b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
899s
max time network
437s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2025, 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
Size

628KB
MD5

97a26d9e3598fea2e1715c6c77b645c2
SHA1

c4bf3a00c9223201aa11178d0f0b53c761a551c4
SHA256

e5df93c0fedca105218296cbfc083bdc535ca99862f10d21a179213203d6794f
SHA512

acfec633714f72bd5c39f16f10e39e88b5c1cf0adab7154891a383912852f92d3415b0b2d874a8f8f3166879e63796a8ed25ee750c6e4be09a4dddd8c849920c
SSDEEP

12288:2oXYZawPO7urFw4HLLDOeLSwg4ULeHOuCqA8:2oXYFIuh5HjhSwiJ8

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Suijgmhjmgip = "\"C:\\Users\\Admin\\AppData\\Roaming\\qf4Q\\FXSCOVER.exe\""	Process not Found

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\kT4cvY\perfmon.exe	cmd.exe
File opened for modification	C:\Windows\system32\kT4cvY\perfmon.exe	cmd.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\ms-settings\shell\open\command\ = "C:\\Windows\\system32\\cmd.exe /c C:\\Users\\Admin\\AppData\\Local\\Temp\\yt2n.cmd"	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\ms-settings\shell\open	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\ms-settings\shell	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\ms-settings	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\ms-settings\shell\open\command	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\ms-settings	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\ms-settings\shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\ms-settings\shell\open	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\ms-settings\shell\open\command\DelegateExecute	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\ms-settings\shell\open\command	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1660	rundll32.exe
1660	rundll32.exe
1660	rundll32.exe
1660	rundll32.exe
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found
3436	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3436	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found
Token: SeShutdownPrivilege	3436	Process not Found
Token: SeCreatePagefilePrivilege	3436	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 948	3436	Process not Found	93
PID 3436 wrote to memory of 948	3436	Process not Found	93
PID 3436 wrote to memory of 2524	3436	Process not Found	94
PID 3436 wrote to memory of 2524	3436	Process not Found	94
PID 3436 wrote to memory of 4528	3436	Process not Found	96
PID 3436 wrote to memory of 4528	3436	Process not Found	96
PID 3436 wrote to memory of 2324	3436	Process not Found	97
PID 3436 wrote to memory of 2324	3436	Process not Found	97
PID 3436 wrote to memory of 4388	3436	Process not Found	99
PID 3436 wrote to memory of 4388	3436	Process not Found	99
PID 4388 wrote to memory of 2472	4388	fodhelper.exe	100
PID 4388 wrote to memory of 2472	4388	fodhelper.exe	100
PID 2472 wrote to memory of 1952	2472	cmd.exe	102
PID 2472 wrote to memory of 1952	2472	cmd.exe	102
PID 3436 wrote to memory of 3968	3436	Process not Found	105
PID 3436 wrote to memory of 3968	3436	Process not Found	105
PID 3968 wrote to memory of 4008	3968	cmd.exe	107
PID 3968 wrote to memory of 4008	3968	cmd.exe	107
PID 3436 wrote to memory of 3368	3436	Process not Found	108
PID 3436 wrote to memory of 3368	3436	Process not Found	108
PID 3368 wrote to memory of 2248	3368	cmd.exe	110
PID 3368 wrote to memory of 2248	3368	cmd.exe	110
PID 3436 wrote to memory of 2772	3436	Process not Found	111
PID 3436 wrote to memory of 2772	3436	Process not Found	111
PID 2772 wrote to memory of 4812	2772	cmd.exe	113
PID 2772 wrote to memory of 4812	2772	cmd.exe	113
PID 3436 wrote to memory of 2388	3436	Process not Found	115
PID 3436 wrote to memory of 2388	3436	Process not Found	115
PID 2388 wrote to memory of 4800	2388	cmd.exe	117
PID 2388 wrote to memory of 4800	2388	cmd.exe	117
PID 3436 wrote to memory of 2376	3436	Process not Found	118
PID 3436 wrote to memory of 2376	3436	Process not Found	118
PID 2376 wrote to memory of 4468	2376	cmd.exe	120
PID 2376 wrote to memory of 4468	2376	cmd.exe	120
PID 3436 wrote to memory of 4428	3436	Process not Found	121
PID 3436 wrote to memory of 4428	3436	Process not Found	121
PID 4428 wrote to memory of 4148	4428	cmd.exe	123
PID 4428 wrote to memory of 4148	4428	cmd.exe	123
PID 3436 wrote to memory of 3232	3436	Process not Found	124
PID 3436 wrote to memory of 3232	3436	Process not Found	124
PID 3232 wrote to memory of 3812	3232	cmd.exe	126
PID 3232 wrote to memory of 3812	3232	cmd.exe	126
PID 3436 wrote to memory of 1036	3436	Process not Found	138
PID 3436 wrote to memory of 1036	3436	Process not Found	138
PID 1036 wrote to memory of 3092	1036	cmd.exe	140
PID 1036 wrote to memory of 3092	1036	cmd.exe	140
PID 3436 wrote to memory of 2976	3436	Process not Found	145
PID 3436 wrote to memory of 2976	3436	Process not Found	145
PID 2976 wrote to memory of 3604	2976	cmd.exe	147
PID 2976 wrote to memory of 3604	2976	cmd.exe	147
PID 3436 wrote to memory of 1556	3436	Process not Found	149
PID 3436 wrote to memory of 1556	3436	Process not Found	149
PID 1556 wrote to memory of 4772	1556	cmd.exe	151
PID 1556 wrote to memory of 4772	1556	cmd.exe	151
PID 3436 wrote to memory of 2964	3436	Process not Found	152
PID 3436 wrote to memory of 2964	3436	Process not Found	152
PID 2964 wrote to memory of 3092	2964	cmd.exe	154
PID 2964 wrote to memory of 3092	2964	cmd.exe	154
PID 3436 wrote to memory of 2764	3436	Process not Found	155
PID 3436 wrote to memory of 2764	3436	Process not Found	155
PID 2764 wrote to memory of 3632	2764	cmd.exe	157
PID 2764 wrote to memory of 3632	2764	cmd.exe	157
PID 3436 wrote to memory of 3976	3436	Process not Found	158
PID 3436 wrote to memory of 3976	3436	Process not Found	158

