184ebb43bfbace5e61336e001253872960b03af82d2082c84500eb68a5328e07

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FREEBOTNET.exe
Size 2.1MB
Sample260626-s8ddpsds2m
SHA256 184ebb43bfbace5e61336e001253872960b03af82d2082c84500eb68a5328e07
MD5 891a0b15abf0b64496ab43d6c8d8d6dd
SHA1 21cb4e2dfd96f5ebc86dbe40f227a8b1a61e5235
SHA512 b47cb6c67fb7e90abea85bbce12a60f73ad6720a5db4b96091bd62ab34cd9c33112397be1c2f9392b8450abdbafed488076b5d4352621ec6b5fab4f0c065fe26
SSDEEP 49152:Hkwzj39pva3/Ioj15e4w8xhACEKzs57Xci5NLd:fojPJw80Rp7XcO1
TLSH
T1DDA5CF17A76801FDD0A3D2BACE524807E7B1B8460771A7DF03D09AA61F176D89E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2948	powershell.exe
5	4592	powershell.exe
6	4584	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2136	powershell.exe
1780	powershell.exe
2948	powershell.exe
4592	powershell.exe
4584	powershell.exe
5044	powershell.exe
4392	powershell.exe
420	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
3468	helper_2956.exe
3076	SystemServices.exe
5960	SystemServices.exe
256	helper_3076.exe
4436	helper_5960.exe
4464	helper_2956.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemServices.exe\" --silent"	FREEBOTNET.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemServices.exe\" --silent"	SystemServices.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
1	discord.com
9	api.gofile.io
11	api.gofile.io
14	discord.com
15	discord.com

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
4	api.ipify.org
5	api.ipify.org
6	api.ipify.org

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3172	cmd.exe
4244	netsh.exe
1928	cmd.exe
2960	netsh.exe
4784	netsh.exe
948	cmd.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5404	WMIC.exe
776	WMIC.exe

