njrat | 3fe43f7477b6da4963b02151d796f8c63575ac99c4d32031360daf6d9ef93769

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 21:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rooted.exe
Size 991KB
Sample260809-ztplrawamc
SHA256 3fe43f7477b6da4963b02151d796f8c63575ac99c4d32031360daf6d9ef93769
MD5 442e1ca969ec94e2a8549837c734ce0c
SHA1 94256ba518e900fe8c361318cdf569d0adb78ae6
SHA512 9639c155bf8533ae1855f84e58f0af3c8d123e49496cca5d7db1257b0a3d7da4590910ee8a3d06b7cc35f09e3b844816280521c311f88e4e6cd83e723c836eb6
SSDEEP 12288:qAjIaqAg8GxPTGspbnEsujK9o7yp1yyY+6Dfg6/5/gVziHlBrCbYi8I:qxIPiPiGbiGUyp1TKk0Xbu
TLSH
T1DA259F1BF762219AE0E952786DD75F09AF71B0FA1B10569F1F79382C2D13BA08E167C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

njrat trojan

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
4496	bueo2bcr.2xw.exe

Loads dropped DLL 1 IoCs

pid	Process
4980	Rooted.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={CA9429C2-6916-4B03-AC98-93B0F8ECFE4A}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018C017D8351653"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1786309274"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 09 Aug 2026 04:04:09 GMT"	OfficeClickToRun.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe
4496	bueo2bcr.2xw.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1364	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	Rooted.exe
Token: SeDebugPrivilege	4496	bueo2bcr.2xw.exe
Token: SeAssignPrimaryTokenPrivilege	3640	svchost.exe
Token: SeIncreaseQuotaPrivilege	3640	svchost.exe
Token: SeSecurityPrivilege	3640	svchost.exe
Token: SeTakeOwnershipPrivilege	3640	svchost.exe
Token: SeLoadDriverPrivilege	3640	svchost.exe
Token: SeSystemtimePrivilege	3640	svchost.exe
Token: SeBackupPrivilege	3640	svchost.exe
Token: SeRestorePrivilege	3640	svchost.exe
Token: SeShutdownPrivilege	3640	svchost.exe
Token: SeSystemEnvironmentPrivilege	3640	svchost.exe
Token: SeUndockPrivilege	3640	svchost.exe
Token: SeManageVolumePrivilege	3640	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3640	svchost.exe
Token: SeIncreaseQuotaPrivilege	3640	svchost.exe
Token: SeSecurityPrivilege	3640	svchost.exe
Token: SeTakeOwnershipPrivilege	3640	svchost.exe
Token: SeLoadDriverPrivilege	3640	svchost.exe
Token: SeSystemtimePrivilege	3640	svchost.exe
Token: SeBackupPrivilege	3640	svchost.exe
Token: SeRestorePrivilege	3640	svchost.exe
Token: SeShutdownPrivilege	3640	svchost.exe
Token: SeSystemEnvironmentPrivilege	3640	svchost.exe
Token: SeUndockPrivilege	3640	svchost.exe
Token: SeManageVolumePrivilege	3640	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3640	svchost.exe
Token: SeIncreaseQuotaPrivilege	3640	svchost.exe
Token: SeSecurityPrivilege	3640	svchost.exe
Token: SeTakeOwnershipPrivilege	3640	svchost.exe
Token: SeLoadDriverPrivilege	3640	svchost.exe
Token: SeSystemtimePrivilege	3640	svchost.exe
Token: SeBackupPrivilege	3640	svchost.exe
Token: SeRestorePrivilege	3640	svchost.exe
Token: SeShutdownPrivilege	3640	svchost.exe
Token: SeSystemEnvironmentPrivilege	3640	svchost.exe
Token: SeUndockPrivilege	3640	svchost.exe
Token: SeManageVolumePrivilege	3640	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3640	svchost.exe
Token: SeIncreaseQuotaPrivilege	3640	svchost.exe
Token: SeSecurityPrivilege	3640	svchost.exe
Token: SeTakeOwnershipPrivilege	3640	svchost.exe
Token: SeLoadDriverPrivilege	3640	svchost.exe
Token: SeSystemtimePrivilege	3640	svchost.exe
Token: SeBackupPrivilege	3640	svchost.exe
Token: SeRestorePrivilege	3640	svchost.exe
Token: SeShutdownPrivilege	3640	svchost.exe
Token: SeSystemEnvironmentPrivilege	3640	svchost.exe
Token: SeUndockPrivilege	3640	svchost.exe
Token: SeManageVolumePrivilege	3640	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3640	svchost.exe
Token: SeIncreaseQuotaPrivilege	3640	svchost.exe
Token: SeSecurityPrivilege	3640	svchost.exe
Token: SeTakeOwnershipPrivilege	3640	svchost.exe
Token: SeLoadDriverPrivilege	3640	svchost.exe
Token: SeSystemtimePrivilege	3640	svchost.exe
Token: SeBackupPrivilege	3640	svchost.exe
Token: SeRestorePrivilege	3640	svchost.exe
