271b738791619b89212e47caa12d2b544f1bf973cba6ecac4436befe2f339354

Analysis

max time kernel
110s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NOUACuy5kdvf1v1255z4l.exe
Size 374KB
Sample260808-g98epaar9v
SHA256 271b738791619b89212e47caa12d2b544f1bf973cba6ecac4436befe2f339354
MD5 c9fa8ae47807a62b52a171818e013643
SHA1 0cf84907fcdd435ae063b96db2b3c503b3ce55a7
SHA512 adf3f86cd39814c4f0f31d402bca1dc7e2e1f388e28cdde2c561ae1ac9e73d8338d9e23dc3103d697842a730953206eaa7b097f811410f476ffa2242fcda51ed
SSDEEP 6144:+6HjoWceTstqlkgor5eKIoN25y8+8eeFCuvozc39pRL0D5bO69CN5aXiS5:+BGshBkeeF8ctpR0DosXiS5
TLSH
T16A84B4247F988A09E590297E415E5A11C7DA91F222327303370BFF615D89DDEEE2C3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4608	dllhost.exe
5132	Audiodg.exe
3132	dllhost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	pastebin.com
8	pastebin.com
1	pastebin.com
2	pastebin.com
5	pastebin.com

Looks up external IP address via web service 1 TTPs 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
19	checkip.amazonaws.com
1	api.ipify.org
1	icanhazip.com
1	ipinfo.io
1	checkip.amazonaws.com
4	icanhazip.com
7	api.ipify.org
13	api.ipify.org