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\Trojan.Dridex.A.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1660

C:\Windows\system32\FXSCOVER.exe
C:\Windows\system32\FXSCOVER.exe
1⤵
PID:948

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\hotRb.cmd
1⤵
PID:2524

C:\Windows\system32\perfmon.exe
C:\Windows\system32\perfmon.exe
1⤵
PID:4528

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\2tBW.cmd
1⤵
- Drops file in System32 directory
PID:2324

C:\Windows\System32\fodhelper.exe
"C:\Windows\System32\fodhelper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\yt2n.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Create /F /TN "Schedzttkcjfvl" /TR C:\Windows\system32\kT4cvY\perfmon.exe /SC minute /MO 60 /RL highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1952

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:4008

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:2248

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:4812

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:4800

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:4468

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:4148

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:3812

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:3092

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:3604

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:4772

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:3092

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:3632

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:3976
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:3240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:4812
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:1224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:1188
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:2152

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:3640
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:1180

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:3060
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:2172

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:4080
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:4308

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:2436
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:1036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:4544
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:1896

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:3468
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:4604

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:5040
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:2472

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:1068
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:748

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:4584
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:2356

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:3008
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:4040

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:4140
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:516

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:2572
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:4028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:4592
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:3360

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:2436
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:4688

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:3660
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:2648

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:3916
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:4352

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:4504
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:3952

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:876
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:3756

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:4972
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:1128

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:2888
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:2556

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:336
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:688

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:4184
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:1728

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:720
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:3008

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:1520
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:3204

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:2740
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:2080

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:5080
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:3360

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:4384
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:2964

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Schedzttkcjfvl"
1⤵
PID:2428
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Query /TN "Schedzttkcjfvl"
  2⤵
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2tBW.cmd

Filesize
198B

MD5
e9142cfb7d9dde8c2bc6239d1e447c32

SHA1
1f032b558b6504b34e9cc1ff01519d049026378b

SHA256
0ab90aca6920728efb642456855c1159b8af9628f8a74c636a0754fa6d867e9b

SHA512
29c0bd109bfb26c60999cec27bbae41e6584e0330abab74cb4662826973497ea9534e8d4d5745241e9e1e1a11a2105ac50f539f50aac4944c2023dedec87e220

