5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/05/2026, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
Size 408KB
Sample260529-cnes2aa19s
SHA256 5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0
MD5 0a503c39cb05fa5a5266bf7f9a3a5eef
SHA1 bbc195fba8cc338eb4e9fc4921bfe0c959b96ca1
SHA512 8fb2d27b6778903e3b38c43e2b80cda28e16224b5f1db692d7fb70f4d40d32e06d534fbfbe79b07d6ddb6271c8a4d01ba1965e5c3582bc502b1c2662123477c8
SSDEEP 6144:xxpdItYQ1h879dxk2dN/nAeH4gnmXLOpY8Z2Td/5LF9/f2HJ5oXs:xGtJ1GDxk2dN/AePwTd/Lx2p5Os
TLSH
T1519423459ADDAB72F8D905FA2D62FA3D6F9DDC35AC1C1C24D2E522D90873100189CFAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery vmprotect

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3136 created 600	3136	Explorer.EXE	5
PID 4636 created 600	4636	HOSTNAME.EXE	5

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\p3VBqMq.sys	VaultCmd.exe
File opened for modification	C:\Windows\system32\drivers\gVzmgAxDYw6S.sys	VaultCmd.exe
File opened for modification	C:\Windows\system32\drivers\S5MMnwBxyG.nyj	VaultCmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe

Executes dropped EXE 2 IoCs

pid	Process
1108	PnPutil.exe
436	VaultCmd.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	436	VaultCmd.exe

VMProtect packed file 14 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/3036-0-0x00000000005C0000-0x00000000006C7000-memory.dmp	vmprotect
behavioral1/memory/3036-1-0x00000000005C0000-0x00000000006C7000-memory.dmp	vmprotect
behavioral1/memory/3036-8-0x00000000005C0000-0x00000000006C7000-memory.dmp	vmprotect
behavioral1/memory/3136-15-0x000000000B3E0000-0x000000000B675000-memory.dmp	vmprotect
behavioral1/memory/3136-16-0x000000000B3E0000-0x000000000B675000-memory.dmp	vmprotect
behavioral1/memory/3136-43-0x000000000B3E0000-0x000000000B675000-memory.dmp	vmprotect
behavioral1/memory/4636-100-0x00000297C8CB0000-0x00000297C8F45000-memory.dmp	vmprotect
behavioral1/memory/4636-96-0x00000297C8CB0000-0x00000297C8F45000-memory.dmp	vmprotect
behavioral1/memory/4636-94-0x00000297C8CB0000-0x00000297C8F45000-memory.dmp	vmprotect
behavioral1/memory/4636-130-0x00000297C8CB0000-0x00000297C8F45000-memory.dmp	vmprotect
behavioral1/memory/436-132-0x000001257CAC0000-0x000001257CDC6000-memory.dmp	vmprotect
behavioral1/memory/436-134-0x000001257CAC0000-0x000001257CDC6000-memory.dmp	vmprotect
behavioral1/files/0x000d000000024274-170.dat	vmprotect
behavioral1/memory/3036-277-0x00000000005C0000-0x00000000006C7000-memory.dmp	vmprotect