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\dllhost.exe	NOUACuy5kdvf1v1255z4l.exe
File opened for modification	C:\Windows\Audiodg.exe	NOUACuy5kdvf1v1255z4l.exe
File opened for modification	C:\Windows\dllhost.exe	dllhost.exe
File opened for modification	C:\Windows\dllhost.exe	dllhost.exe
File opened for modification	C:\Windows\Audiodg.exe	dllhost.exe
File opened for modification	C:\Windows\dllhost.exe	Audiodg.exe
File opened for modification	C:\Windows\Audiodg.exe	Audiodg.exe
File opened for modification	C:\Windows\dllhost.exe	NOUACuy5kdvf1v1255z4l.exe
File created	C:\Windows\Audiodg.exe	NOUACuy5kdvf1v1255z4l.exe
File opened for modification	C:\Windows\Audiodg.exe	dllhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 44 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2980	cmd.exe
3388	cmd.exe
2144	cmd.exe
2544	cmd.exe
1508	cmd.exe
296	cmd.exe
480	cmd.exe
4636	cmd.exe
2548	cmd.exe
3336	cmd.exe
2904	cmd.exe
5428	cmd.exe
420	cmd.exe
3316	cmd.exe
4848	cmd.exe
3976	cmd.exe
3168	cmd.exe
1164	cmd.exe
1232	cmd.exe
2956	cmd.exe
2432	cmd.exe
3252	cmd.exe
1456	cmd.exe
2512	cmd.exe
5984	cmd.exe
5704	cmd.exe
2820	cmd.exe
4120	cmd.exe
4312	cmd.exe
3812	cmd.exe
4836	cmd.exe
544	cmd.exe
5612	cmd.exe
1168	cmd.exe
1060	cmd.exe
3196	cmd.exe
5276	cmd.exe
4976	cmd.exe
4320	cmd.exe
4720	cmd.exe
4696	cmd.exe
2180	cmd.exe
2268	cmd.exe
1664	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 44 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2388	schtasks.exe
1244	schtasks.exe
2468	schtasks.exe
4224	schtasks.exe
3000	schtasks.exe
2964	schtasks.exe
5696	schtasks.exe
4456	schtasks.exe
3392	schtasks.exe
4896	schtasks.exe
5568	schtasks.exe
5100	schtasks.exe
5332	schtasks.exe
5268	schtasks.exe
2656	schtasks.exe
3416	schtasks.exe
932	schtasks.exe
4400	schtasks.exe
1352	schtasks.exe
824	schtasks.exe
3204	schtasks.exe
2268	schtasks.exe
4704	schtasks.exe
2228	schtasks.exe
3940	schtasks.exe
4644	schtasks.exe
5296	schtasks.exe
1932	schtasks.exe
3188	schtasks.exe
1860	schtasks.exe
2780	schtasks.exe
5944	schtasks.exe
3208	schtasks.exe
2240	schtasks.exe
2356	schtasks.exe
3300	schtasks.exe
2796	schtasks.exe
6028	schtasks.exe
4296	schtasks.exe
6088	schtasks.exe
1080	schtasks.exe
2132	schtasks.exe
1544	schtasks.exe
3268	schtasks.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	NOUACuy5kdvf1v1255z4l.exe
Token: SeDebugPrivilege	4608	dllhost.exe
Token: SeDebugPrivilege	3132	dllhost.exe
Token: SeDebugPrivilege	5132	Audiodg.exe
Token: SeIncBasePriorityPrivilege	3132	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4596	4864	NOUACuy5kdvf1v1255z4l.exe	91
PID 4864 wrote to memory of 480	4864	NOUACuy5kdvf1v1255z4l.exe	93
PID 480 wrote to memory of 5696	480	cmd.exe	95
PID 4864 wrote to memory of 1164	4864	NOUACuy5kdvf1v1255z4l.exe	96
PID 1164 wrote to memory of 1932	1164	cmd.exe	98
PID 4864 wrote to memory of 3132	4864	NOUACuy5kdvf1v1255z4l.exe	103
PID 3132 wrote to memory of 4636	3132	dllhost.exe	104
PID 4636 wrote to memory of 932	4636	cmd.exe	106
PID 3132 wrote to memory of 1168	3132	dllhost.exe	107
PID 1168 wrote to memory of 4400	1168	cmd.exe	109
PID 3132 wrote to memory of 1060	3132	dllhost.exe	110
PID 1060 wrote to memory of 1352	1060	cmd.exe	112
PID 3132 wrote to memory of 4848	3132	dllhost.exe	113
PID 4848 wrote to memory of 2388	4848	cmd.exe	115
PID 3132 wrote to memory of 2548	3132	dllhost.exe	116
PID 2548 wrote to memory of 4456	2548	cmd.exe	118
PID 3132 wrote to memory of 1232	3132	dllhost.exe	119
PID 1232 wrote to memory of 6088	1232	cmd.exe	121
PID 4608 wrote to memory of 4720	4608	dllhost.exe	123
PID 4720 wrote to memory of 2240	4720	cmd.exe	125
PID 4608 wrote to memory of 3336	4608	dllhost.exe	126
PID 3336 wrote to memory of 1244	3336	cmd.exe	128
PID 3132 wrote to memory of 3976	3132	dllhost.exe	129
PID 3976 wrote to memory of 2468	3976	cmd.exe	131
PID 3132 wrote to memory of 5984	3132	dllhost.exe	132
PID 5984 wrote to memory of 4224	5984	cmd.exe	134
PID 3132 wrote to memory of 2956	3132	dllhost.exe	135
PID 2956 wrote to memory of 2356	2956	cmd.exe	137
PID 3132 wrote to memory of 2980	3132	dllhost.exe	138
PID 2980 wrote to memory of 3000	2980	cmd.exe	140
PID 3132 wrote to memory of 3196	3132	dllhost.exe	141
PID 3196 wrote to memory of 3300	3196	cmd.exe	143
PID 3132 wrote to memory of 5276	3132	dllhost.exe	144
PID 5276 wrote to memory of 2268	5276	cmd.exe	146
PID 3132 wrote to memory of 3388	3132	dllhost.exe	147
PID 3388 wrote to memory of 3392	3388	cmd.exe	149
PID 3132 wrote to memory of 2904	3132	dllhost.exe	150
PID 2904 wrote to memory of 4704	2904	cmd.exe	152
PID 3132 wrote to memory of 4120	3132	dllhost.exe	153
PID 4120 wrote to memory of 3188	4120	cmd.exe	155
PID 3132 wrote to memory of 2144	3132	dllhost.exe	156
PID 2144 wrote to memory of 2796	2144	cmd.exe	158
PID 3132 wrote to memory of 4312	3132	dllhost.exe	159
PID 4312 wrote to memory of 1860	4312	cmd.exe	161
PID 3132 wrote to memory of 2432	3132	dllhost.exe	162
PID 2432 wrote to memory of 6028	2432	cmd.exe	164
PID 3132 wrote to memory of 5704	3132	dllhost.exe	165
PID 5704 wrote to memory of 1080	5704	cmd.exe	167
PID 3132 wrote to memory of 3168	3132	dllhost.exe	168
PID 3168 wrote to memory of 4896	3168	cmd.exe	170
PID 3132 wrote to memory of 3812	3132	dllhost.exe	171
PID 3812 wrote to memory of 5568	3812	cmd.exe	173
PID 3132 wrote to memory of 4976	3132	dllhost.exe	174
PID 5132 wrote to memory of 4320	5132	Audiodg.exe	176
PID 4976 wrote to memory of 2656	4976	cmd.exe	178
PID 4320 wrote to memory of 2228	4320	cmd.exe	179
PID 5132 wrote to memory of 2544	5132	Audiodg.exe	180
PID 2544 wrote to memory of 5100	2544	cmd.exe	182
PID 3132 wrote to memory of 5428	3132	dllhost.exe	183
PID 5428 wrote to memory of 2132	5428	cmd.exe	185
PID 3132 wrote to memory of 3252	3132	dllhost.exe	186
PID 3252 wrote to memory of 824	3252	cmd.exe	188
PID 3132 wrote to memory of 1456	3132	dllhost.exe	189
PID 1456 wrote to memory of 3940	1456	cmd.exe	191