Kills process with taskkill 14 IoCs

defense_evasion

pid	Process
4872	taskkill.exe
1400	taskkill.exe
2296	taskkill.exe
2400	taskkill.exe
5112	taskkill.exe
3360	taskkill.exe
1492	taskkill.exe
2596	taskkill.exe
4564	taskkill.exe
2312	taskkill.exe
1392	taskkill.exe
824	taskkill.exe
2756	taskkill.exe
4512	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5772	schtasks.exe
5852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
2948	powershell.exe
2948	powershell.exe
5044	powershell.exe
5044	powershell.exe
5044	powershell.exe
2948	powershell.exe
3076	SystemServices.exe
3076	SystemServices.exe
4392	powershell.exe
4392	powershell.exe
4592	powershell.exe
4592	powershell.exe
4392	powershell.exe
4592	powershell.exe
420	powershell.exe
420	powershell.exe
420	powershell.exe
4584	powershell.exe
4584	powershell.exe
776	WMIC.exe
776	WMIC.exe
776	WMIC.exe
776	WMIC.exe
4584	powershell.exe
244	WMIC.exe
244	WMIC.exe
244	WMIC.exe
244	WMIC.exe
5536	WMIC.exe
5536	WMIC.exe
5536	WMIC.exe
5536	WMIC.exe
5404	WMIC.exe
5404	WMIC.exe
5404	WMIC.exe
5404	WMIC.exe
4052	WMIC.exe
4052	WMIC.exe
4052	WMIC.exe
4052	WMIC.exe
3360	WMIC.exe
3360	WMIC.exe
3360	WMIC.exe
3360	WMIC.exe
2136	powershell.exe
2136	powershell.exe
2136	powershell.exe
1780	powershell.exe
1780	powershell.exe
1780	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	1392	taskkill.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	824	taskkill.exe
Token: SeDebugPrivilege	420	powershell.exe
Token: SeDebugPrivilege	5112	taskkill.exe
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeDebugPrivilege	2756	taskkill.exe
Token: SeIncreaseQuotaPrivilege	776	WMIC.exe
Token: SeSecurityPrivilege	776	WMIC.exe
Token: SeTakeOwnershipPrivilege	776	WMIC.exe
Token: SeLoadDriverPrivilege	776	WMIC.exe
Token: SeSystemProfilePrivilege	776	WMIC.exe
Token: SeSystemtimePrivilege	776	WMIC.exe
Token: SeProfSingleProcessPrivilege	776	WMIC.exe
Token: SeIncBasePriorityPrivilege	776	WMIC.exe
Token: SeCreatePagefilePrivilege	776	WMIC.exe
Token: SeBackupPrivilege	776	WMIC.exe
Token: SeRestorePrivilege	776	WMIC.exe
Token: SeShutdownPrivilege	776	WMIC.exe
Token: SeDebugPrivilege	776	WMIC.exe
Token: SeSystemEnvironmentPrivilege	776	WMIC.exe
Token: SeRemoteShutdownPrivilege	776	WMIC.exe
Token: SeUndockPrivilege	776	WMIC.exe
Token: SeManageVolumePrivilege	776	WMIC.exe
Token: 33	776	WMIC.exe
Token: 34	776	WMIC.exe
Token: 35	776	WMIC.exe
Token: 36	776	WMIC.exe
Token: SeIncreaseQuotaPrivilege	776	WMIC.exe
Token: SeSecurityPrivilege	776	WMIC.exe
Token: SeTakeOwnershipPrivilege	776	WMIC.exe
Token: SeLoadDriverPrivilege	776	WMIC.exe
Token: SeSystemProfilePrivilege	776	WMIC.exe
Token: SeSystemtimePrivilege	776	WMIC.exe
Token: SeProfSingleProcessPrivilege	776	WMIC.exe
Token: SeIncBasePriorityPrivilege	776	WMIC.exe
Token: SeCreatePagefilePrivilege	776	WMIC.exe
Token: SeBackupPrivilege	776	WMIC.exe
Token: SeRestorePrivilege	776	WMIC.exe
Token: SeShutdownPrivilege	776	WMIC.exe
Token: SeDebugPrivilege	776	WMIC.exe
Token: SeSystemEnvironmentPrivilege	776	WMIC.exe
Token: SeRemoteShutdownPrivilege	776	WMIC.exe
Token: SeUndockPrivilege	776	WMIC.exe
Token: SeManageVolumePrivilege	776	WMIC.exe
Token: 33	776	WMIC.exe
Token: 34	776	WMIC.exe
Token: 35	776	WMIC.exe
Token: 36	776	WMIC.exe
Token: SeDebugPrivilege	3360	taskkill.exe
Token: SeIncreaseQuotaPrivilege	244	WMIC.exe
Token: SeSecurityPrivilege	244	WMIC.exe
Token: SeTakeOwnershipPrivilege	244	WMIC.exe
Token: SeLoadDriverPrivilege	244	WMIC.exe
Token: SeSystemProfilePrivilege	244	WMIC.exe
Token: SeSystemtimePrivilege	244	WMIC.exe
Token: SeProfSingleProcessPrivilege	244	WMIC.exe
Token: SeIncBasePriorityPrivilege	244	WMIC.exe
Token: SeCreatePagefilePrivilege	244	WMIC.exe
Token: SeBackupPrivilege	244	WMIC.exe
Token: SeRestorePrivilege	244	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 1092	2956	FREEBOTNET.exe	89
PID 2956 wrote to memory of 5172	2956	FREEBOTNET.exe	90
PID 2956 wrote to memory of 4452	2956	FREEBOTNET.exe	91
PID 2956 wrote to memory of 3172	2956	FREEBOTNET.exe	95
PID 5172 wrote to memory of 2948	5172	cmd.exe	97
PID 2956 wrote to memory of 3468	2956	FREEBOTNET.exe	98
PID 2956 wrote to memory of 5044	2956	FREEBOTNET.exe	100
PID 4452 wrote to memory of 1392	4452	cmd.exe	205
PID 3172 wrote to memory of 4244	3172	cmd.exe	104
PID 1092 wrote to memory of 5852	1092	cmd.exe	105
PID 3076 wrote to memory of 1900	3076	SystemServices.exe	110
PID 3076 wrote to memory of 5408	3076	SystemServices.exe	109
PID 3076 wrote to memory of 4392	3076	SystemServices.exe	115
PID 3076 wrote to memory of 1928	3076	SystemServices.exe	114
PID 3076 wrote to memory of 256	3076	SystemServices.exe	116
PID 5408 wrote to memory of 4592	5408	cmd.exe	121
PID 1928 wrote to memory of 2960	1928	cmd.exe	123
PID 1900 wrote to memory of 824	1900	cmd.exe	124
PID 5960 wrote to memory of 1720	5960	SystemServices.exe	126
PID 5960 wrote to memory of 4876	5960	SystemServices.exe	127
PID 5960 wrote to memory of 5732	5960	SystemServices.exe	128
PID 5960 wrote to memory of 948	5960	SystemServices.exe	129
PID 5960 wrote to memory of 420	5960	SystemServices.exe	130
PID 2956 wrote to memory of 2344	2956	FREEBOTNET.exe	131
PID 5960 wrote to memory of 4436	5960	SystemServices.exe	138
PID 3468 wrote to memory of 1508	3468	helper_2956.exe	135
PID 3468 wrote to memory of 1508	3468	helper_2956.exe	135
PID 2956 wrote to memory of 3620	2956	FREEBOTNET.exe	141
PID 1720 wrote to memory of 5772	1720	cmd.exe	144
PID 5732 wrote to memory of 5112	5732	cmd.exe	145
PID 948 wrote to memory of 4784	948	cmd.exe	143
PID 4876 wrote to memory of 4584	4876	cmd.exe	146
PID 2344 wrote to memory of 2756	2344	cmd.exe	147
PID 3620 wrote to memory of 776	3620	cmd.exe	148
PID 3076 wrote to memory of 2936	3076	SystemServices.exe	149
PID 5960 wrote to memory of 1768	5960	SystemServices.exe	151
PID 2956 wrote to memory of 5412	2956	FREEBOTNET.exe	153
PID 2956 wrote to memory of 5168	2956	FREEBOTNET.exe	155
PID 2936 wrote to memory of 3360	2936	cmd.exe	201
PID 256 wrote to memory of 1444	256	helper_3076.exe	200
PID 256 wrote to memory of 1444	256	helper_3076.exe	200
PID 3468 wrote to memory of 3436	3468	helper_2956.exe	159
PID 3468 wrote to memory of 3436	3468	helper_2956.exe	159
PID 1768 wrote to memory of 4512	1768	cmd.exe	160
PID 5168 wrote to memory of 244	5168	cmd.exe	161
PID 5412 wrote to memory of 4872	5412	cmd.exe	162
PID 4436 wrote to memory of 4600	4436	helper_5960.exe	163
PID 2956 wrote to memory of 460	2956	FREEBOTNET.exe	164
PID 2956 wrote to memory of 1232	2956	FREEBOTNET.exe	165
PID 5960 wrote to memory of 3804	5960	SystemServices.exe	166
PID 2956 wrote to memory of 3920	2956	FREEBOTNET.exe	170
PID 1232 wrote to memory of 5536	1232	cmd.exe	172
PID 3804 wrote to memory of 1492	3804	cmd.exe	173
PID 3920 wrote to memory of 2596	3920	cmd.exe	174
PID 4436 wrote to memory of 4600	4436	helper_5960.exe	163
PID 5960 wrote to memory of 5636	5960	SystemServices.exe	175
PID 5636 wrote to memory of 1400	5636	cmd.exe	177
PID 256 wrote to memory of 2720	256	helper_3076.exe	178
PID 256 wrote to memory of 2720	256	helper_3076.exe	178
PID 2956 wrote to memory of 4152	2956	FREEBOTNET.exe	181
PID 5960 wrote to memory of 1960	5960	SystemServices.exe	183
PID 4152 wrote to memory of 2296	4152	cmd.exe	185
PID 1960 wrote to memory of 2400	1960	cmd.exe	186
PID 5960 wrote to memory of 2928	5960	SystemServices.exe	187

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FREEBOTNET.exe
"C:\Users\Admin\AppData\Local\Temp\FREEBOTNET.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsSystemUpdater" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe\" --silent" /sc MINUTE /mo 30 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsSystemUpdater" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe\" --silent" /sc MINUTE /mo 30 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c netsh wlan show profiles
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4244
- C:\Users\Admin\AppData\Local\Temp\helper_2956.exe
  "C:\Users\Admin\AppData\Local\Temp\helper_2956.exe" --kill --output-path "C:\Users\Admin\AppData\Local\Temp\ce_2956" all
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\grabbed_2956\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\GrabbedFiles_2956.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /f /im brave.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:776
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /f /im msedge.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:4872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic os get Caption
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get Caption
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\ce_2956"
  2⤵
  PID:460
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic cpu get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /f /im opera.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im opera.exe
    3⤵
    - Kills process with taskkill
    PID:2596
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /f /im browser.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im browser.exe
    3⤵
    - Kills process with taskkill
    PID:2296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /f /im vivaldi.exe >nul 2>&1
  2⤵
  PID:3568
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:4564
- C:\Users\Admin\AppData\Local\Temp\helper_2956.exe
  "C:\Users\Admin\AppData\Local\Temp\helper_2956.exe" --kill --output-path "C:\Users\Admin\AppData\Local\Temp\ce_2956" all
  2⤵
  - Executes dropped EXE
  PID:4464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\ce_2956"
  2⤵
  PID:432
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\grabbed_2956"
  2⤵
  PID:2688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c move /y "C:\Users\Admin\AppData\Local\Temp\sess_2956" "C:\Users\Admin\AppData\Local\Temp\Scanned_2956\Games\Steam_Riot" >nul 2>&1
  2⤵
  PID:3340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\Scanned_2956\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\VictusData_2956.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\Scanned_2956"
  2⤵
  PID:5976

