Resubmissions
25/11/2025, 20:55
251125-zqtrasslcj1025/11/2025, 20:43
251125-zhyehsyjay1025/11/2025, 20:43
251125-zhxszsyjax25/11/2025, 20:43
251125-zhpsdayjaw23/09/2025, 19:26
250923-x5k2laem811018/08/2025, 23:28
250818-3gc9qsytgx18/08/2025, 23:28
250818-3gbe5sykz415/08/2025, 10:08
250815-l6cwtswvay1015/08/2025, 10:08
250815-l57ptawvax14/08/2025, 15:38
250814-s3edtawpw210Analysis
- geolocation tags
- max time kernel
300s - max time network
301s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
- submitted
23/09/2025, 19:26
General
- Target 37d8e1ce3b6e6488942717aa78cb54785edc985143bcc8d9ba9f42d73a3dbd7a.exe
- Size 22.5MB
- Sample250923-x5k2laem81
- SHA256 37d8e1ce3b6e6488942717aa78cb54785edc985143bcc8d9ba9f42d73a3dbd7a
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
Default
-
gfhhjgh.duckdns.org:8050
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
system32.exe
-
install_folder
%AppData%
Extracted
-
redline
-
@zhilsholi
-
yabynennet.xyz:81
-
auth_value
c2d0b7a2ede97b91495c99e75b4f27fb
Extracted
-
fickerstealer
-
80.87.192.115:80
Extracted
-
raccoon
-
1.8.3-hotfix
-
5781468cedb3a203003fdf1f12e72fe98d6f1c0f
-
url4cnc
http://194.180.174.53/brikitiki
http://91.219.236.18/brikitiki
http://194.180.174.41/brikitiki
http://91.219.236.148/brikitiki
https://t.me/brikitiki
Extracted
-
azorult
-
http://195.245.112.115/index.php
Extracted
-
pony
-
http://londonpaerl.co.uk/yesup/gate.php
Extracted
-
oski
-
prepepe.ac.ug
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Azorult family
- Blackmoon family
- Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Dcrat family
- Detect Blackmoon payload 2 IoCs
- Detect PurpleFox Rootkit 9 IoCs
Detect PurpleFox Rootkit.
- Fickerstealer
Ficker is an infostealer written in Rust and ASM.
- Fickerstealer family
- Gh0st RAT payload 10 IoCs
- Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Gh0strat family
- HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
- Hawkeye family
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Nanocore family
- Oski
Oski is an infostealer targeting browser data, crypto wallets.
- Oski family
- Pony family
- Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
- Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
- Purplefox family
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V1 payload 4 IoCs
- Raccoon family
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Redline family
- UAC bypass 3 TTPs 3 IoCs
- Xmrig family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Async RAT payload 2 IoCs
- DCRat payload 2 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Detected Nirsoft tools 7 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
- XMRig Miner payload 8 IoCs
- Drops file in Drivers directory 1 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
- Sets service image path in registry 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Drops startup file 2 IoCs
- Executes dropped EXE 38 IoCs
- Loads dropped DLL 4 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Uses the VBS compiler for execution 1 TTPs
- Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 10 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 8 IoCs
- SmartAssembly .NET packer 4 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 9 IoCs
- UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 9 IoCs
- Drops file in Windows directory 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 36 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 50 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Modifies data under HKEY_USERS 5 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\37d8e1ce3b6e6488942717aa78cb54785edc985143bcc8d9ba9f42d73a3dbd7a.exe"C:\Users\Admin\AppData\Local\Temp\37d8e1ce3b6e6488942717aa78cb54785edc985143bcc8d9ba9f42d73a3dbd7a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\healastounding.exe"C:\Users\Admin\AppData\Roaming\healastounding.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\test.exe"C:\Users\Admin\AppData\Roaming\test.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\gay.exe"C:\Users\Admin\AppData\Roaming\gay.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\mediaget.exe"C:\Users\Admin\AppData\Roaming\mediaget.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\mediaget.exe" "mediaget.exe" ENABLE5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Roaming\Opus.exe"C:\Users\Admin\AppData\Roaming\Opus.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "LAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9BB3.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "LAN Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAC00.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\aaa.exe"C:\Users\Admin\AppData\Roaming\aaa.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\aaa.exe"C:\Users\Admin\AppData\Roaming\aaa.exe"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240645796.bat" "C:\Users\Admin\AppData\Roaming\aaa.exe" "5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe"C:\Users\Admin\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\FFDvbcrdfqs.exe"C:\Users\Admin\AppData\Local\Temp\FFDvbcrdfqs.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\FFDvbcrdfqs.exe"C:\Users\Admin\AppData\Local\Temp\FFDvbcrdfqs.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Dcvxaamev.exe"C:\Users\Admin\AppData\Local\Temp\Dcvxaamev.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Dcvxaamev.exe"C:\Users\Admin\AppData\Local\Temp\Dcvxaamev.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 13726⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe"C:\Users\Admin\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\4.exe"C:\Users\Admin\AppData\Roaming\4.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\3.exe"C:\Users\Admin\AppData\Roaming\3.exe"4⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\6eb8e248df559290f6d7924f088a79\conhost.exe"C:\6eb8e248df559290f6d7924f088a79\conhost.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Roaming\a.exe"C:\Users\Admin\AppData\Roaming\a.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Pluto Panel.exe"C:\Users\Admin\AppData\Roaming\Pluto Panel.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\22.exe"C:\Users\Admin\AppData\Roaming\22.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Block3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filterlist name=Filter13⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=FilteraAtion1 action=block3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion13⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Block assign=y3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del "C:\Users\Admin\AppData\Roaming\22.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\___11.19.exe"C:\Users\Admin\AppData\Roaming\___11.19.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe3⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\HD____11.19.exeC:\Users\Admin\AppData\Roaming\HD____11.19.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Program Files (x86)\LAN Service\lansv.exe1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240622609.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\bc37b954b382a741a460471932\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\bc37b954b382a741a460471932\dllhost.exe"1⤵
-
C:\bc37b954b382a741a460471932\dllhost.exeC:\bc37b954b382a741a460471932\dllhost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\6eb8e248df559290f6d7924f088a79\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\6eb8e248df559290f6d7924f088a79\conhost.exe"1⤵
-
C:\6eb8e248df559290f6d7924f088a79\conhost.exeC:\6eb8e248df559290f6d7924f088a79\conhost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe1⤵
-
C:\Users\Admin\AppData\Roaming\WindowsUpdate.exeC:\Users\Admin\AppData\Roaming\WindowsUpdate.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\LAN Service\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\LAN Service\unsecapp.exe"1⤵
-
C:\Program Files (x86)\LAN Service\unsecapp.exe"C:\Program Files (x86)\LAN Service\unsecapp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\DigitalLocker\en-US\sppsvc.exe"1⤵
-
C:\Windows\DigitalLocker\en-US\sppsvc.exeC:\Windows\DigitalLocker\en-US\sppsvc.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\System32\wbem\esscli\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\esscli\unsecapp.exe"1⤵
-
C:\Windows\System32\wbem\esscli\unsecapp.exeC:\Windows\System32\wbem\esscli\unsecapp.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "aaa" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\SelectUse\aaa.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\SelectUse\aaa.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\SelectUse\aaa.exeC:\Users\Admin\AppData\Roaming\SelectUse\aaa.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\mediaget.exe" ..1⤵
-
C:\Users\Admin\AppData\Roaming\mediaget.exeC:\Users\Admin\AppData\Roaming\mediaget.exe ..2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1104 -ip 11041⤵
-
C:\Windows\Help\Winlogon.exeC:\Windows\Help\Winlogon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Cursors\WUDFhosts.exeC:\Windows\Cursors\WUDFhosts.exe -o pool.usa-138.com:80 -u 4B7yFmYw2qvEtWZDDnZVeY16HHpwTtuYBg6EMn5xdDbM3ggSEnQFDWDHH6cqdEYaPx4iQvAwLNu8NLc21QxDU84GGxZEY7S -p x3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 4802⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 5292 -ip 52921⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
4Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
kaosdma.txt
aaa.exe.log
Dcvxaamev.exe
FFDvbcrdfqs.exe
svchos.exe
svchost.exe
tmp9BB3.tmp
tmpAC00.tmp
0fd7de5367376231a788872005d7ed4f.exe
22.exe
3.exe
4.exe
8f1c8b40c7be588389a8d382040b23bb.exe
HD____11.19.exe
Opus.exe
Pluto Panel.exe
___11.19.exe
a.exe
aaa.exe
gay.exe
healastounding.exe
test.exe
240622609.txt
memory/232-488-0x0000000000400000-0x0000000000491000-memory.dmp
memory/232-422-0x0000000000400000-0x0000000000491000-memory.dmp
memory/232-343-0x0000000000400000-0x0000000000495000-memory.dmp
memory/232-345-0x0000000000400000-0x0000000000495000-memory.dmp
memory/1104-395-0x0000000000400000-0x0000000000438000-memory.dmp
memory/1104-410-0x0000000000400000-0x0000000000438000-memory.dmp
memory/1104-411-0x0000000000400000-0x0000000000434000-memory.dmp
memory/1104-396-0x0000000000400000-0x0000000000438000-memory.dmp
memory/1192-420-0x0000000010000000-0x0000000010103000-memory.dmp