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	VaultCmd.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	VaultCmd.exe
File created	C:\Windows\system32\ \Windows\System32\dWI2bwIb.sys	VaultCmd.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	VaultCmd.exe
File opened for modification	C:\Windows\system32\joG6zN7aTV.sys	VaultCmd.exe
File opened for modification	C:\Windows\system32\oAb2OUcqEvIhL.ykt	VaultCmd.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D4E97.cat	VaultCmd.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D4F21.cat	VaultCmd.exe
File created	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\LmAaej.cat	VaultCmd.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D4E67.cat	VaultCmd.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D4F51.cat	VaultCmd.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D4FAE.cat	VaultCmd.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D4FDE.cat	VaultCmd.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D4F81.cat	VaultCmd.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	VaultCmd.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D4EF4.cat	VaultCmd.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\TJtjQ5rm8OcQxL.qab	VaultCmd.exe
File opened for modification	C:\Program Files\Windows Portable Devices\manifest.json	VaultCmd.exe
File opened for modification	C:\Program Files\Windows Portable Devices\lib\64747020.js	VaultCmd.exe
File opened for modification	C:\Program Files\Windows Portable Devices\39671b80.js	VaultCmd.exe
File opened for modification	C:\Program Files\Windows Portable Devices\47c0e260.html	VaultCmd.exe
File opened for modification	C:\Program Files\Windows Portable Devices\561aa940.js	VaultCmd.exe
File opened for modification	C:\Program Files\NIuOsjADLAIa2t.sys	VaultCmd.exe
File opened for modification	C:\Program Files\KJfHbCE8yvObFd.aat	VaultCmd.exe
File opened for modification	C:\Program Files (x86)\sdaRBjkFw7j.sys	VaultCmd.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Inf\VaultCmd.exe	HOSTNAME.EXE
File opened for modification	C:\Windows\Inf\VaultCmd.exe	HOSTNAME.EXE
File created	C:\Windows\CweG08Dt.sys	VaultCmd.exe
File opened for modification	C:\Windows\fNzjxhvrzqLF.sys	VaultCmd.exe
File opened for modification	C:\Windows\N8HZPu7DKIDq.pjj	VaultCmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	VaultCmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	VaultCmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	VaultCmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2168	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
924	taskkill.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PnPutil.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	VaultCmd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	PnPutil.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	PnPutil.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	VaultCmd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	VaultCmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	VaultCmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	VaultCmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PnPutil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PnPutil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	VaultCmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	VaultCmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PnPutil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PnPutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	VaultCmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	VaultCmd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	PnPutil.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
4636	HOSTNAME.EXE
4636	HOSTNAME.EXE
4636	HOSTNAME.EXE
4636	HOSTNAME.EXE
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe
436	VaultCmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3136	Explorer.EXE

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
Token: SeTcbPrivilege	3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
Token: SeDebugPrivilege	3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
Token: SeDebugPrivilege	3136	Explorer.EXE
Token: SeDebugPrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeDebugPrivilege	3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
Token: SeDebugPrivilege	4636	HOSTNAME.EXE
Token: SeDebugPrivilege	4636	HOSTNAME.EXE
Token: SeDebugPrivilege	436	VaultCmd.exe
Token: SeDebugPrivilege	436	VaultCmd.exe
Token: SeDebugPrivilege	436	VaultCmd.exe
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeDebugPrivilege	436	VaultCmd.exe
Token: SeDebugPrivilege	924	taskkill.exe
Token: SeDebugPrivilege	436	VaultCmd.exe
Token: SeBackupPrivilege	436	VaultCmd.exe
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3136	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3136	3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe	56
PID 3036 wrote to memory of 3136	3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe	56
PID 3036 wrote to memory of 3136	3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe	56
PID 3136 wrote to memory of 1108	3136	Explorer.EXE	102
PID 3136 wrote to memory of 1108	3136	Explorer.EXE	102
PID 3136 wrote to memory of 1108	3136	Explorer.EXE	102
PID 3136 wrote to memory of 1108	3136	Explorer.EXE	102
PID 3036 wrote to memory of 4636	3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe	106
PID 3036 wrote to memory of 4636	3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe	106
PID 3036 wrote to memory of 4636	3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe	106
PID 3036 wrote to memory of 4636	3036	5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe	106
PID 4636 wrote to memory of 436	4636	HOSTNAME.EXE	108
PID 4636 wrote to memory of 436	4636	HOSTNAME.EXE	108
PID 4636 wrote to memory of 436	4636	HOSTNAME.EXE	108
PID 4636 wrote to memory of 436	4636	HOSTNAME.EXE	108
PID 3136 wrote to memory of 2888	3136	Explorer.EXE
PID 3136 wrote to memory of 2664	3136	Explorer.EXE
PID 3136 wrote to memory of 2344	3136	Explorer.EXE
PID 436 wrote to memory of 924	436	VaultCmd.exe	115
PID 436 wrote to memory of 924	436	VaultCmd.exe	115
PID 436 wrote to memory of 924	436	VaultCmd.exe	115
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 436 wrote to memory of 3136	436	VaultCmd.exe	56
PID 3136 wrote to memory of 4256	3136	Explorer.EXE
PID 3136 wrote to memory of 2288	3136	Explorer.EXE
PID 3136 wrote to memory of 1616	3136	Explorer.EXE
PID 3136 wrote to memory of 1572	3136	Explorer.EXE
PID 3136 wrote to memory of 4928	3136	Explorer.EXE	105
PID 3136 wrote to memory of 1072	3136	Explorer.EXE
PID 3136 wrote to memory of 456	3136	Explorer.EXE
PID 3136 wrote to memory of 3952	3136	Explorer.EXE
PID 3136 wrote to memory of 4140	3136	Explorer.EXE
PID 3136 wrote to memory of 4960	3136	Explorer.EXE
PID 3136 wrote to memory of 4120	3136	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:600
- C:\ProgramData\PnPutil.exe
  "C:\ProgramData\PnPutil.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:1108
- C:\Windows\Inf\VaultCmd.exe
  "C:\Windows\Inf\VaultCmd.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Unexpected DNS network traffic destination
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:924

