0b3a483bcce3e09fd52c015488fc14cb85ae61f1cf63ff2647ca5d65125f377c

Analysis

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 12.8MB
Sample260415-j3aaescv31
SHA256 0b3a483bcce3e09fd52c015488fc14cb85ae61f1cf63ff2647ca5d65125f377c
MD5 de23460d2f26ceb38423bce05a2066fe
SHA1 eec89c91e824e06165f113427e6323c43a1129c7
SHA512 1ac243c67b37e16f1b6c20d229d4f8cd3e88b5aad4a59ebd90570ef4833cbcf8203e8a42cdad4f3da4c65cdc25653efa5ada3b333a3d0cf2abc4176b66717bcb
SSDEEP 196608:CPI/bIL5ToIhVb9f1ElhTLCaf5Wcr+SWxM+yedHJJJD7pKHvY54AqAVWyJFJXut6:ZkdpLEHyer+SuMtYHJJFQv0duMS0UOwa
TLSH
T144D63315B483C371E3A5C0706577A175CA36BE7B96A60096781C73A6FF7B200BEE02D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with 9Rays.Net Spices.Net Obfuscator. 7 IoCs

resource	yara_rule
behavioral2/memory/1556-1-0x0000000007F70000-0x0000000008CD0000-memory.dmp	INDICATOR_EXE_Packed_Spices
behavioral2/memory/1556-4-0x0000000008CD0000-0x0000000009A2E000-memory.dmp	INDICATOR_EXE_Packed_Spices
behavioral2/memory/3424-124-0x0000000004A40000-0x0000000004A72000-memory.dmp	INDICATOR_EXE_Packed_Spices
behavioral2/memory/3424-125-0x0000000005080000-0x00000000050B2000-memory.dmp	INDICATOR_EXE_Packed_Spices
behavioral2/files/0x00050000000272d5-185.dat	INDICATOR_EXE_Packed_Spices
behavioral2/memory/5356-210-0x000000001C5E0000-0x000000001C62A000-memory.dmp	INDICATOR_EXE_Packed_Spices
behavioral2/memory/5356-211-0x000000001BBB0000-0x000000001BBC6000-memory.dmp	INDICATOR_EXE_Packed_Spices

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2328	Powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\App.ico.lnk	SecurityServiceHub.exe

Executes dropped EXE 7 IoCs

pid	Process
2568	ServiceHubSecuritySystemServiceHub.dll
3424	SecurityServiceHub.exe
1684	MicrosoftEnvelope.exe
2116	MicrosoftResourceManagementresources.dll
5356	MicrosoftMsmqRuntimeInterop.exe
4144	SecurityServiceHub.exe
4612	SecurityServiceHub.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	MicrosoftEnvelope.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	MicrosoftEnvelope.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	checkip.dyndns.org

