valleyrat_s2 | 3d20d079d777d5c179d709428935d51605d82a8668ac716eb89f8249c46adb8d

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2025, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
Size

21.8MB
MD5

f1795a8e111b967491cefe7438f38267
SHA1

ec6783287f8fba0a53534b88ad027799f054e023
SHA256

3d20d079d777d5c179d709428935d51605d82a8668ac716eb89f8249c46adb8d
SHA512

a70a16730a858bf59f0c18274b2251206ab0136a34237447a3b1fa624c1c19a7ff8c431b7352534d739770d5b9674bd043199d1461584bc9366feaeb2e7014b9
SSDEEP

49152:XciUvXVc5YlG4V5EXHwCC5hDOng6kpicavOafd4+9mNneuEBELEMjFRwV:sislc5YlG4fnzDOnREoQBe

Score

10^/10

valleyrat_s2 backdoor defense_evasion discovery privilege_escalation trojan

Malware Config

Extracted

Family

valleyrat_s2

Version

1.0

154.39.239.95:1445

Attributes

campaign_date
2025. 3. 5

Signatures

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2
Valleyrat_s2 family
valleyrat_s2

Blocklisted process makes network request 21 IoCs

flow	pid	Process
23	3568	cmd.exe
24	4932	cmd.exe
25	4848	cmd.exe
31	4848	cmd.exe
32	4932	cmd.exe
33	3568	cmd.exe
60	3568	cmd.exe
61	4848	cmd.exe
62	4932	cmd.exe
71	4932	cmd.exe
72	4848	cmd.exe
73	3568	cmd.exe
74	4848	cmd.exe
75	4932	cmd.exe
76	3568	cmd.exe
80	4932	cmd.exe
81	4848	cmd.exe
82	3568	cmd.exe
83	4932	cmd.exe
84	4848	cmd.exe
85	3568	cmd.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	mshta.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dPnsKQt.lnk	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nvMRNTtwJMPa.HnamDcWZj	asdccx.exe

Executes dropped EXE 4 IoCs

pid	Process
4640	pYDJFbnxcWxF.exe
5648	asdccx.exe
5300	asdccx.exe
5004	asdccx.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4640 set thread context of 4848	4640	pYDJFbnxcWxF.exe	98
PID 4640 set thread context of 4932	4640	pYDJFbnxcWxF.exe	99
PID 4640 set thread context of 3568	4640	pYDJFbnxcWxF.exe	101
PID 4640 set thread context of 5648	4640	pYDJFbnxcWxF.exe	102
PID 4640 set thread context of 5300	4640	pYDJFbnxcWxF.exe	103
PID 4640 set thread context of 5004	4640	pYDJFbnxcWxF.exe	104