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Users\Admin\AppData\Local\Temp\5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
  "C:\Users\Admin\AppData\Local\Temp\5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\system32\HOSTNAME.EXE
    "C:\Windows\system32\HOSTNAME.EXE"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4636
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2260
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2168

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PnPutil.exe

Path C:\ProgramData\PnPutil.exe
Size 329KB
SHA256 490896a34dc2cd9b02ef4f568eac69cbf4c14ef085471ee43bb48336fa0b3736
MD5 b40cae42a6d16b7186ccacedc513997c
SHA1 dedb9598b11d9bdb69f92178effa9800679a1ae4
SHA512 1c0c7fd84a6c55515422805aee95bcf85a6e256071299d37c6cd7182823dd6eef8cc061a9521134a40815247e731e5c387844540ced3aa377f2fdc941ae4f517
SSDEEP 6144:a0EYwF2L4cI/c7wlKDtQoZDdTeTFUpMAj:aJxFJcUc74KDtQKDdCSqA
TLSH
T146643A1DE3F619E5E17BD27489B68501EA72B835170296DF2170C47C6F22FE0AA3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VaultCmd.exe

Path C:\Windows\INF\VaultCmd.exe
Size 30KB
SHA256 edc1b6a3e4fde216a323329e35f4192b0f49bc68285ee67036deff9e94c4e33a
MD5 5f69f4f8683151a59c5a11265b4a3c96
SHA1 95ae738ab6b2cc92d88e3debbaacdd924bc27f5e
SHA512 33fd26e122685c5d9e49930cf4c64237d157443ea43dd82423187c6b71e19539bc3c9582d567736bac3d8d27b604f32514f85eefa8e8a5e5b26b9f402b23bebf
SSDEEP 768:fs4TjbWSCdB16t4D+GJmiPioMNFzXn7Bv:fTjb7yPioWFzXn7Bv
TLSH
T156D2194AABA514D9E8B6473D89634719E572F921232057EF0BF0857E0F22BF0B438F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2B0D4E97.cat

Path C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0D4E97.cat
Size 5KB
SHA256 61112b5e4aedc68d291e4fd7441e077fc37e0a625abf1c1b012004663ca68b35
MD5 784bb97d4362cbec0a404dc60057edc4
SHA1 7e71f2fab0c54faf7ea185aabe13c02b2e42bd10
SHA512 22cfbd725430c38eef64ac6d61f451e029154e6d961f7a90f82c2ecf62505d79bca0c3807c695995ed6f673c5c5ba4aee09ca0ff686ea42eccb2cc28a849ab01
SSDEEP 96:XmIr5uPNC9L0WDIRIzwV0Di3s6TeDuHfw4pbTA/pvkrNXZCsnlTE+TVJoQrOg:WIrXL0UIRIzw3jtlAur9ZCspE+TMQrOg
TLSH
T10DB1F7D709082456ED8A1F91D5C2D27F9D347BDA2EC8A5A2507292992FC3BE0BB0D40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fNzjxhvrzqLF.sys