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	MicrosoftEnvelope.exe
File created	C:\Windows\assembly\Desktop.ini	MicrosoftEnvelope.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	MicrosoftEnvelope.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityServiceHub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEnvelope.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityServiceHub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHubSecuritySystemServiceHub.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityServiceHub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftResourceManagementresources.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4204	WMIC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1072	schtasks.exe
6036	schtasks.exe
5636	schtasks.exe
1020	schtasks.exe
2980	schtasks.exe
5932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2328	Powershell.exe
2328	Powershell.exe
3424	SecurityServiceHub.exe
3424	SecurityServiceHub.exe
3424	SecurityServiceHub.exe
3424	SecurityServiceHub.exe
3424	SecurityServiceHub.exe
3424	SecurityServiceHub.exe
3424	SecurityServiceHub.exe
3424	SecurityServiceHub.exe
4144	SecurityServiceHub.exe
4144	SecurityServiceHub.exe
4144	SecurityServiceHub.exe
4144	SecurityServiceHub.exe
4144	SecurityServiceHub.exe
4144	SecurityServiceHub.exe
4144	SecurityServiceHub.exe
4612	SecurityServiceHub.exe
4612	SecurityServiceHub.exe
4612	SecurityServiceHub.exe
4612	SecurityServiceHub.exe
4612	SecurityServiceHub.exe
4612	SecurityServiceHub.exe
4612	SecurityServiceHub.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	Powershell.exe
Token: SeIncreaseQuotaPrivilege	4092	WMIC.exe
Token: SeSecurityPrivilege	4092	WMIC.exe
Token: SeTakeOwnershipPrivilege	4092	WMIC.exe
Token: SeLoadDriverPrivilege	4092	WMIC.exe
Token: SeSystemProfilePrivilege	4092	WMIC.exe
Token: SeSystemtimePrivilege	4092	WMIC.exe
Token: SeProfSingleProcessPrivilege	4092	WMIC.exe
Token: SeIncBasePriorityPrivilege	4092	WMIC.exe
Token: SeCreatePagefilePrivilege	4092	WMIC.exe
Token: SeBackupPrivilege	4092	WMIC.exe
Token: SeRestorePrivilege	4092	WMIC.exe
Token: SeShutdownPrivilege	4092	WMIC.exe
Token: SeDebugPrivilege	4092	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4092	WMIC.exe
Token: SeRemoteShutdownPrivilege	4092	WMIC.exe
Token: SeUndockPrivilege	4092	WMIC.exe
Token: SeManageVolumePrivilege	4092	WMIC.exe
Token: 33	4092	WMIC.exe
Token: 34	4092	WMIC.exe
Token: 35	4092	WMIC.exe
Token: 36	4092	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4092	WMIC.exe
Token: SeSecurityPrivilege	4092	WMIC.exe
Token: SeTakeOwnershipPrivilege	4092	WMIC.exe
Token: SeLoadDriverPrivilege	4092	WMIC.exe
Token: SeSystemProfilePrivilege	4092	WMIC.exe
Token: SeSystemtimePrivilege	4092	WMIC.exe
Token: SeProfSingleProcessPrivilege	4092	WMIC.exe
Token: SeIncBasePriorityPrivilege	4092	WMIC.exe
Token: SeCreatePagefilePrivilege	4092	WMIC.exe
Token: SeBackupPrivilege	4092	WMIC.exe
Token: SeRestorePrivilege	4092	WMIC.exe
Token: SeShutdownPrivilege	4092	WMIC.exe
Token: SeDebugPrivilege	4092	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4092	WMIC.exe
Token: SeRemoteShutdownPrivilege	4092	WMIC.exe
Token: SeUndockPrivilege	4092	WMIC.exe
Token: SeManageVolumePrivilege	4092	WMIC.exe
Token: 33	4092	WMIC.exe
Token: 34	4092	WMIC.exe
Token: 35	4092	WMIC.exe
Token: 36	4092	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1648	WMIC.exe
Token: SeSecurityPrivilege	1648	WMIC.exe
Token: SeTakeOwnershipPrivilege	1648	WMIC.exe
Token: SeLoadDriverPrivilege	1648	WMIC.exe
Token: SeSystemProfilePrivilege	1648	WMIC.exe
Token: SeSystemtimePrivilege	1648	WMIC.exe
Token: SeProfSingleProcessPrivilege	1648	WMIC.exe
Token: SeIncBasePriorityPrivilege	1648	WMIC.exe
Token: SeCreatePagefilePrivilege	1648	WMIC.exe
Token: SeBackupPrivilege	1648	WMIC.exe
Token: SeRestorePrivilege	1648	WMIC.exe
Token: SeShutdownPrivilege	1648	WMIC.exe
Token: SeDebugPrivilege	1648	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1648	WMIC.exe
Token: SeRemoteShutdownPrivilege	1648	WMIC.exe
Token: SeUndockPrivilege	1648	WMIC.exe
Token: SeManageVolumePrivilege	1648	WMIC.exe
Token: 33	1648	WMIC.exe
Token: 34	1648	WMIC.exe
Token: 35	1648	WMIC.exe
Token: 36	1648	WMIC.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2328	1556	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	79
PID 1556 wrote to memory of 2568	1556	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	81
PID 1556 wrote to memory of 6036	1556	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	82
PID 1556 wrote to memory of 5636	1556	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	86
PID 1556 wrote to memory of 1020	1556	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	88
PID 3424 wrote to memory of 2152	3424	SecurityServiceHub.exe	90
PID 2152 wrote to memory of 4092	2152	cmd.exe	92
PID 1556 wrote to memory of 1636	1556	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	95
PID 1636 wrote to memory of 1648	1636	cmd.exe	97
PID 1684 wrote to memory of 2980	1684	MicrosoftEnvelope.exe	99
PID 1556 wrote to memory of 5148	1556	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	102
PID 5148 wrote to memory of 5680	5148	cmd.exe	104
PID 1684 wrote to memory of 5932	1684	MicrosoftEnvelope.exe	105
PID 1556 wrote to memory of 3300	1556	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	107
PID 3300 wrote to memory of 1776	3300	cmd.exe	109
PID 3424 wrote to memory of 2984	3424	SecurityServiceHub.exe	110
PID 2984 wrote to memory of 2124	2984	cmd.exe	112
PID 1556 wrote to memory of 2112	1556	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	113
PID 2112 wrote to memory of 4204	2112	cmd.exe	115
PID 1556 wrote to memory of 5548	1556	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	116
PID 5548 wrote to memory of 6076	5548	cmd.exe	118
PID 3424 wrote to memory of 344	3424	SecurityServiceHub.exe	119
PID 344 wrote to memory of 5676	344	cmd.exe	121
PID 1684 wrote to memory of 2116	1684	MicrosoftEnvelope.exe	122
PID 1684 wrote to memory of 5356	1684	MicrosoftEnvelope.exe	123
PID 5356 wrote to memory of 1072	5356	MicrosoftMsmqRuntimeInterop.exe	124
PID 4144 wrote to memory of 4132	4144	SecurityServiceHub.exe	127
PID 4132 wrote to memory of 4796	4132	cmd.exe	129
PID 4144 wrote to memory of 5668	4144	SecurityServiceHub.exe	130
PID 5668 wrote to memory of 5060	5668	cmd.exe	132
PID 4144 wrote to memory of 3308	4144	SecurityServiceHub.exe	133
PID 3308 wrote to memory of 5268	3308	cmd.exe	135
PID 4612 wrote to memory of 488	4612	SecurityServiceHub.exe	137
PID 488 wrote to memory of 5772	488	cmd.exe	139
PID 4612 wrote to memory of 2384	4612	SecurityServiceHub.exe	140
PID 2384 wrote to memory of 996	2384	cmd.exe	142
PID 4612 wrote to memory of 1036	4612	SecurityServiceHub.exe	143
PID 1036 wrote to memory of 3688	1036	cmd.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  Powershell -executionpolicy bypass -NonInteractive -windowstyle Hidden -file C:\Users\Admin\AppData\Local\Temp\tmp2EAC.tmp.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2328
- C:\Users\Admin\AppData\Local\ServiceHubSecuritySystemServiceHub.dll
  C:\Users\Admin\AppData\Local\ServiceHubSecuritySystemServiceHub.dll -p123
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2568
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /f /tn SecurityServiceHub /tr "C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:6036
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc onstart minute /mo 30 /f /tn MicrosoftOneDriveStandalone /tr "C:\Users\Admin\AppData\Roaming\windows\SecurityCryptography.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5636
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 7 /f /tn SecurityHealthEnvelope /tr "C:\Users\Admin\AppData\Local\windows\MicrosoftEnvelope.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic path win32_computersystemproduct get uuid /value
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid /value
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c Wmic os get Caption /value
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    Wmic os get Caption /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5680
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic path win32_VideoController get name /value
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name /value
    3⤵
    - System Location Discovery: System Language Discovery
    - Detects videocard installed
    PID:4204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic computersystem get totalphysicalmemory
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic computersystem get totalphysicalmemory
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6076