Token: SeShutdownPrivilege	3640	svchost.exe
Token: SeSystemEnvironmentPrivilege	3640	svchost.exe
Token: SeUndockPrivilege	3640	svchost.exe
Token: SeManageVolumePrivilege	3640	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3640	svchost.exe
Token: SeIncreaseQuotaPrivilege	3640	svchost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1364	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4496	4980	Rooted.exe	88
PID 4496 wrote to memory of 756	4496	bueo2bcr.2xw.exe	5
PID 4496 wrote to memory of 988	4496	bueo2bcr.2xw.exe	9
PID 4496 wrote to memory of 996	4496	bueo2bcr.2xw.exe	10
PID 4496 wrote to memory of 1008	4496	bueo2bcr.2xw.exe	11
PID 4496 wrote to memory of 1040	4496	bueo2bcr.2xw.exe	13
PID 4496 wrote to memory of 1188	4496	bueo2bcr.2xw.exe	14
PID 4496 wrote to memory of 1256	4496	bueo2bcr.2xw.exe	15
PID 4496 wrote to memory of 1304	4496	bueo2bcr.2xw.exe	16
PID 4496 wrote to memory of 1348	4496	bueo2bcr.2xw.exe	17
PID 4496 wrote to memory of 1412	4496	bueo2bcr.2xw.exe	18
PID 4496 wrote to memory of 1492	4496	bueo2bcr.2xw.exe	20
PID 4496 wrote to memory of 1500	4496	bueo2bcr.2xw.exe	21
PID 4496 wrote to memory of 1608	4496	bueo2bcr.2xw.exe	22
PID 4496 wrote to memory of 1640	4496	bueo2bcr.2xw.exe	23
PID 4496 wrote to memory of 1660	4496	bueo2bcr.2xw.exe	24
PID 4496 wrote to memory of 1704	4496	bueo2bcr.2xw.exe	25
PID 4496 wrote to memory of 1772	4496	bueo2bcr.2xw.exe	26
PID 4496 wrote to memory of 1868	4496	bueo2bcr.2xw.exe	27
PID 4496 wrote to memory of 1360	4496	bueo2bcr.2xw.exe	29
PID 4496 wrote to memory of 1480	4496	bueo2bcr.2xw.exe	30
PID 4496 wrote to memory of 1600	4496	bueo2bcr.2xw.exe	31
PID 4496 wrote to memory of 2164	4496	bueo2bcr.2xw.exe	32
PID 4496 wrote to memory of 2200	4496	bueo2bcr.2xw.exe	33
PID 4496 wrote to memory of 2256	4496	bueo2bcr.2xw.exe	34
PID 4496 wrote to memory of 2360	4496	bueo2bcr.2xw.exe	35
PID 4496 wrote to memory of 2412	4496	bueo2bcr.2xw.exe	36
PID 4496 wrote to memory of 2512	4496	bueo2bcr.2xw.exe	37
PID 4496 wrote to memory of 2612	4496	bueo2bcr.2xw.exe	38
PID 4496 wrote to memory of 2620	4496	bueo2bcr.2xw.exe	39
PID 4496 wrote to memory of 2640	4496	bueo2bcr.2xw.exe	40
PID 4496 wrote to memory of 2652	4496	bueo2bcr.2xw.exe	41
PID 4496 wrote to memory of 2944	4496	bueo2bcr.2xw.exe	42
PID 4496 wrote to memory of 3016	4496	bueo2bcr.2xw.exe	43
PID 4496 wrote to memory of 2224	4496	bueo2bcr.2xw.exe	44
PID 4496 wrote to memory of 3084	4496	bueo2bcr.2xw.exe	45
PID 4496 wrote to memory of 3148	4496	bueo2bcr.2xw.exe	46
PID 4496 wrote to memory of 3216	4496	bueo2bcr.2xw.exe	48
PID 4496 wrote to memory of 3476	4496	bueo2bcr.2xw.exe	50
PID 4496 wrote to memory of 3540	4496	bueo2bcr.2xw.exe	51
PID 4496 wrote to memory of 3600	4496	bueo2bcr.2xw.exe	52
PID 4496 wrote to memory of 3608	4496	bueo2bcr.2xw.exe	53
PID 4496 wrote to memory of 3616	4496	bueo2bcr.2xw.exe	54
PID 4496 wrote to memory of 3640	4496	bueo2bcr.2xw.exe	55
PID 4496 wrote to memory of 3664	4496	bueo2bcr.2xw.exe	56
PID 4496 wrote to memory of 3308	4496	bueo2bcr.2xw.exe	57
PID 4496 wrote to memory of 1784	4496	bueo2bcr.2xw.exe	58
PID 4496 wrote to memory of 4352	4496	bueo2bcr.2xw.exe	59
PID 4496 wrote to memory of 4412	4496	bueo2bcr.2xw.exe	60
PID 4496 wrote to memory of 4460	4496	bueo2bcr.2xw.exe	61
PID 4496 wrote to memory of 4704	4496	bueo2bcr.2xw.exe	62
PID 4496 wrote to memory of 4712	4496	bueo2bcr.2xw.exe	63
PID 4496 wrote to memory of 4176	4496	bueo2bcr.2xw.exe	64
PID 4496 wrote to memory of 5176	4496	bueo2bcr.2xw.exe	65
PID 4496 wrote to memory of 5244	4496	bueo2bcr.2xw.exe	66
PID 4496 wrote to memory of 5288	4496	bueo2bcr.2xw.exe	67
PID 4496 wrote to memory of 5568	4496	bueo2bcr.2xw.exe	70
PID 4496 wrote to memory of 2928	4496	bueo2bcr.2xw.exe	72
PID 4496 wrote to memory of 2888	4496	bueo2bcr.2xw.exe	74
PID 4496 wrote to memory of 3688	4496	bueo2bcr.2xw.exe	75
PID 4496 wrote to memory of 2068	4496	bueo2bcr.2xw.exe	78
PID 4496 wrote to memory of 3440	4496	bueo2bcr.2xw.exe	79
PID 4496 wrote to memory of 4268	4496	bueo2bcr.2xw.exe	80
PID 4496 wrote to memory of 1364	4496	bueo2bcr.2xw.exe	81