Path C:\Windows\fNzjxhvrzqLF.sys
Size 160KB
SHA256 cbe4cd5b07477d6256ec67ee9e865fa44c41df1852a95c9553752c053e74590e
MD5 0475cf35cbe497cbd8ac36b1a93fbf19
SHA1 5aba3f0499a3f58848a77f954511c3f4f110ef62
SHA512 6112efe87d28c55da9d7161d00de4fe23524a1ed550268808a95d5572f556968f9aed933a74ca44d8bf23598e0521ba834417ff52ff6a4700e978afb5f6c8455
SSDEEP 3072:dd122CU6LdPkK0XxHNqDB0oB5b+yyru+EvwF9L5aav5AcxO8FB9RypCFOzx:T122CUiPk1JKLJyHEoFJq8upxx
TLSH
T1CDF302634A9927C3D40B887B951A90D45CF4B117FE098C06D285BEB2780ADDF7E5D0BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-111-0x0000012579B40000-0x0000012579DA7000-memory.dmp

Download

memory/436-118-0x00007FFBD2350000-0x00007FFBD2360000-memory.dmp

Download

memory/436-117-0x0000012579B40000-0x0000012579DA7000-memory.dmp

Download

memory/436-134-0x000001257CAC0000-0x000001257CDC6000-memory.dmp

Download

memory/436-145-0x000001257D5D0000-0x000001257D7AB000-memory.dmp

Download

memory/436-109-0x0000012579B40000-0x0000012579DA7000-memory.dmp

Download

memory/436-139-0x000001257D5D0000-0x000001257D7AB000-memory.dmp

Download

memory/436-138-0x000001257D5D0000-0x000001257D7AB000-memory.dmp

Download

memory/436-124-0x00007FFBD2350000-0x00007FFBD2360000-memory.dmp

Download

memory/436-108-0x0000012579850000-0x0000012579853000-memory.dmp

Download

memory/436-132-0x000001257CAC0000-0x000001257CDC6000-memory.dmp

Download

memory/1108-45-0x0000029664000000-0x0000029664267000-memory.dmp

Download

memory/1108-27-0x0000029664000000-0x0000029664267000-memory.dmp

Download

memory/1108-38-0x00007FFBD2350000-0x00007FFBD2360000-memory.dmp

Download

memory/1108-37-0x0000029664000000-0x0000029664267000-memory.dmp

Download

memory/1108-29-0x0000029664000000-0x0000029664267000-memory.dmp

Download

memory/1108-40-0x0000029663E60000-0x0000029663E61000-memory.dmp

Download

memory/1108-31-0x0000029664000000-0x0000029664267000-memory.dmp

Download

memory/3036-30-0x0000000003DA0000-0x0000000003DA1000-memory.dmp

Download

memory/3036-277-0x00000000005C0000-0x00000000006C7000-memory.dmp

Download

memory/3036-10-0x0000000003DA0000-0x0000000003DA1000-memory.dmp

Download

memory/3036-9-0x0000000003DA0000-0x0000000003DA1000-memory.dmp

Download

memory/3036-8-0x00000000005C0000-0x00000000006C7000-memory.dmp

Download

memory/3036-1-0x00000000005C0000-0x00000000006C7000-memory.dmp

Download

memory/3036-0-0x00000000005C0000-0x00000000006C7000-memory.dmp

Download

memory/3136-47-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-53-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-54-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-56-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-58-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-62-0x00007FFC02E83000-0x00007FFC02E84000-memory.dmp

Download

memory/3136-61-0x00007FFC02E82000-0x00007FFC02E83000-memory.dmp

Download

memory/3136-60-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-59-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-63-0x0000000002840000-0x0000000002850000-memory.dmp

Download

memory/3136-64-0x00007FFC02E83000-0x00007FFC02E84000-memory.dmp

Download

memory/3136-65-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-68-0x00007FFC02EDB000-0x00007FFC02EDC000-memory.dmp

Download

memory/3136-67-0x0000000002840000-0x0000000002850000-memory.dmp

Download

memory/3136-66-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-69-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-80-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-79-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-78-0x00007FFC02EDB000-0x00007FFC02EDC000-memory.dmp