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe" --silent
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- C:\Windows\System32\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:824
- C:\Windows\System32\cmd.exe
  cmd.exe /c netsh wlan show profiles
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\System32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\grabbed_3076\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\GrabbedFiles_3076.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4392
- C:\Users\Admin\AppData\Local\Temp\helper_3076.exe
  "C:\Users\Admin\AppData\Local\Temp\helper_3076.exe" --kill --output-path "C:\Users\Admin\AppData\Local\Temp\ce_3076" all
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2720
- C:\Windows\System32\cmd.exe
  cmd.exe /c taskkill /f /im brave.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3360

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\System32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsSystemUpdater" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe\" --silent" /sc MINUTE /mo 30 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\System32\schtasks.exe
    schtasks /create /tn "WindowsSystemUpdater" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe\" --silent" /sc MINUTE /mo 30 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5772
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4584
- C:\Windows\System32\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5112
- C:\Windows\System32\cmd.exe
  cmd.exe /c netsh wlan show profiles
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\System32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\grabbed_5960\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\GrabbedFiles_5960.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:420
- C:\Users\Admin\AppData\Local\Temp\helper_5960.exe
  "C:\Users\Admin\AppData\Local\Temp\helper_5960.exe" --kill --output-path "C:\Users\Admin\AppData\Local\Temp\ce_5960" all
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4804
- C:\Windows\System32\cmd.exe
  cmd.exe /c taskkill /f /im brave.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im brave.exe
    3⤵
    - Kills process with taskkill
    PID:4512
- C:\Windows\System32\cmd.exe
  cmd.exe /c taskkill /f /im msedge.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:1492
- C:\Windows\System32\cmd.exe
  cmd.exe /c taskkill /f /im opera.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5636
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im opera.exe
    3⤵
    - Kills process with taskkill
    PID:1400
- C:\Windows\System32\cmd.exe
  cmd.exe /c taskkill /f /im browser.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im browser.exe
    3⤵
    - Kills process with taskkill
    PID:2400
- C:\Windows\System32\cmd.exe
  cmd.exe /c taskkill /f /im vivaldi.exe >nul 2>&1
  2⤵
  PID:2928
- - C:\Windows\System32\taskkill.exe
    taskkill /f /im vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:2312
- C:\Windows\System32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  PID:2548
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:5404
- C:\Windows\System32\cmd.exe
  cmd.exe /c wmic os get Caption
  2⤵
  PID:2420
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get Caption
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4052
- C:\Windows\System32\cmd.exe
  cmd.exe /c wmic cpu get name
  2⤵
  PID:5092
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1444
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3360
- C:\Windows\System32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\ce_5960"
  2⤵
  PID:1392
- C:\Windows\System32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\grabbed_5960"
  2⤵
  PID:3016
- C:\Windows\System32\cmd.exe
  cmd.exe /c move /y "C:\Users\Admin\AppData\Local\Temp\sess_5960" "C:\Users\Admin\AppData\Local\Temp\Scanned_5960\Games\Steam_Riot" >nul 2>&1
  2⤵
  PID:3260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\Scanned_5960\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\VictusData_5960.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1780
- C:\Windows\System32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\Scanned_5960"
  2⤵
  PID:1920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:908

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv znKZrsAbK0Ky6cHDdjcIYA.0.2
1⤵
PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...