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
4952	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4532	5096	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdccx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pYDJFbnxcWxF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdccx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdccx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	subst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.HnamDcWZj\ = "TdsxcnLong"	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TdsxcnLong\Shell\Open\Command	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.HnamDcWZj	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TdsxcnLong	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TdsxcnLong\Shell	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TdsxcnLong\Shell\Open	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TdsxcnLong\Shell\Open\Command\ = "C:\\Users\\Public\\WSkOgkc\\pYDJFbnxcWxF.exe 3264511234"	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	mshta.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5832	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1016	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
1016	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
1016	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
1016	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe
5648	asdccx.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
5096	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
5096	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
5096	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
1016	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
1016	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
1016	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
4640	pYDJFbnxcWxF.exe
4640	pYDJFbnxcWxF.exe
4640	pYDJFbnxcWxF.exe
5648	asdccx.exe
5648	asdccx.exe
5300	asdccx.exe
5300	asdccx.exe
5004	asdccx.exe
5004	asdccx.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 1016	5096	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe	91
PID 5096 wrote to memory of 1016	5096	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe	91
PID 5096 wrote to memory of 1016	5096	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe	91
PID 1016 wrote to memory of 4640	1016	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe	96
PID 1016 wrote to memory of 4640	1016	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe	96
PID 1016 wrote to memory of 4640	1016	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe	96
PID 4640 wrote to memory of 4808	4640	pYDJFbnxcWxF.exe	97
PID 4640 wrote to memory of 4808	4640	pYDJFbnxcWxF.exe	97
PID 4640 wrote to memory of 4808	4640	pYDJFbnxcWxF.exe	97
PID 4640 wrote to memory of 4848	4640	pYDJFbnxcWxF.exe	98
PID 4640 wrote to memory of 4848	4640	pYDJFbnxcWxF.exe	98
PID 4640 wrote to memory of 4848	4640	pYDJFbnxcWxF.exe	98
PID 4640 wrote to memory of 4848	4640	pYDJFbnxcWxF.exe	98
PID 4640 wrote to memory of 4848	4640	pYDJFbnxcWxF.exe	98
PID 4640 wrote to memory of 4848	4640	pYDJFbnxcWxF.exe	98
PID 4640 wrote to memory of 4848	4640	pYDJFbnxcWxF.exe	98
PID 4640 wrote to memory of 4848	4640	pYDJFbnxcWxF.exe	98
PID 4640 wrote to memory of 4848	4640	pYDJFbnxcWxF.exe	98
PID 4640 wrote to memory of 4848	4640	pYDJFbnxcWxF.exe	98
PID 4640 wrote to memory of 4932	4640	pYDJFbnxcWxF.exe	99
PID 4640 wrote to memory of 4932	4640	pYDJFbnxcWxF.exe	99
PID 4640 wrote to memory of 4932	4640	pYDJFbnxcWxF.exe	99
PID 4640 wrote to memory of 4932	4640	pYDJFbnxcWxF.exe	99
PID 4640 wrote to memory of 4932	4640	pYDJFbnxcWxF.exe	99
PID 4640 wrote to memory of 4932	4640	pYDJFbnxcWxF.exe	99
PID 4640 wrote to memory of 4932	4640	pYDJFbnxcWxF.exe	99
PID 4640 wrote to memory of 4932	4640	pYDJFbnxcWxF.exe	99
PID 4640 wrote to memory of 4932	4640	pYDJFbnxcWxF.exe	99
PID 4640 wrote to memory of 4932	4640	pYDJFbnxcWxF.exe	99
PID 4640 wrote to memory of 3568	4640	pYDJFbnxcWxF.exe	101
PID 4640 wrote to memory of 3568	4640	pYDJFbnxcWxF.exe	101
PID 4640 wrote to memory of 3568	4640	pYDJFbnxcWxF.exe	101
PID 4640 wrote to memory of 3568	4640	pYDJFbnxcWxF.exe	101
PID 4640 wrote to memory of 3568	4640	pYDJFbnxcWxF.exe	101
PID 4640 wrote to memory of 3568	4640	pYDJFbnxcWxF.exe	101
PID 4640 wrote to memory of 3568	4640	pYDJFbnxcWxF.exe	101
PID 4640 wrote to memory of 3568	4640	pYDJFbnxcWxF.exe	101
PID 4640 wrote to memory of 3568	4640	pYDJFbnxcWxF.exe	101
PID 4640 wrote to memory of 3568	4640	pYDJFbnxcWxF.exe	101
PID 4640 wrote to memory of 5648	4640	pYDJFbnxcWxF.exe	102
PID 4640 wrote to memory of 5648	4640	pYDJFbnxcWxF.exe	102
PID 4640 wrote to memory of 5648	4640	pYDJFbnxcWxF.exe	102
PID 4640 wrote to memory of 5648	4640	pYDJFbnxcWxF.exe	102
PID 4640 wrote to memory of 5648	4640	pYDJFbnxcWxF.exe	102
PID 4640 wrote to memory of 5648	4640	pYDJFbnxcWxF.exe	102
PID 4640 wrote to memory of 5648	4640	pYDJFbnxcWxF.exe	102
PID 4640 wrote to memory of 5648	4640	pYDJFbnxcWxF.exe	102
PID 4640 wrote to memory of 5648	4640	pYDJFbnxcWxF.exe	102
PID 4640 wrote to memory of 5300	4640	pYDJFbnxcWxF.exe	103
PID 4640 wrote to memory of 5300	4640	pYDJFbnxcWxF.exe	103
PID 4640 wrote to memory of 5300	4640	pYDJFbnxcWxF.exe	103
PID 4640 wrote to memory of 5300	4640	pYDJFbnxcWxF.exe	103
PID 4640 wrote to memory of 5300	4640	pYDJFbnxcWxF.exe	103
PID 4640 wrote to memory of 5300	4640	pYDJFbnxcWxF.exe	103
PID 4640 wrote to memory of 5300	4640	pYDJFbnxcWxF.exe	103
PID 4640 wrote to memory of 5300	4640	pYDJFbnxcWxF.exe	103
PID 4640 wrote to memory of 5300	4640	pYDJFbnxcWxF.exe	103
PID 4640 wrote to memory of 5004	4640	pYDJFbnxcWxF.exe	104
PID 4640 wrote to memory of 5004	4640	pYDJFbnxcWxF.exe	104
PID 4640 wrote to memory of 5004	4640	pYDJFbnxcWxF.exe	104
PID 4640 wrote to memory of 5004	4640	pYDJFbnxcWxF.exe	104
PID 4640 wrote to memory of 5004	4640	pYDJFbnxcWxF.exe	104
PID 4640 wrote to memory of 5004	4640	pYDJFbnxcWxF.exe	104
PID 4640 wrote to memory of 5004	4640	pYDJFbnxcWxF.exe	104