Download

memory/3136-77-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-81-0x0000000002840000-0x0000000002850000-memory.dmp

Download

memory/3136-75-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-74-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-72-0x00007FFC02EDB000-0x00007FFC02EDC000-memory.dmp

Download

memory/3136-71-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-70-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-82-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-85-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-83-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-84-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-86-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-87-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-88-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-89-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-92-0x00007FFC02EDB000-0x00007FFC02EDC000-memory.dmp

Download

memory/3136-11-0x00000000027E0000-0x00000000027E3000-memory.dmp

Download

memory/3136-262-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-261-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-260-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-46-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-48-0x00007FFC02E82000-0x00007FFC02E83000-memory.dmp

Download

memory/3136-51-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-52-0x00007FFC02EDB000-0x00007FFC02EDC000-memory.dmp

Download

memory/3136-55-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-49-0x00000000027B0000-0x00000000027C0000-memory.dmp

Download

memory/3136-50-0x00007FFC02E82000-0x00007FFC02E83000-memory.dmp

Download

memory/3136-125-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Download

memory/3136-127-0x00000000028B0000-0x00000000028B1000-memory.dmp

Download

memory/3136-126-0x00000000027A0000-0x00000000027A1000-memory.dmp

Download

memory/3136-259-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-44-0x00000000028B0000-0x00000000028B1000-memory.dmp

Download

memory/3136-43-0x000000000B3E0000-0x000000000B675000-memory.dmp

Download

memory/3136-16-0x000000000B3E0000-0x000000000B675000-memory.dmp

Download

memory/3136-25-0x00000000028B0000-0x00000000028B1000-memory.dmp

Download

memory/3136-21-0x00000000027E0000-0x00000000027E3000-memory.dmp

Download

memory/3136-156-0x00000000027B0000-0x00000000027B1000-memory.dmp

Download

memory/3136-15-0x000000000B3E0000-0x000000000B675000-memory.dmp

Download

memory/3136-12-0x00000000027E0000-0x00000000027E3000-memory.dmp

Download

memory/3136-235-0x0000000008A50000-0x0000000008A51000-memory.dmp

Download

memory/3136-234-0x0000000008A40000-0x0000000008A41000-memory.dmp

Download

memory/3136-232-0x0000000008A20000-0x0000000008A21000-memory.dmp

Download

memory/3136-231-0x0000000007880000-0x0000000007881000-memory.dmp

Download

memory/3136-230-0x0000000007870000-0x0000000007871000-memory.dmp

Download

memory/3136-229-0x0000000007860000-0x0000000007861000-memory.dmp

Download

memory/3136-228-0x0000000007850000-0x0000000007851000-memory.dmp

Download

memory/3136-225-0x00000000077D0000-0x00000000077D1000-memory.dmp

Download

memory/3136-224-0x00000000077B0000-0x00000000077B1000-memory.dmp

Download

memory/3136-223-0x0000000004930000-0x0000000004931000-memory.dmp

Download

memory/3136-222-0x0000000002D30000-0x0000000002D31000-memory.dmp

Download

memory/3136-220-0x00000000027B0000-0x00000000027B1000-memory.dmp

Download

memory/3136-233-0x0000000008A30000-0x0000000008A31000-memory.dmp

Download

memory/3136-227-0x0000000007840000-0x0000000007841000-memory.dmp

Download

memory/3136-226-0x0000000007830000-0x0000000007831000-memory.dmp

Download

memory/3136-221-0x00000000028D0000-0x00000000028D1000-memory.dmp

Download

memory/3136-252-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-253-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-254-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-255-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-256-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-257-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/3136-258-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/4636-130-0x00000297C8CB0000-0x00000297C8F45000-memory.dmp

Download

memory/4636-104-0x00000297C8C40000-0x00000297C8C41000-memory.dmp

Download

memory/4636-94-0x00000297C8CB0000-0x00000297C8F45000-memory.dmp

Download

memory/4636-96-0x00000297C8CB0000-0x00000297C8F45000-memory.dmp

Download

memory/4636-100-0x00000297C8CB0000-0x00000297C8F45000-memory.dmp

Download