Analysis
- max time kernel
900s - max time network
896s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 00:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ABI Full[Launcher].exe
Resource
win10v2004-20260513-en
windows10-2004-x64
33 signatures
900 seconds
Behavioral task
behavioral2
Sample
ABI Full[Launcher].exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
General
- Target ABI Full[Launcher].exe
- Size 4.0MB
- Sample260731-atrnnsaa65
- SHA256 4cea7f2769e4397869ee4b85b23c8c50b972a1137614239c0e04482e8ae61874
- MD5 7ea6b5cf7eac17a5826f2ff6ea81110e
- SHA1 4806b419f996ee94e73b78143e5399a01fc197d9
- SHA512 a82be1a7c63a83f63f0d3f7a7b3a1ff19fb935376aaf4cfb2071e9933a2b65cd5165aa800f88cf1f31aa40d1ab4f980c5f78075740763b9ebfb41739d4924c59
- SSDEEP 98304:YJpdOBAMfz7U2NNG94om5/JVgobqugref6qaScPedZx+KAf33:YfMnr7U2NNS4ochOoec6EcPi+KAv3
- TLSH T13316330FB7A970E4F4F7F63680762906F769BC740A74A72B16C64B210E266829D1CF35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 57 IoCs
resource yara_rule behavioral2/memory/6060-28-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-31-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-32-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-71-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-73-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-75-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-77-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-79-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-81-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-83-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-85-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-87-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-89-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-91-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-93-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-95-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-97-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-99-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-101-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-103-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-105-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-107-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-109-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-111-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-113-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-115-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-117-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-119-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-121-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-123-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-125-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-127-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-129-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-131-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-133-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-135-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-137-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-140-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-142-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-144-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-146-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-148-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-150-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-152-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-154-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-156-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-158-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-160-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-162-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-164-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-166-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-168-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-170-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-172-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-174-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-176-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer behavioral2/memory/1424-178-0x0000000000660000-0x0000000001276000-memory.dmp family_salatstealer - Executes dropped EXE 4 IoCs
pid Process 3680 5weawtrq.exe 4968 WmiPrvSE.exe 6060 duff.exe 1424 duff.exe - Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
resource yara_rule behavioral2/files/0x000c00000001c5a8-24.dat upx behavioral2/memory/6060-26-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/6060-28-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-30-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-31-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-32-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-71-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-73-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-75-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-77-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-79-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-81-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-83-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-85-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-87-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-89-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-91-