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe

C:\Users\Admin\AppData\Local\Temp\2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Users\Admin\AppData\Local\Temp\2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer.exe" 65423587
  2⤵
  - UAC bypass
  - Drops startup file
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1016
- - C:\Users\Public\WSkOgkc\pYDJFbnxcWxF.exe
    C:\Users\Public\WSkOgkc\pYDJFbnxcWxF.exe 3264511234
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Public\WSkOgkc\62310.cmd
      4⤵
      System Location Discovery: System Language Discovery
      PID:4808
    - - C:\Windows\SysWOW64\mshta.exe
        
        mshta vbscript:createobject("shell.application").shellexecute("C:\Users\Public\WSkOgkc\62310.cmd","::","","runas",0)(window.close)
        5⤵
        Checks computer location settings
        Access Token Manipulation: Create Process with Token
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4952
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Public\WSkOgkc\62310.cmd" ::
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Windows\SysWOW64\subst.exe
        
        subst o: /d
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5832
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SYSTEM\ControlSet001\Control\Session Manager\DOS Devices" /v O: /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1956
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe
      4⤵
      Blocklisted process makes network request
      System Location Discovery: System Language Discovery
      PID:4848
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe
      4⤵
      Blocklisted process makes network request
      System Location Discovery: System Language Discovery
      PID:4932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe
      4⤵
      Blocklisted process makes network request
      System Location Discovery: System Language Discovery
      PID:3568
  - - C:\Users\Public\WSkOgkc\asdccx.exe
      C:\Users\Public\WSkOgkc\asdccx.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5648
  - - C:\Users\Public\WSkOgkc\asdccx.exe
      C:\Users\Public\WSkOgkc\asdccx.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5300
  - - C:\Users\Public\WSkOgkc\asdccx.exe
      C:\Users\Public\WSkOgkc\asdccx.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 1416
  2⤵
  - Program crash
  PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5096 -ip 5096
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\WSkOgkc\62310.cmd

Filesize
413B

MD5
675e12cfecc9ced36cc924981b0a1637

SHA1
6b9ac34248d15b292663593fed704fa8e96aea08

SHA256
6f17d3d9e7d5374f11f9bfc1adb0fc53e78cd5861c8272cdc3bac0fe88bfb9c6

SHA512
d0507e1781a66846a7f7a046139b07c7176861d7a496ed334918c19bb51d00ae9f683eae9e8e9397f0587e3b26fe8aeb4568f9a39410b00b730288a790ac4c28

Download Submit
C:\Users\Public\WSkOgkc\asdccx.exe

Filesize
231KB

MD5
d0fce3afa6aa1d58ce9fa336cc2b675b

SHA1
4048488de6ba4bfef9edf103755519f1f762668f

SHA256
4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22

SHA512
80e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2

Download Submit
C:\Users\Public\WSkOgkc\asvv.txt

Filesize
108KB

MD5
4cf58cd3bc03c3ced6cc48c5ccf08961

SHA1
cfef73a005db72c34fb6f8d98ec29da0641dfd96

SHA256
106bc9812d240651c48ced1435ccfd6754808ec17bb57624fe5b737ce447f544

SHA512
75e7701d75c91b7b0400ba4ce3f94a07337b6c3b67010714e6a35c491ad7bf7a2c2a75317d4d723c18eded78306443778a6ae381a4dc3afd6636ed526469fa37

Download Submit
C:\Users\Public\WSkOgkc\pYDJFbnxcWxF.exe

Filesize
21.8MB

MD5
f1795a8e111b967491cefe7438f38267

SHA1
ec6783287f8fba0a53534b88ad027799f054e023

SHA256
3d20d079d777d5c179d709428935d51605d82a8668ac716eb89f8249c46adb8d

SHA512
a70a16730a858bf59f0c18274b2251206ab0136a34237447a3b1fa624c1c19a7ff8c431b7352534d739770d5b9674bd043199d1461584bc9366feaeb2e7014b9

Download Submit
memory/3568-43-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3568-44-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4848-23-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4848-22-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4848-26-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4848-20-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4848-21-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4848-24-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4848-33-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4932-34-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4932-35-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5648-47-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/5648-46-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/5648-48-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/5648-59-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/5648-45-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download