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:756
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:988
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1188

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:996

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b3016338-ae67-4bd4-9dda-b4da3f8537ae -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3288c85e-833a-45c1-924a-fe41a132646a -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ca9fe4db-8fb1-4210-b61a-2d5634833290 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b37176f3-81d2-471c-95d6-2022e94cff80 -LifetimeId:3b924d1b-80a7-4236-9c8a-6da1c4e6d3a2 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:1640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1480
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:4268
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of UnmapMainImage
    PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\Rooted.exe
      "C:\Users\Admin\AppData\Local\Temp\Rooted.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\bueo2bcr.2xw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bueo2bcr.2xw.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2512
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:4176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:3016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2224

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3216

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1784

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4352

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4704

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4712

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5176

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5244

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:2928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2068

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2772

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bueo2bcr.2xw.exe

Path C:\Users\Admin\AppData\Local\Temp\bueo2bcr.2xw.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iKTzc.dll

Path C:\Users\Admin\AppData\Local\Temp\iKTzc.dll
Size 112KB
SHA256 47578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed
MD5 2f1a50031dcf5c87d92e8b2491fdcea6
SHA1 71e2aaa2d1bb7dbe32a00e1d01d744830ecce08f
SHA512 1c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8
SSDEEP 3072:LrNI5AiELn1Sf6T2JFRwkzDyc69rJMWI/S:LBIcA3JFR2rkK
TLSH
T1DCB35B1BB7E500BBE1768239C8635A06D776F8120621DB6F03A4469A1F733919D3FF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-24-0x0000023729FB0000-0x0000023729FD5000-memory.dmp

Download

memory/756-25-0x000002372B000000-0x000002372B02B000-memory.dmp

Download

memory/756-26-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/756-284-0x000002372B000000-0x000002372B02B000-memory.dmp

Download

memory/988-29-0x00000182804E0000-0x000001828050B000-memory.dmp

Download

memory/988-30-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/988-285-0x00000182804E0000-0x000001828050B000-memory.dmp

Download

memory/996-286-0x000001D8E4EB0000-0x000001D8E4EDB000-memory.dmp

Download

memory/996-33-0x000001D8E4EB0000-0x000001D8E4EDB000-memory.dmp

Download

memory/996-34-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1008-291-0x000001CB7DA30000-0x000001CB7DA5B000-memory.dmp

Download

memory/1008-111-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1008-110-0x000001CB7DA30000-0x000001CB7DA5B000-memory.dmp

Download

memory/1040-113-0x000002AF2DFA0000-0x000002AF2DFCB000-memory.dmp

Download

memory/1040-114-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1040-292-0x000002AF2DFA0000-0x000002AF2DFCB000-memory.dmp

Download

memory/1188-287-0x0000020A55EB0000-0x0000020A55EDB000-memory.dmp

Download

memory/1188-39-0x0000020A55EB0000-0x0000020A55EDB000-memory.dmp

Download

memory/1188-40-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1256-117-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1256-116-0x0000023ACB0D0000-0x0000023ACB0FB000-memory.dmp

Download

memory/1304-120-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1304-119-0x00000269DF000000-0x00000269DF02B000-memory.dmp

Download

memory/1348-122-0x000002006BDF0000-0x000002006BE1B000-memory.dmp

Download

memory/1348-123-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1360-150-0x000001512CDC0000-0x000001512CDEB000-memory.dmp

Download

memory/1360-151-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1364-290-0x00000000035B0000-0x00000000035DB000-memory.dmp

Download

memory/1364-105-0x00000000035B0000-0x00000000035DB000-memory.dmp

Download

memory/1364-106-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1412-127-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1412-126-0x0000026C6D520000-0x0000026C6D54B000-memory.dmp

Download

memory/1480-153-0x0000014CF9310000-0x0000014CF933B000-memory.dmp

Download

memory/1480-154-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1492-130-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1492-129-0x000001752A150000-0x000001752A17B000-memory.dmp

Download

memory/1500-49-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1500-288-0x00000151D6EB0000-0x00000151D6EDB000-memory.dmp

Download

memory/1500-48-0x00000151D6EB0000-0x00000151D6EDB000-memory.dmp

Download

memory/1600-161-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1600-159-0x00000149FDE20000-0x00000149FDE4B000-memory.dmp

Download

memory/1608-132-0x0000020200450000-0x000002020047B000-memory.dmp

Download

memory/1608-133-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1640-135-0x00000297109E0000-0x0000029710A0B000-memory.dmp

Download

memory/1640-136-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1660-139-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1660-138-0x0000023B50DF0000-0x0000023B50E1B000-memory.dmp

Download

memory/1704-143-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1704-142-0x000001CA692A0000-0x000001CA692CB000-memory.dmp

Download

memory/1772-145-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1772-141-0x0000022A6ACA0000-0x0000022A6ACCB000-memory.dmp

Download

memory/1868-148-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/1868-147-0x000002A749410000-0x000002A74943B000-memory.dmp

Download

memory/2164-156-0x0000021E486D0000-0x0000021E486FB000-memory.dmp

Download

memory/2164-157-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/2200-163-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/2200-160-0x0000023AABEF0000-0x0000023AABF1B000-memory.dmp

Download

memory/2256-165-0x0000011EC0D30000-0x0000011EC0D5B000-memory.dmp

Download

memory/2256-166-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/2360-169-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/2360-168-0x0000016980FA0000-0x0000016980FCB000-memory.dmp

Download

memory/2412-171-0x000002087B4B0000-0x000002087B4DB000-memory.dmp

Download

memory/2412-172-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/2512-174-0x0000024613A30000-0x0000024613A5B000-memory.dmp

Download

memory/2512-175-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/2612-177-0x000002A657F40000-0x000002A657F6B000-memory.dmp

Download

memory/2612-178-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/2620-180-0x000001AC35A00000-0x000001AC35A2B000-memory.dmp

Download

memory/4176-289-0x0000026BD6C80000-0x0000026BD6CAB000-memory.dmp

Download

memory/4176-92-0x00007FFCD8360000-0x00007FFCD8370000-memory.dmp

Download

memory/4176-91-0x0000026BD6C80000-0x0000026BD6CAB000-memory.dmp

Download

memory/4496-17-0x00007FFD17470000-0x00007FFD17537000-memory.dmp

Download

memory/4496-14-0x00007FFD18220000-0x00007FFD18483000-memory.dmp

Download

memory/4980-0-0x00007FFCF55BF000-0x00007FFCF55C0000-memory.dmp

Download

memory/4980-5-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4980-293-0x00000148DAD80000-0x00000148DAD90000-memory.dmp

Download

memory/4980-23-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4980-125-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4980-19-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4980-283-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4980-16-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4980-6-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4980-15-0x00000148F37D0000-0x00000148F389C000-memory.dmp

Download

memory/4980-3-0x00000148D94A0000-0x00000148D94CC000-memory.dmp

Download

memory/4980-2-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4980-1-0x00000148D8DC0000-0x00000148D8EBE000-memory.dmp

Download

memory/4980-313-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4980-314-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4980-315-0x00000148DAD80000-0x00000148DAD90000-memory.dmp

Download