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-93-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-95-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-97-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-99-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-101-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-103-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-105-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-107-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-109-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-111-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-113-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-115-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-117-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-119-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-121-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-123-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-125-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-127-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-129-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-131-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-133-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-135-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-137-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-140-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-142-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-144-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-146-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-148-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-150-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-152-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-154-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-156-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-158-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-160-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-162-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-164-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-166-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-168-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-170-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-172-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-174-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-176-0x0000000000660000-0x0000000001276000-memory.dmp upx behavioral2/memory/1424-178-0x0000000000660000-0x0000000001276000-memory.dmp upx - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\SystemTemp\__PSScriptPolicyTest_4p5fk05k.uvc.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_4oojvbwh.0xb.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_wgfc1bad.we4.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_nzlxcyxj.n1m.psm1 powershell.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language duff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language duff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3680 5weawtrq.exe 3680 5weawtrq.exe 4968 WmiPrvSE.exe 4968 WmiPrvSE.exe 4968 WmiPrvSE.exe 4968 WmiPrvSE.exe 4968 WmiPrvSE.exe 4968 WmiPrvSE.exe 4968 WmiPrvSE.exe 4968 WmiPrvSE.exe 1424 duff.exe 1424 duff.exe 1424 duff.exe 1424 duff.exe 1992 powershell.exe 1992 powershell.exe 4968 WmiPrvSE.exe 4968 WmiPrvSE.exe 4968 WmiPrvSE.exe 4968 WmiPrvSE.exe 4968 WmiPrvSE.exe 4968 WmiPrvSE.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1424 duff.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 4628 Process not Found 5476 Process not Found 5928 Process not Found 1968 Process not Found 4548 Process not Found 1076 Process not Found 5988 Process not Found 4360 Process not Found 5828 Process not Found 6008 Process not Found 988 Process not Found 5676 Process not Found 2960 Process not Found 4572 Process not Found 5980 Process not Found 4420 Process not Found 5496 Process not Found 796 Process not Found 5620 Process not Found 1148 Process not Found 6100 Process not Found 5748 Process not Found 3244 Process not Found 2780 Process not Found 4276 Process not Found 1796 Process not Found 2496 Process not Found 912 Process not Found 5920 Process not Found 4484 Process not Found 5260 Process not Found 5876 Process not Found 4640 Process not Found 2424 Process not Found 5104 Process not Found 3396 Process not Found 1836 Process not Found 2716 Process not Found 2828 Process not Found 1408 Process not Found 1204 Process not Found 4604 Process not Found 3676 Process not Found 2152 Process not Found 6028 Process not Found 2876 Process not Found 3280 Process not Found 5008 Process not Found 3276 Process not Found 4616 Process not Found 1484 Process not Found 5588 Process not Found 1392 Process not Found 5612 Process not Found 4928 Process not Found 748 Process not Found 5380 Process not Found 2168 Process not Found 5448 Process not Found 5856 Process not Found 4000 Process not Found 4612 Process not Found 3952 Process not Found 1224 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3680 5weawtrq.exe Token: SeAssignPrimaryTokenPrivilege 3680 5weawtrq.exe Token: SeIncreaseQuotaPrivilege 3680 5weawtrq.exe Token: SeDebugPrivilege 4968 WmiPrvSE.exe Token: SeAssignPrimaryTokenPrivilege 4968 WmiPrvSE.exe Token: SeIncreaseQuotaPrivilege 4968 WmiPrvSE.exe Token: SeDebugPrivilege 1992 powershell.exe Token: SeAssignPrimaryTokenPrivilege 1992 powershell.exe Token: SeIncreaseQuotaPrivilege 1992 powershell.exe Token: SeSecurityPrivilege 1992 powershell.exe Token: SeTakeOwnershipPrivilege 1992 powershell.exe Token: SeLoadDriverPrivilege 1992 powershell.exe Token: SeSystemtimePrivilege 1992 powershell.exe Token: SeBackupPrivilege 1992 powershell.exe Token: SeRestorePrivilege 1992 powershell.exe Token: SeShutdownPrivilege 1992 powershell.exe Token: SeSystemEnvironmentPrivilege 1992 powershell.exe Token: SeUndockPrivilege 1992 powershell.exe Token: SeManageVolumePrivilege 1992 powershell.exe Token: SeAssignPrimaryTokenPrivilege 1992 powershell.exe Token: SeIncreaseQuotaPrivilege 1992 powershell.exe Token: SeSecurityPrivilege 1992 powershell.exe Token: SeTakeOwnershipPrivilege 1992 powershell.exe Token: SeLoadDriverPrivilege 1992 powershell.exe Token: SeSystemtimePrivilege 1992 powershell.exe Token: SeBackupPrivilege 1992 powershell.exe Token: SeRestorePrivilege 1992 powershell.exe Token: SeShutdownPrivilege 1992 powershell.exe Token: SeSystemEnvironmentPrivilege 1992 powershell.exe Token: SeUndockPrivilege 1992 powershell.exe Token: SeManageVolumePrivilege 1992 powershell.exe Token: SeAssignPrimaryTokenPrivilege 1992 powershell.exe Token: SeIncreaseQuotaPrivilege 1992 powershell.exe Token: SeSecurityPrivilege 1992 powershell.exe Token: SeTakeOwnershipPrivilege 1992 powershell.exe Token: SeLoadDriverPrivilege 1992 powershell.exe Token: SeSystemtimePrivilege 1992 powershell.exe Token: SeBackupPrivilege 1992 powershell.exe Token: SeRestorePrivilege 1992 powershell.exe Token: SeShutdownPrivilege 1992 powershell.exe Token: SeSystemEnvironmentPrivilege 1992 powershell.exe Token: SeUndockPrivilege 1992 powershell.exe Token: SeManageVolumePrivilege 1992 powershell.exe Token: SeAssignPrimaryTokenPrivilege 1992 powershell.exe Token: SeIncreaseQuotaPrivilege 1992 powershell.exe Token: SeSecurityPrivilege 1992 powershell.exe Token: SeTakeOwnershipPrivilege 1992 powershell.exe Token: SeLoadDriverPrivilege 1992 powershell.exe Token: SeSystemtimePrivilege 1992 powershell.exe Token: SeBackupPrivilege 1992 powershell.exe Token: SeRestorePrivilege 1992 powershell.exe Token: SeShutdownPrivilege 1992 powershell.exe Token: SeSystemEnvironmentPrivilege 1992 powershell.exe Token: SeUndockPrivilege 1992 powershell.exe Token: SeManageVolumePrivilege 1992 powershell.exe Token: SeDebugPrivilege 4968 WmiPrvSE.exe Token: SeAssignPrimaryTokenPrivilege 4968 WmiPrvSE.exe Token: SeIncreaseQuotaPrivilege 4968 WmiPrvSE.exe Token: SeDebugPrivilege 4968 WmiPrvSE.exe Token: SeAssignPrimaryTokenPrivilege 4968 WmiPrvSE.exe Token: SeIncreaseQuotaPrivilege 4968 WmiPrvSE.exe Token: SeDebugPrivilege 4968 WmiPrvSE.exe Token: SeAssignPrimaryTokenPrivilege 4968 WmiPrvSE.exe Token: SeIncreaseQuotaPrivilege 4968 WmiPrvSE.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4176 wrote to memory of 3680 4176 ABI Full[Launcher].exe 90 PID 3680 wrote to memory of 740 3680 5weawtrq.exe 5 PID 4968 wrote to memory of 740 4968 WmiPrvSE.exe 5 PID 4968 wrote to memory of 6060 4968 WmiPrvSE.exe 95 PID 4968 wrote to memory of 1424 4968 WmiPrvSE.exe 1340 PID 1424 wrote to memory of 1992 1424 duff.exe 7764
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\ABI Full[Launcher].exe"C:\Users\Admin\AppData\Local\Temp\ABI Full[Launcher].exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\5weawtrq.exe"C:\Users\Admin\AppData\Local\5weawtrq.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680
-
-
C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\pyp\WmiPrvSE.exe"C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\pyp\WmiPrvSE.exe" --service --sn=Ro3oj0VSpcDs1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\pyp\duff.exe"C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\pyp\duff.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6060
-
-
C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\pyp\duff.exe"C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\pyp\duff.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵PID:2036
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:5392
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2052
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:5176
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3760
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1604
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:944
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:2796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5000
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\pyp\duff.exe
- Size 3.4MB
- SHA256 b5169a31b6d9ad709e396e7b937205076f666506366f3f9122608e2933cfceca
- MD5 566c82807acb4959ef4de9b1ebff0c9a
- SHA1 afaae61a72828be1a09aa54e9eb27207ec8a8231
- SHA512 f030e4a560e80aa10cf11fc5366d1e68d79d2a70f5aa4d7fd2947d186fc6f49ba8bc896634fc919847eabe0c23d9436f79e6fb94ee6f2627f0aabedc4c6b68ba
- SSDEEP 98304:UV8otUf3AoESofksdIyJW2gN5k8BMptmp3JNh9:UeZgkRN5k8HJJ
- TLSH T1B0F5335A3E4DFC15C30A8271736B2BCEDD99B7F7A981EC4B4F4026518D6A3481B24E78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\5weawtrq.exe
- Size 3.8MB
- SHA256 c9bc92c29044cae43b58248cd40e29400014e23cc808edf7046ade568e6a8497
- MD5 11c3637c555cc865a5596cf996b0bad7
- SHA1 6234aebc806a0d201510476de2472d02dc54cd9d
- SHA512 8d177d8daf3e848e3c7687a7f1780dd12ba0eb483eaa32383122459e21de0e5d591b6a992f9f7e4eac1060d3b09f57b4f8573878fa92e185d0ab8b26f834b15e
- SSDEEP 98304:JRV8otUf3AoESofksdIyJW2gN5k8BMptmp3JNh9:JReZgkRN5k8HJJ
- TLSH T120062203B69550B5D17F817896675A46FB7AF93187A19EDF03500AAA0F333C4AE38F21
- MD5 SHA1 SHA512 SSDEEP TLSH