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NOUACuy5kdvf1v1255z4l.exe
"C:\Users\Admin\AppData\Local\Temp\NOUACuy5kdvf1v1255z4l.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="r,qBcf8-cq2)ch" dir=in action=allow program="C:\Windows\dllhost.exe" enable=yes & exit
  2⤵
  PID:4596
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:480
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5696
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1932
- C:\Windows\dllhost.exe
  "C:\Windows\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:932
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4400
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1352
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2388
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4456
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6088
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2468
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5984
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4224
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2356
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3000
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3300
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5276
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2268
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3392
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4704
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3188
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2796
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1860
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6028
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1080
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4896
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5568
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2656
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5428
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2132
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:824
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3940
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4696
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1544
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4836
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5332
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1508
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3416
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:544
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2780
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:296
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5944
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:420
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4296
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2512
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2964
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5612
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4644
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2180
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5268
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2268
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3208
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1664
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5296
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2820
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3204
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3316
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3268

C:\Windows\dllhost.exe
C:\Windows\dllhost.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2240
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1244

C:\Windows\Audiodg.exe
C:\Windows\Audiodg.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2228
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dllhost.exe

Path C:\Windows\dllhost.exe
Size 374KB
SHA256 271b738791619b89212e47caa12d2b544f1bf973cba6ecac4436befe2f339354
MD5 c9fa8ae47807a62b52a171818e013643
SHA1 0cf84907fcdd435ae063b96db2b3c503b3ce55a7
SHA512 adf3f86cd39814c4f0f31d402bca1dc7e2e1f388e28cdde2c561ae1ac9e73d8338d9e23dc3103d697842a730953206eaa7b097f811410f476ffa2242fcda51ed
SSDEEP 6144:+6HjoWceTstqlkgor5eKIoN25y8+8eeFCuvozc39pRL0D5bO69CN5aXiS5:+BGshBkeeF8ctpR0DosXiS5
TLSH
T16A84B4247F988A09E590297E415E5A11C7DA91F222327303370BFF615D89DDEEE2C3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4864-0-0x0000019D76790000-0x0000019D767F4000-memory.dmp

Download

memory/4864-1-0x00007FFAD210F000-0x00007FFAD2110000-memory.dmp

Download

memory/4864-2-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/4864-3-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/4864-4-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/4864-5-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/4864-6-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/4864-7-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/4864-70-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/4864-69-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/4864-71-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads