
memory/3856-153-0x000000001E200000-0x000000001E21A000-memory.dmp

Filesize
104KB

Download
memory/3856-154-0x000000001DCA0000-0x000000001DCAC000-memory.dmp

Filesize
48KB

Download
memory/3856-155-0x000000001DCA0000-0x000000001DCAE000-memory.dmp

Filesize
56KB

Download
memory/3856-156-0x000000001E200000-0x000000001E218000-memory.dmp

Filesize
96KB

Download
memory/3856-157-0x000000001E200000-0x000000001E212000-memory.dmp

Filesize
72KB

Download
memory/3856-158-0x000000001DCA0000-0x000000001DCAE000-memory.dmp

Filesize
56KB

Download
memory/3856-159-0x000000001DCA0000-0x000000001DCAA000-memory.dmp

Filesize
40KB

Download
memory/3856-160-0x000000001DCA0000-0x000000001DCA8000-memory.dmp

Filesize
32KB

Download
memory/3856-161-0x000000001E200000-0x000000001E21C000-memory.dmp

Filesize
112KB

Download
memory/3856-162-0x000000001E200000-0x000000001E21C000-memory.dmp

Filesize
112KB

Download
memory/3856-163-0x000000001DCA0000-0x000000001DCA8000-memory.dmp

Filesize
32KB

Download
memory/3856-164-0x000000001DCA0000-0x000000001DCA8000-memory.dmp

Filesize
32KB

Download
memory/3856-165-0x000000001DCA0000-0x000000001DCA8000-memory.dmp

Filesize
32KB

Download
memory/3856-166-0x000000001DCA0000-0x000000001DCAE000-memory.dmp

Filesize
56KB

Download
memory/3856-167-0x000000001E200000-0x000000001E212000-memory.dmp

Filesize
72KB

Download
memory/3856-168-0x000000001DCA0000-0x000000001DCAE000-memory.dmp

Filesize
56KB

Download
memory/3856-169-0x000000001DCA0000-0x000000001DCAA000-memory.dmp

Filesize
40KB

Download
memory/3856-170-0x000000001E580000-0x000000001E5AA000-memory.dmp

Filesize
168KB

Download
memory/3856-171-0x000000001E580000-0x000000001E5A8000-memory.dmp

Filesize
160KB

Download
memory/3856-172-0x000000001E200000-0x000000001E21E000-memory.dmp

Filesize
120KB

Download
memory/3856-5-0x000000001CAD0000-0x000000001CF9E000-memory.dmp

Filesize
4.8MB

Download
memory/4160-49-0x000000001AA30000-0x000000001AB3A000-memory.dmp

Filesize
1.0MB

Download
memory/4660-16-0x00007FF995C60000-0x00007FF996601000-memory.dmp

Filesize
9.6MB

Download
memory/4660-19-0x00007FF995C60000-0x00007FF996601000-memory.dmp

Filesize
9.6MB

Download
memory/4800-53-0x000001BD194D0000-0x000001BD194F2000-memory.dmp

Filesize
136KB

Download