memory/1192-415-0x0000000010000000-0x0000000010103000-memory.dmp
memory/1192-416-0x0000000010000000-0x0000000010103000-memory.dmp
memory/1192-419-0x0000000010000000-0x0000000010103000-memory.dmp
memory/1192-414-0x0000000010000000-0x0000000010103000-memory.dmp
memory/1192-417-0x0000000010000000-0x0000000010103000-memory.dmp
memory/1192-413-0x0000000010000000-0x0000000010103000-memory.dmp
memory/1192-454-0x0000000010000000-0x0000000010103000-memory.dmp
memory/1192-461-0x0000000010000000-0x0000000010103000-memory.dmp
memory/1192-421-0x0000000010000000-0x0000000010103000-memory.dmp
memory/2020-294-0x0000000075010000-0x00000000755C1000-memory.dmp
memory/2020-45-0x0000000075010000-0x00000000755C1000-memory.dmp
memory/2544-431-0x0000000000400000-0x0000000000458000-memory.dmp
memory/2544-426-0x0000000000400000-0x0000000000458000-memory.dmp
memory/2544-425-0x0000000000400000-0x0000000000458000-memory.dmp
memory/2708-388-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2708-385-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2708-383-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2708-387-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2716-393-0x0000000000400000-0x000000000041D000-memory.dmp
memory/2716-394-0x0000000000400000-0x000000000041D000-memory.dmp
memory/2716-390-0x0000000000400000-0x000000000041D000-memory.dmp
memory/2976-185-0x0000000000400000-0x000000000044F000-memory.dmp
memory/2976-187-0x0000000000400000-0x000000000044F000-memory.dmp
memory/2976-321-0x0000000000400000-0x000000000044F000-memory.dmp
memory/3252-144-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3252-141-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3252-143-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3256-48-0x0000000000400000-0x0000000000625000-memory.dmp
memory/3296-368-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3296-365-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3296-364-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4340-173-0x0000000000400000-0x00000000007C2000-memory.dmp
memory/4340-163-0x0000000000400000-0x00000000007C2000-memory.dmp
memory/4340-197-0x0000000005D70000-0x0000000006388000-memory.dmp
memory/4340-200-0x0000000006450000-0x000000000655A000-memory.dmp
memory/4340-220-0x00000000065E0000-0x000000000662C000-memory.dmp
memory/4340-218-0x0000000006560000-0x000000000659C000-memory.dmp
memory/4340-199-0x0000000006430000-0x0000000006442000-memory.dmp
memory/4340-172-0x0000000000400000-0x00000000007C2000-memory.dmp
memory/4420-99-0x00000000003E0000-0x00000000003F2000-memory.dmp
memory/4548-165-0x0000000002660000-0x0000000002760000-memory.dmp
memory/4896-121-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/4896-102-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/4896-120-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/5104-295-0x00000000061A0000-0x0000000006562000-memory.dmp
memory/5104-297-0x00000000061A0000-0x0000000006562000-memory.dmp
memory/5104-312-0x00000000061A0000-0x0000000006562000-memory.dmp
memory/5104-306-0x00000000061A0000-0x0000000006562000-memory.dmp
memory/5104-378-0x0000000000400000-0x00000000019AA000-memory.dmp
memory/5104-303-0x00000000061A0000-0x0000000006562000-memory.dmp
memory/5104-247-0x0000000000400000-0x00000000019AA000-memory.dmp
memory/5104-317-0x00000000061A0000-0x0000000006562000-memory.dmp
memory/5104-300-0x00000000061A0000-0x0000000006562000-memory.dmp
memory/5104-314-0x00000000061A0000-0x0000000006562000-memory.dmp
memory/5160-478-0x00007FF670550000-0x00007FF670AD0000-memory.dmp
memory/5160-504-0x00007FF670550000-0x00007FF670AD0000-memory.dmp
memory/5160-457-0x00007FF670550000-0x00007FF670AD0000-memory.dmp
memory/5160-456-0x00007FF670550000-0x00007FF670AD0000-memory.dmp
memory/5160-489-0x00007FF670550000-0x00007FF670AD0000-memory.dmp
memory/5160-493-0x00007FF670550000-0x00007FF670AD0000-memory.dmp
memory/5160-474-0x00007FF670550000-0x00007FF670AD0000-memory.dmp
memory/5160-463-0x00007FF670550000-0x00007FF670AD0000-memory.dmp
memory/5160-423-0x00007FF670550000-0x00007FF670AD0000-memory.dmp
memory/5160-424-0x000001B748C40000-0x000001B748C50000-memory.dmp
memory/5472-38-0x0000000075010000-0x00000000755C1000-memory.dmp
memory/5472-164-0x0000000075010000-0x00000000755C1000-memory.dmp
memory/5472-41-0x0000000075010000-0x00000000755C1000-memory.dmp
memory/5596-223-0x0000000000480000-0x0000000000514000-memory.dmp
memory/5596-244-0x0000000000E70000-0x0000000000E7C000-memory.dmp
memory/5596-236-0x0000000000E60000-0x0000000000E6C000-memory.dmp
memory/5596-234-0x0000000000C40000-0x0000000000C4A000-memory.dmp
memory/5596-233-0x0000000000C30000-0x0000000000C3C000-memory.dmp
memory/5668-170-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/5668-176-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/5668-201-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/5668-198-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/5668-169-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/5668-168-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/6020-71-0x0000000075010000-0x00000000755C1000-memory.dmp
memory/6020-0-0x0000000075011000-0x0000000075012000-memory.dmp
memory/6020-1-0x0000000075010000-0x00000000755C1000-memory.dmp