solaris_loader | 87d2052c1a961cf20137e158b32965ace9f1d85c3bd9744624ec0bd9346aed1b

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 08:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87d2052c1a961cf20137e158b32965ace9f1d85c3bd9744624ec0bd9346aed1b.exe
Size 14.4MB
Sample260820-krcf3stanb
SHA256 87d2052c1a961cf20137e158b32965ace9f1d85c3bd9744624ec0bd9346aed1b
MD5 e15381964ab8a89effec8c6aa724b138
SHA1 4ce1468b5a2aea310d0f9cb89a3b69903f554aeb
SHA512 4ab393fb5a4c9af4228d58930172b0c328f7b69bae256972084c8d84e91d3a9d90c6555514a9df64fd9ddbc4bd0047143b4529b223275a7ebc384b3f8525c10f
SSDEEP 393216:5N1wS5eHly8k3QDCvhwJIb8qvcwMeg/p/V:XaSSvk37R8Pigh/
TLSH
T1C3E6337391E178E4E091923FE8D68B075F27BE31B238EF4D627291714E692823E75670
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

run discovery downloader execution solaris_loader stealc svcstealer installer loader persistence stealer

Malware Config

Extracted

Family

solaris_loader

196.251.107.186
192.162.199.186
196.251.107.163

Extracted

Family

stealc

Botnet

http://196.251.107.163

rc4.plain

Extracted

Family

svcstealer

http://196.251.107.186/acovp/post.php
http://192.162.199.186/usovp/post.php
http://196.251.107.163/bioxp/post.php

Attributes

build_id
Dropped
srv_delay
1
srv_retry
1

Signatures

Family: SolarisLoader
SolarisLoader is a Windows loader written in C.
loader solaris_loader
Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Downloads MZ/PE file 3 IoCs

flow	pid	Process
85	2460	dyxevgrs.exe
94	3136	Explorer.EXE
6	4788	jrz8h7g1.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	87d2052c1a961cf20137e158b32965ace9f1d85c3bd9744624ec0bd9346aed1b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	rb4gq3vx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	dyxevgrs.exe

Executes dropped EXE 19 IoCs

pid	Process
4552	cm5xy2ev.exe
1648	rb4gq3vx.exe
4788	jrz8h7g1.exe
4516	e7jsfge5.exe
3344	cm5xy2ev.tmp
3212	tbsqp.exe
2460	dyxevgrs.exe
3632	wlrmdr.exe
380	tbsqp.exe
2432	b1xx2wan.exe
3940	edefdfdaac.exe
1816	b1xx2wan.exe
1872	tbsqp.exe
176	lykfog0r.exe
644	diaghubcom.exe
1840	8FA.tmp.exe
520	odran.exe
704	odran.exe
536	tbsqp.exe

Loads dropped DLL 1 IoCs

pid	Process
3344	cm5xy2ev.tmp

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\edefdfdaac = "\"C:\\ProgramData\\edefdfdaac.exe\""	b1xx2wan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\edefdfdaac = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\b1xx2wan.exe\""	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\edefdfdaac = "\"C:\\ProgramData\\edefdfdaac.exe\""	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\diaghubcom.exe"	lykfog0r.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\odran.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Nifioh\\odran.exe"	odran.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Component Manager = "C:\\Users\\Admin\\AppData\\Roaming\\hygcx\\tbsqp.exe"	rb4gq3vx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1540	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cm5xy2ev.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cm5xy2ev.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x0009000000024311-5.dat	innosetup
behavioral1/memory/4552-7-0x0000000000040000-0x0000000000146000-memory.dmp	innosetup
behavioral1/memory/4552-99-0x0000000000040000-0x0000000000146000-memory.dmp	innosetup