Download Submit
C:\Users\Admin\AppData\Local\Temp\5NDF44.tmp

Filesize
656KB

MD5
fc2fe85ab140b2cbe3085d70cd13d94f

SHA1
3d1574d90ba3a4c75cfb6d2e7958ff0574f73f08

SHA256
76de5ccb03117e17004906cd142c153fb5313184d53ac50ce0c5646aa189c293

SHA512
abaa924ba05b65872c181884b4a4a02cf4dbb459f29a1084c937fc9faa36dc637324eca7f607d7971cab511f827f310e11fc1b43b6dadd1511e16cdcd80f3c14

Download Submit
C:\Users\Admin\AppData\Local\Temp\hotRb.cmd

Filesize
226B

MD5
3639f1bc7c94f3f9430262925f28395e

SHA1
facd82cb84885ba31806a61e71f5da57ceb5e33a

SHA256
9f0cada6bd06b168660861c663c5e7ee8617a8458e9fa4d71f959278d46b6e62

SHA512
2ad2003bb40ac1cb8cf09a408739251513755747ca44e68cde8608d9171f0f2a43904b859cc6cac94928834237c64e50ea5d654e3e3a1c60ae3d1d0f67a6c5d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpi711.tmp

Filesize
628KB

MD5
53b70226ae42621f6e7348bf61697024

SHA1
7af1b76fae44a82b98a00b7a6668b1ab0ff927e0

SHA256
b90870df009c323f3b58d103cd93e1f7d7bd7c9bc064263aa2525ec7ede1ed3c

SHA512
6c60deaa36ae10af1c19bf3fa47b4ae13b9a87bb3df77fbc1078b5497849075bb40c9ed87140e4edad938e0d6363fec4c70dbdacd31ede071ee502527ab49fec

Download Submit
C:\Users\Admin\AppData\Local\Temp\yt2n.cmd

Filesize
132B

MD5
ea2c588a20d9f3db2477db736b632dba

SHA1
14af02dfd020858af59277a5133baf20442b283d

SHA256
a69b4bf212bdc7fba269f2e08a7e264c83b83c3110a8786908b8e5e631fbe9f2

SHA512
9b379e06139b36b2ab8beeed1421c536305c5e6728623f1a62cf9348d118752d279125fd675c74fdb9fabb7059a4555d92357a150326e14f411692f2c80f0efc

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Suijgmhjmgip.lnk

Filesize
900B

MD5
0f36318bcc32959a2a0e3cb54b5bfb4d

SHA1
03325c86799b6cbc242b1fa3073fabeea285594e

SHA256
499b49a8cdeaf3722730756c793e4cfa3b508895d36956580fd5a175b9800156

SHA512
88bd467e4dd9e444afeb91fbd2fff797f45a207aa9fea73e0ec128d6a178478f099a25a534dcc623f8d9248b74cfbc6293711a0ec13c556d90226c0fd3813841

Download Submit
C:\Users\Admin\AppData\Roaming\qf4Q\FXSCOVER.exe

Filesize
242KB

MD5
5769f78d00f22f76a4193dc720d0b2bd

SHA1
d62b6cab057e88737cba43fe9b0c6d11a28b53e8

SHA256
40e8e6dabfa1485b11cdccf220eb86eeaa8256e99e344cf2b2098d4cdb788a31

SHA512
b4b3448a2635b21690c71254d964832e89bf947f7a0d32e79dcc84730f11d4afb4149a810a768878e52f88fc8baec45f1a2fec8e22c5301e9f39fe4fc6a57e3f

Download Submit
memory/1660-0-0x00007FFFC9C70000-0x00007FFFC9D0D000-memory.dmp

Filesize
628KB

Download
memory/1660-6-0x00007FFFC9C70000-0x00007FFFC9D0D000-memory.dmp

Filesize
628KB

Download
memory/1660-2-0x00000138BD710000-0x00000138BD717000-memory.dmp

Filesize
28KB

Download
memory/3436-13-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/3436-33-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/3436-15-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/3436-9-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/3436-8-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/3436-7-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/3436-31-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/3436-10-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/3436-11-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/3436-20-0x0000000002C90000-0x0000000002C97000-memory.dmp

Filesize
28KB

Download
memory/3436-24-0x00007FFFE7A00000-0x00007FFFE7A10000-memory.dmp

Filesize
64KB

Download
memory/3436-21-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/3436-12-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/3436-4-0x00007FFFE661A000-0x00007FFFE661B000-memory.dmp

Filesize
4KB

Download
memory/3436-3-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

Filesize
4KB

Download