C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe
C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe
1⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c wmic process where ExecutablePath='%HomeDrive%\\Users\\%username%\\AppData\\Roaming\\system32\\svchost.exe' Get ProcessID
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where ExecutablePath='C:\\Users\\Admin\\AppData\\Roaming\\system32\\svchost.exe' Get ProcessID
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic path win32_computersystemproduct get uuid /value
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:344
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5676

C:\Users\Admin\AppData\Local\windows\MicrosoftEnvelope.exe
C:\Users\Admin\AppData\Local\windows\MicrosoftEnvelope.exe
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 7 /f /tn MicrosoftEdgeScriptRuntime /tr "C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftMsmqRuntimeInterop.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2980
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 7 /f /tn MicrosoftEnvelope /tr "C:\Users\Admin\AppData\Local\windows\MicrosoftEnvelope.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5932
- C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftResourceManagementresources.dll
  C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftResourceManagementresources.dll -pHelloAnalayser:)
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2116
- C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftMsmqRuntimeInterop.exe
  "C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftMsmqRuntimeInterop.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 7 /f /tn MicrosoftInkResources /tr "C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftMsmqRuntimeInterop.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1072

C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe
C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c wmic process where ExecutablePath='%HomeDrive%\\Users\\%username%\\AppData\\Roaming\\system32\\svchost.exe' Get ProcessID
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where ExecutablePath='C:\\Users\\Admin\\AppData\\Roaming\\system32\\svchost.exe' Get ProcessID
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic path win32_computersystemproduct get uuid /value
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5668
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5268

C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe
C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c wmic process where ExecutablePath='%HomeDrive%\\Users\\%username%\\AppData\\Roaming\\system32\\svchost.exe' Get ProcessID
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:488
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where ExecutablePath='C:\\Users\\Admin\\AppData\\Roaming\\system32\\svchost.exe' Get ProcessID
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic path win32_computersystemproduct get uuid /value
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftMsmqRuntimeInterop.exe

Path C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftMsmqRuntimeInterop.exe
Size 487KB
SHA256 f46f121e1a096b5e0f2c5602b1de590ae226e5d45ee9b97ce7d13efd35894aa2
MD5 995109a0b9489beaeee02a58e2bac292
SHA1 8ff7ec2dc0a4aa31452719406e293cf951e124a0
SHA512 06791ed9af044763d3d371543341395aa214fc3010414ecc2fbb29ce7cdaa55c01e3f2a3f251772817d9811c469551c9dfe9c4171a0057f2f12625299eee724c
SSDEEP 6144:qXo/gpghIYqbRJavZ3kHzHMGX1cG4nJiiYzXE6UofdFpho8r1I9WcYneeWyZKVVB:qYi1TJc0HzwnJHyaQd/erNVth
TLSH
T1E5B4E0433AA88B05D5642AF6C0EF683413D5AEC32673E6997F18379D0E427A3DD44B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftResourceManagementresources.dll

Path C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftResourceManagementresources.dll
Size 809KB
SHA256 e73a182865f9f1c4c37f87a8f6bfafc19b36d3d750b953ea99f00367e3284f7e
MD5 ae12d02b39095e5b2986811c0e2d0051
SHA1 9382cd9988b2f0d41807e627d02832384c690031
SHA512 e1cd18a761b1bcaafc868cc2cb325484aec134bcfe077cdef15e26717bbf30c698a8142ab1211df821b005e7c2c7c6993106122f7a37200c7b00615b8176864b
SSDEEP 24576:DhvJVJdMxSA4ekw6G4WcqXgieabBCz8edTWSS:r3dWQeX9jwieayoSS
TLSH
T173050202BFD55472E6B21D3656256B20293D79201F38CF9FA3D44E6DEA305D1EA30BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityServiceHub.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecurityServiceHub.exe.log
Size 1KB
SHA256 0a086928e251853520b6e63c81111de641c94d9f2f7935791fbe842d6e84cedd
MD5 870df74976c7f7482633fc615a41df85
SHA1 0e3b4fb8e647016cee3913236fa7f09114bbb406
SHA512 b5cee5810b2023063ed0a1a458b1794bb9293de8d043070d4ce184c5fcc4fadf5330787d80d6a0786be82aea951558689a8bebe5939cbcdc427773af37504d67
TLSH
T1363157303122B5D80D422F560C186EC962EF4749BBB8DF5CBA65335DCE2A44BDB221E3
MD5 SHA1 SHA512 TLSH

Submit Download

ServiceHubSecuritySystemServiceHub.dll

Path C:\Users\Admin\AppData\Local\ServiceHubSecuritySystemServiceHub.dll
Size 870KB
SHA256 6c94c696e4c4151f373569e845b4a9e903885d152fe049b2fcf76f3b5d004f98
MD5 013d9d0c437daf1267fd0c4302493840
SHA1 290e7c13cd54a37d3bcbd43182fc14ce0b1b992c
SHA512 de3f16ab2912a170b34024c3d9aec73c1d70bc1992cb77f36d6634c92e36d90bd04b08c412a0021a47dc1884eacbc63a43abfc9e77e5b7c5382531f8dbe50a23
SSDEEP 24576:+ry2uXzm/RYpXVFFta79uaVn9YKMT6am21hxytZZpKYp0W:+unJpXVFy59G3milYp5
TLSH
T1E615F1F0AEE078B0E131243574A8E63C3BEA7C199F2489ABD78AE51D35704C125B6F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityServiceHub.exe

Path C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe
Size 204KB
SHA256 ef498b88f3255c046d0f55ee571bc7f2c03453981d284ff3d3434e273f7da8dd
MD5 869b9c6da662c33ef98d4c02de240eaf
SHA1 bba51e44bc33c27a5224fd1881f486dd81836e97
SHA512 4e21088e5d83677c20a90779fcff3fab236ab7b25a8f18f6a2b764e9f3a556e8150889c6ce32e7c6ad753e82cf0d2796b3ce0d35141d39092580ff3766b071c6
SSDEEP 3072:lDKW1LgppLRHMY0TBfJvjcTp5XewaCxuHcKWVQCIp38YxZOc3:lDKW1Lgbdl0TBBvjc/eTF8HVwrj
TLSH
T17314BF1171C1C1B3C4B7153044E6CB799A7A70724B7A96D7B7D81BBA6E203E1A3362CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_nrkkj2k1.ucd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nrkkj2k1.ucd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp2EAC.tmp.ps1

Path C:\Users\Admin\AppData\Local\Temp\tmp2EAC.tmp.ps1
Size 117B
SHA256 c42eb405a28d493899ebd7574011b45f121ab0da8d6ca96b379f9f3199b0b566
MD5 b1481c7cefa4a7063d453f726e3b3658
SHA1 6c151e7a968c80b5969c3fe75c9caaa52cfee007
SHA512 a84e371cbc1494cd65aea6321f54d2861780f2f8004c217c15d096994ab12ecd5d3bb2a57997d60b1b0e2363859f03ae1ec7d0aeda200bd6b18810174c970d24
TLSH
T1CCB09B31910201D5E231375194154759307FE529455D09010539181C5010DA9637AE36
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEnvelope.exe

Path C:\Users\Admin\AppData\Local\windows\MicrosoftEnvelope.exe
Size 975KB
SHA256 ef7c84296697650bf4290c686b81a33272bd319fc8a5e18df35d3a1844539f28
MD5 c64f650c58af5481c0eab30ba3a77002
SHA1 664064b8a1c90b5399238d9793434a5271343471
SHA512 ed5d71398579a639e69ae647e137661e1c18b882c49ac4ac0555a8d8bb3975d57a94def49d0c9efc0951ac716b1d3857991d70f07539823e1eaad7177cde9834
SSDEEP 24576:vwnU4TDL0PMEDefkBhI204srFNO/3GsXsiumpstOwS7:4ntTX0PPDYkBS2toI8iumGs
TLSH
T11525222274C1C2B3C47B957081D58A386D353462876A96C7B66D2BAB7F113E1E3372CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1556-139-0x000000000F610000-0x000000000F631000-memory.dmp

Download

memory/1556-136-0x000000000F140000-0x000000000F497000-memory.dmp

Download

memory/1556-10-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/1556-8-0x0000000007C10000-0x0000000007C1A000-memory.dmp

Download

memory/1556-53-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/1556-7-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/1556-1-0x0000000007F70000-0x0000000008CD0000-memory.dmp

Download

memory/1556-6-0x0000000007A00000-0x0000000007A92000-memory.dmp

Download

memory/1556-48-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/1556-138-0x000000000F5D0000-0x000000000F60C000-memory.dmp

Download

memory/1556-5-0x0000000007940000-0x00000000079DC000-memory.dmp

Download

memory/1556-137-0x000000000F540000-0x000000000F58C000-memory.dmp

Download

memory/1556-0-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/1556-9-0x0000000007C20000-0x0000000007C76000-memory.dmp

Download

memory/1556-4-0x0000000008CD0000-0x0000000009A2E000-memory.dmp

Download

memory/1556-134-0x0000000009A30000-0x000000000A032000-memory.dmp

Download

memory/1556-133-0x0000000004AC0000-0x0000000004B0A000-memory.dmp

Download

memory/1556-3-0x0000000007210000-0x00000000077B6000-memory.dmp

Download

memory/1556-35-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/1556-127-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/1556-32-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/1556-2-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/1556-121-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/1684-188-0x0000000002870000-0x0000000002E72000-memory.dmp

Download

memory/2116-184-0x0000000003490000-0x0000000003A92000-memory.dmp

Download

memory/2328-26-0x00000000063C0000-0x00000000063DE000-memory.dmp

Download

memory/2328-25-0x0000000005EB0000-0x0000000006207000-memory.dmp

Download

memory/2328-47-0x0000000007A40000-0x0000000007A51000-memory.dmp

Download

memory/2328-45-0x00000000078B0000-0x00000000078BA000-memory.dmp

Download

memory/2328-49-0x0000000007A70000-0x0000000007A7E000-memory.dmp

Download

memory/2328-50-0x0000000007A80000-0x0000000007A95000-memory.dmp

Download

memory/2328-51-0x0000000007B70000-0x0000000007B8A000-memory.dmp

Download

memory/2328-52-0x0000000007AB0000-0x0000000007AB8000-memory.dmp

Download

memory/2328-44-0x0000000007830000-0x000000000784A000-memory.dmp

Download

memory/2328-56-0x0000000004D20000-0x0000000004D35000-memory.dmp

Download

memory/2328-59-0x0000000006680000-0x0000000006702000-memory.dmp

Download

memory/2328-58-0x0000000004DE0000-0x0000000004E17000-memory.dmp

Download

memory/2328-57-0x0000000005660000-0x0000000005C62000-memory.dmp

Download

memory/2328-43-0x0000000007E80000-0x00000000084FA000-memory.dmp

Download

memory/2328-12-0x0000000002540000-0x0000000002576000-memory.dmp

Download

memory/2328-42-0x00000000074E0000-0x0000000007584000-memory.dmp

Download

memory/2328-41-0x0000000007430000-0x000000000744E000-memory.dmp

Download

memory/2328-13-0x0000000002620000-0x0000000002630000-memory.dmp

Download

memory/2328-14-0x0000000002620000-0x0000000002630000-memory.dmp

Download

memory/2328-33-0x0000000002620000-0x0000000002630000-memory.dmp

Download

memory/2328-31-0x000000006FD20000-0x000000006FD6C000-memory.dmp

Download

memory/2328-30-0x00000000073D0000-0x0000000007404000-memory.dmp

Download

memory/2328-29-0x000000007F170000-0x000000007F180000-memory.dmp

Download

memory/2328-15-0x0000000005030000-0x000000000565A000-memory.dmp

Download

memory/2328-27-0x0000000006400000-0x000000000644C000-memory.dmp

Download

memory/2328-46-0x0000000007AD0000-0x0000000007B66000-memory.dmp

Download

memory/2328-18-0x0000000004EC0000-0x0000000004F26000-memory.dmp

Download

memory/2328-17-0x0000000004E50000-0x0000000004EB6000-memory.dmp

Download

memory/2328-16-0x0000000004DB0000-0x0000000004DD2000-memory.dmp

Download

memory/2568-120-0x0000000003190000-0x0000000003792000-memory.dmp

Download

memory/3424-125-0x0000000005080000-0x00000000050B2000-memory.dmp

Download

memory/3424-124-0x0000000004A40000-0x0000000004A72000-memory.dmp

Download

memory/3424-193-0x00000000022B0000-0x00000000022FA000-memory.dmp

Download

memory/3424-194-0x0000000005220000-0x0000000005822000-memory.dmp

Download

memory/3424-200-0x00000000022B0000-0x00000000022FA000-memory.dmp

Download

memory/3424-201-0x0000000005220000-0x0000000005822000-memory.dmp

Download

memory/3424-135-0x0000000009000000-0x0000000009018000-memory.dmp

Download

memory/4144-227-0x0000000005220000-0x0000000005822000-memory.dmp

Download

memory/4144-221-0x0000000005220000-0x0000000005822000-memory.dmp

Download

memory/4612-255-0x00000000051D0000-0x00000000057D2000-memory.dmp

Download

memory/4612-249-0x00000000051D0000-0x00000000057D2000-memory.dmp

Download

memory/5356-210-0x000000001C5E0000-0x000000001C62A000-memory.dmp

Download

memory/5356-216-0x000000001BBA0000-0x000000001BBAC000-memory.dmp

Download

memory/5356-217-0x000000001CF10000-0x000000001CFAC000-memory.dmp

Download

memory/5356-218-0x000000001C0A0000-0x000000001C0A8000-memory.dmp

Download

memory/5356-211-0x000000001BBB0000-0x000000001BBC6000-memory.dmp

Download

memory/5356-223-0x000000001C9D0000-0x000000001CA3F000-memory.dmp

Download

memory/5356-191-0x000000001C580000-0x000000001C5DE000-memory.dmp

Download

memory/5356-190-0x000000001DFD0000-0x000000001E49E000-memory.dmp

Download

memory/5356-189-0x000000001BD80000-0x000000001BE26000-memory.dmp

Download