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	dyxevgrs.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4788	jrz8h7g1.exe
4788	jrz8h7g1.exe
1648	rb4gq3vx.exe
1648	rb4gq3vx.exe
3212	tbsqp.exe
3212	tbsqp.exe
2460	dyxevgrs.exe
2460	dyxevgrs.exe
380	tbsqp.exe
380	tbsqp.exe
2432	b1xx2wan.exe
2432	b1xx2wan.exe
1872	tbsqp.exe
1872	tbsqp.exe
520	odran.exe
520	odran.exe
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3136	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeDebugPrivilege	1648	rb4gq3vx.exe
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeDebugPrivilege	3212	tbsqp.exe
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeDebugPrivilege	380	tbsqp.exe
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeDebugPrivilege	1872	tbsqp.exe
Token: SeShutdownPrivilege	3616	RuntimeBroker.exe
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeSecurityPrivilege	1840	8FA.tmp.exe
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3616	RuntimeBroker.exe
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 4552	1544	87d2052c1a961cf20137e158b32965ace9f1d85c3bd9744624ec0bd9346aed1b.exe	85
PID 1544 wrote to memory of 1648	1544	87d2052c1a961cf20137e158b32965ace9f1d85c3bd9744624ec0bd9346aed1b.exe	86
PID 1648 wrote to memory of 628	1648	rb4gq3vx.exe	87
PID 1544 wrote to memory of 4788	1544	87d2052c1a961cf20137e158b32965ace9f1d85c3bd9744624ec0bd9346aed1b.exe	89
PID 1544 wrote to memory of 4516	1544	87d2052c1a961cf20137e158b32965ace9f1d85c3bd9744624ec0bd9346aed1b.exe	90
PID 4788 wrote to memory of 2956	4788	jrz8h7g1.exe	51
PID 4788 wrote to memory of 3020	4788	jrz8h7g1.exe	53
PID 4788 wrote to memory of 3136	4788	jrz8h7g1.exe	56
PID 4788 wrote to memory of 3616	4788	jrz8h7g1.exe	60
PID 4788 wrote to memory of 3860	4788	jrz8h7g1.exe	62
PID 4788 wrote to memory of 3380	4788	jrz8h7g1.exe	65
PID 1648 wrote to memory of 2212	1648	rb4gq3vx.exe	91
PID 1648 wrote to memory of 4056	1648	rb4gq3vx.exe	93
PID 3136 wrote to memory of 4736	3136	Explorer.EXE
PID 3136 wrote to memory of 1988	3136	Explorer.EXE
PID 1648 wrote to memory of 3136	1648	rb4gq3vx.exe	56
PID 1648 wrote to memory of 3136	1648	rb4gq3vx.exe	56
PID 4552 wrote to memory of 3344	4552	cm5xy2ev.exe	97
PID 3212 wrote to memory of 3940	3212	tbsqp.exe	99
PID 3212 wrote to memory of 3136	3212	tbsqp.exe	56
PID 3212 wrote to memory of 3136	3212	tbsqp.exe	56
PID 3136 wrote to memory of 2460	3136	Explorer.EXE	103
PID 2460 wrote to memory of 2956	2460	dyxevgrs.exe	51
PID 2460 wrote to memory of 3136	2460	dyxevgrs.exe	56
PID 2460 wrote to memory of 3616	2460	dyxevgrs.exe	60
PID 2460 wrote to memory of 3860	2460	dyxevgrs.exe	62
PID 2460 wrote to memory of 3380	2460	dyxevgrs.exe	65
PID 3136 wrote to memory of 1244	3136	Explorer.EXE
PID 380 wrote to memory of 1972	380	tbsqp.exe	110
PID 380 wrote to memory of 3136	380	tbsqp.exe	56
PID 380 wrote to memory of 3136	380	tbsqp.exe	56
PID 1544 wrote to memory of 2432	1544	87d2052c1a961cf20137e158b32965ace9f1d85c3bd9744624ec0bd9346aed1b.exe	120
PID 2432 wrote to memory of 3136	2432	b1xx2wan.exe	56
PID 3136 wrote to memory of 4764	3136	Explorer.EXE
PID 3136 wrote to memory of 4372	3136	Explorer.EXE
PID 1872 wrote to memory of 4924	1872	tbsqp.exe	129
PID 1872 wrote to memory of 3136	1872	tbsqp.exe	56
PID 1872 wrote to memory of 3136	1872	tbsqp.exe	56
PID 2460 wrote to memory of 176	2460	dyxevgrs.exe	133
PID 3136 wrote to memory of 5072	3136	Explorer.EXE
PID 3136 wrote to memory of 1840	3136	Explorer.EXE	136
PID 1840 wrote to memory of 520	1840	8FA.tmp.exe	137
PID 520 wrote to memory of 3136	520	odran.exe	56
PID 1840 wrote to memory of 1540	1840	8FA.tmp.exe	138
PID 3136 wrote to memory of 3688	3136	Explorer.EXE
PID 536 wrote to memory of 1816	536	tbsqp.exe	147
PID 536 wrote to memory of 3136	536	tbsqp.exe	56
PID 536 wrote to memory of 3136	536	tbsqp.exe	56

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2956

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3020

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Downloads MZ/PE file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Users\Admin\AppData\Local\Temp\87d2052c1a961cf20137e158b32965ace9f1d85c3bd9744624ec0bd9346aed1b.exe
  "C:\Users\Admin\AppData\Local\Temp\87d2052c1a961cf20137e158b32965ace9f1d85c3bd9744624ec0bd9346aed1b.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Users\Admin\AppData\Local\Temp\cm5xy2ev.exe
    C:\Users\Admin\AppData\Local\Temp\cm5xy2ev.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\is-FZUPAGLBEH.tmp\cm5xy2ev.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-FZUPAGLBEH.tmp\cm5xy2ev.tmp" /SL5="$5015A,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\cm5xy2ev.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3344
- - C:\Users\Admin\AppData\Local\Temp\rb4gq3vx.exe
    "C:\Users\Admin\AppData\Local\Temp\rb4gq3vx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
      4⤵
      PID:628
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security Scanner"
      4⤵
      PID:2212
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security Scanner" /tr "C:\Users\Admin\AppData\Roaming\hygcx\tbsqp.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4056
- - C:\Users\Admin\AppData\Local\Temp\jrz8h7g1.exe
    "C:\Users\Admin\AppData\Local\Temp\jrz8h7g1.exe"
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4788
- - C:\Users\Admin\AppData\Local\Temp\e7jsfge5.exe
    C:\Users\Admin\AppData\Local\Temp\e7jsfge5.exe
    3⤵
    - Executes dropped EXE
    PID:4516
- - C:\Users\Admin\AppData\Local\Temp\b1xx2wan.exe
    "C:\Users\Admin\AppData\Local\Temp\b1xx2wan.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2432
- C:\Users\Admin\AppData\Local\Temp\dyxevgrs.exe
  "C:\Users\Admin\AppData\Local\Temp\dyxevgrs.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Users\Admin\AppData\Local\Temp\lykfog0r.exe
    "C:\Users\Admin\AppData\Local\Temp\lykfog0r.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:176
- C:\Users\Admin\AppData\Local\Temp\8FA.tmp.exe
  C:\Users\Admin\AppData\Local\Temp\8FA.tmp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Users\Admin\AppData\Roaming\Nifioh\odran.exe
    "C:\Users\Admin\AppData\Roaming\Nifioh\odran.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:520
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp53e286ac.bat"
    3⤵
    - Executes a command shell one-liner
    PID:1540

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3616

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3860

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3380

C:\Users\Admin\AppData\Roaming\hygcx\tbsqp.exe
C:\Users\Admin\AppData\Roaming\hygcx\tbsqp.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\system32\schtasks.exe
  schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
  2⤵
  PID:3940

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
1⤵
- Executes dropped EXE
PID:3632

C:\Users\Admin\AppData\Roaming\hygcx\tbsqp.exe
C:\Users\Admin\AppData\Roaming\hygcx\tbsqp.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\system32\schtasks.exe
  schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
  2⤵
  PID:1972

C:\ProgramData\edefdfdaac.exe
"C:\ProgramData\edefdfdaac.exe"
1⤵
- Executes dropped EXE
PID:3940

C:\Users\Admin\AppData\Local\Temp\b1xx2wan.exe
"C:\Users\Admin\AppData\Local\Temp\b1xx2wan.exe"
1⤵
- Executes dropped EXE
PID:1816

C:\Users\Admin\AppData\Roaming\hygcx\tbsqp.exe
C:\Users\Admin\AppData\Roaming\hygcx\tbsqp.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\system32\schtasks.exe
  schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
  2⤵
  PID:4924

C:\Users\Admin\AppData\Roaming\diaghubcom.exe
C:\Users\Admin\AppData\Roaming\diaghubcom.exe
1⤵
- Executes dropped EXE
PID:644

C:\Users\Admin\AppData\Roaming\Nifioh\odran.exe
C:\Users\Admin\AppData\Roaming\Nifioh\odran.exe
1⤵
- Executes dropped EXE
PID:704

C:\Users\Admin\AppData\Roaming\hygcx\tbsqp.exe
C:\Users\Admin\AppData\Roaming\hygcx\tbsqp.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\system32\schtasks.exe
  schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
  2⤵
  PID:1816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8FA.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\8FA.tmp.exe
Size 212KB
SHA256 7832317094e8026f060673379f02dc898b655bf805f34e3f28084648cd731a14
MD5 d829e21c7046a6531ac01da09dd1e509
SHA1 0fd3e5665dc6af236d05fc952b65b74be9a358de
SHA512 a12bfefe55ed63ed037cabb495845232cf298399735f21c7c3649bfc36ed2e668095b4e154d26b6c91d2cc218e384da3539a31df598e9dc66eefca4f8a80cc11
SSDEEP 3072:+LS/umYftd1ew8WiRLNSQ94fyupmImVhyCn26WOFz0lkAPxETc7rRxjytj:ECNEN8WENSQefyupxwhyK2loMxEOryR
TLSH
T1B6248E6BB5E45BB8F46FE235C5416A26D1B2740A1B31D38F22B48ED61F13332B22D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1xx2wan.exe

Path C:\Users\Admin\AppData\Local\Temp\b1xx2wan.exe
Size 90KB
SHA256 706409b4cfeba987355f41d23c31e047f9b1c851ccacaf49fc243a692f7a3e22
MD5 b4994740359f6302a3047feb3e6d3453
SHA1 723990132e40adab04d65fd38e15e2d3044ceeae
SHA512 e4bdd846611147115d00368b28ce8d2d100cc4934c8000913b5bde137130ba3681d411d5f2119a68c93980770e913fe2654bdedd88dcbe3ea467724d41450254
SSDEEP 1536:/Dq9NyTUi+O2IOiJ3hP51h/SeDIiG0hL47okrNTWIxUtGsNTfqroYD4c76j:/Dq99jwx51xhDJXL4DrNTWoU7rqrfD41
TLSH
T1D293CFA7279414F5D9AAD678D5A18F23F2F3B8894A15871F03B8C9852F23362723D707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cm5xy2ev.exe

Path C:\Users\Admin\AppData\Local\Temp\cm5xy2ev.exe
Size 13.1MB
SHA256 42d3f82fdc329abbfea289482b70b0a93adee02963306d6680cc047140dd794a
MD5 988c557adf7da2bb023305f07c5cceac
SHA1 8e32ccb260cb531aa8de8c9f585bc765841d566a
SHA512 a73835bd2ef2131a22da20d0121681a65e5dcdaa39afdb564041e61e5e4af50d0fad69a1f7fffa177b7d85249eb2338d9465383ce1c00d0443318215422796e1
SSDEEP 98304:voJJqPg6ziVAQhCydt9JuQcpF4JorePYPAMo7Bmpbn5RjQC73I1jw6NeHAFMSj:6eg6zoAQXdVyyPgfo70pbngCLI1c6w
TLSH
T155D60233A189602AE06D563745B79285853B6E687C218D1DA7F03D5CFB3F3603927B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyxevgrs.exe

Path C:\Users\Admin\AppData\Local\Temp\dyxevgrs.exe
Size 54KB
SHA256 063fb02a19adefb88a47ade0eba990288e2e761f962b9fd202f286c35d579778
MD5 400f15a3759cb92c1aeb974f1576e721
SHA1 fb3b77805dfd0350370f0fd2fe494ee57c091db3
SHA512 1d884442d7aac8de0464e1b4b4d8d441a1e3ca7e9e390d11172cbd0bffa433c0bb9d65bdea8e4f20cbd24845b9eece9c0ba2383ecb63c4044c4a21c3b8d1abc0
SSDEEP 1536:InPh2MEK5ogoHuDI6jrDxtKp9f53J67N7x:MjjCeXDrKXf587NF
TLSH
T1A343F73552C642A9F8369330DEF6537FD2E8FE017922AA1F0320D91C1F97641B51AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7jsfge5.exe

Path C:\Users\Admin\AppData\Local\Temp\e7jsfge5.exe
Size 771KB
SHA256 2e76d6a4c45848c9a1bbe5ffdf3b6a17050789b50b27584b8b2ca850ee022987
MD5 51281be022faea9c9a00e0b324a11ecc
SHA1 28528684dc899c00f00a95541d767da2fe5bda55
SHA512 d277bf12f8b6b8a07bc874023eb50913b2b666760e81158e24b5de61943676a934df6de7a79b1102ee71eac30506463596788356cfb9c5eb392058b92d097aa1
SSDEEP 12288:fJmtSx7mW7LciwFZnlMf6r60dMIGyxBlDetAqxSvSc:RZ7n74iwFZlC6+6MIGybq
TLSH
T199F49D1AF7A502FCD07BC175CA524952EB72B8565330A78F03E14AA61F376A05F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-CDLFN6L617.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cm5xy2ev.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-FZUPAGLBEH.tmp\cm5xy2ev.tmp
Size 4.3MB
SHA256 8a71d9a7963fbb1904e8d43ec3aaec927c1a94ed78376baf8fdd8fa46f7533ef
MD5 33453f6a4881d9959e8f964a185e1e04
SHA1 5adb5722c611dbeceba40d753c766211bc461787
SHA512 2572420402140eec620b219d7db73e05f4ef210ffe9cc0608edd399c42ec9d1a990330bcace4653156f0f389a4d72acb77d2f6817744672d46a96bf71283a789
SSDEEP 49152:6eGyzK5YtS9+SmpPvOwUNSdi1NsF+QxvCs7F5uhJBP4ji2333DneQ:6eGwK5YHCNmi16F+QxvCeFLm2333zB
TLSH
T148267E13B688753ED4A71A3B483BA684983B7E213A11CC4B7BF42D4C9E3D740AD26757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrz8h7g1.exe

Path C:\Users\Admin\AppData\Local\Temp\jrz8h7g1.exe
Size 57KB
SHA256 eb4c2dc7db21d6a8a889c74c7b90eaac0e095205063ae3e348a400e253c6bdd8
MD5 51242d1f06d41c80ea8c6fa541be3d6e
SHA1 a01f91e44b2a59f24b9e9c72e46e2207b6f86526
SHA512 bc7bde4ea9431f0e7c5345ea9cd1da7ec2f6a27da9f0bcfbd86b15dcfb2df3f416603d29986b849668b5e85c73678b76ad518d98cdecc6b8ae504a284fd90ff6
SSDEEP 1536:sKWHka5dALVp1V8YJVqJMX0jl0w15GXC0rOB7CD:sKm5dAppRdX0jlP1wT0E
TLSH
T184433A58A6DE624DD836D4B5D6A5D333FBA3F8427235974F0132C91E0F22B26BD28E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lykfog0r.exe

Path C:\Users\Admin\AppData\Local\Temp\lykfog0r.exe
Size 166KB
SHA256 a564ca03842ac237973a6f07a1c25fb5a072d8fb7424b6ac8684888377391d9a
MD5 9f0ffb9820e62b6ef058a4cc72be5b4c
SHA1 211ff312c1ee2ef378ff2b5331bd1b7cb773af3e
SHA512 9fe5007c0d27139b43ee152264e304c2d5a8807ac8a5092344e8090eb8c093f6cd5571df498c70c7139b1d6596b6271b2e57e09358c7907a6977e6dacc347d47
SSDEEP 3072:td6/4CsQSODs98mIOWgxwlIFaKAzhDEWxrGvMvHXrb15STd:tJCsDSs98JswWaKAu8R
TLSH
T1D5F37C4A73E510FDE1378239C9551905F772782607209BAF07A04BBA9F272E1AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rb4gq3vx.exe

Path C:\Users\Admin\AppData\Local\Temp\rb4gq3vx.exe
Size 350KB
SHA256 f808b3e2570a2446b1483274e9aaf0d235580dbeacb2f129d5b52adc745a91a2
MD5 535ec55dd03c574541c9f6a5266fefad
SHA1 e2b318b2e438414f775ed35251e9e72fc2e0d7ee
SHA512 ab0cbe5ef8266218290d06b4c1583223d5b6186e180add0dee5e9d80211da36265bf13a5a0d76e638a50a202fb48c21138e81ed99e9327e4c932b73c4b74cef1
SSDEEP 6144:XVzk6qoefnPoDjo4ZYOVKS2bwJz8RmQf0WIiEnm2j7ZvINkn0srBQVkhHdZ:Xu3gDjoOktsORmQf07iSvN0hs/Z
TLSH
T12D74F147FEF035E9E12A523D84644A16E736F4BD06348E1F036C426A2F2A6D15E3AF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp53e286ac.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp53e286ac.bat
Size 193B
SHA256 fbce13181cd638dc1adea2ce88c0515e3e408eb62819b2f3f888a1c91e76a555
MD5 8927e6b71dfd4bf4271b4bb4b6fff6cd
SHA1 f408f7a026c71bc1a283aa7191a3ce38d3d159f7
SHA512 9a79c92eceae1c61e5d9df4ef29b11f88e280199b4e770c28679f29f9f4b8246cc35138b7eee17c709e36958706837fe9dd73cca0d31c532a7d158a07b303095
TLSH
T1B8C0221241C3CA59180840370AF5218DC0B909E83F8A37100320C08CB59240CF6D7301
MD5 SHA1 SHA512 TLSH

Submit Download

odran.exe

Path C:\Users\Admin\AppData\Roaming\Nifioh\odran.exe
Size 212KB
SHA256 d7619187db109767d4822cf4d63e0fb9a27de7e95d9267f812abf13e6a81ae40
MD5 98b6c14d63014c487e727158e9166c87
SHA1 e302732b79e38756790cf178611652fbc1d98f7b
SHA512 f1c588263f3b305bf0c686bcc6bf9e3ac01b38050f5eccea507fbdb2a2ddd73e965dfa0818e94e374cd4f54db4185c51a51ef4ac93470641140be4962d0ee3bb
SSDEEP 3072:+LS/umYftd1ew8WiRLNSQ94fyupmImVhyCn26WOFz0lkAPxETc7rRxjyth:ECNEN8WENSQefyupxwhyK2loMxEOryr
TLSH
T1F2248E6BB4E45BB8F46FE235C5416A26D1B2740A1B31D38F22B48ED61F13332B22D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1816-146-0x00007FF7EDC60000-0x00007FF7EDC7E000-memory.dmp

Download

memory/1816-145-0x00007FF7EDC60000-0x00007FF7EDC7E000-memory.dmp

Download

memory/1840-251-0x0000000002260000-0x00000000025B5000-memory.dmp

Download

memory/1840-241-0x00000000018E0000-0x0000000001DB0000-memory.dmp

Download

memory/1840-247-0x0000000001EF0000-0x0000000001F8B000-memory.dmp

Download

memory/1840-245-0x0000000001DF0000-0x0000000001E1B000-memory.dmp

Download

memory/1840-248-0x0000000001F90000-0x00000000020BA000-memory.dmp

Download

memory/1840-244-0x0000000001DC0000-0x0000000001DE2000-memory.dmp

Download

memory/1840-243-0x0000000001DB0000-0x0000000001DBA000-memory.dmp

Download

memory/1840-242-0x00000000016E0000-0x00000000016F8000-memory.dmp

Download

memory/1840-252-0x00000000025C0000-0x00000000025F1000-memory.dmp

Download

memory/1840-253-0x0000000002600000-0x000000000270B000-memory.dmp

Download

memory/1840-250-0x0000000002160000-0x0000000002260000-memory.dmp

Download

memory/1840-249-0x00000000020C0000-0x000000000215D000-memory.dmp

Download

memory/1840-233-0x0000000000E30000-0x000000000156F000-memory.dmp

Download

memory/1840-246-0x0000000001E50000-0x0000000001EEE000-memory.dmp

Download

memory/1840-237-0x00000000015A0000-0x00000000016CA000-memory.dmp

Download

memory/1840-236-0x0000000000CC0000-0x0000000000CC8000-memory.dmp

Download

memory/1840-238-0x0000000001710000-0x000000000177B000-memory.dmp

Download

memory/1840-230-0x0000000000B10000-0x0000000000CB1000-memory.dmp

Download

memory/1840-231-0x0000000000D20000-0x0000000000DCC000-memory.dmp

Download

memory/1840-232-0x0000000000DD0000-0x0000000000E25000-memory.dmp

Download

memory/1840-229-0x0000000000170000-0x0000000000200000-memory.dmp

Download

memory/1840-228-0x0000000000670000-0x0000000000939000-memory.dmp

Download

memory/1840-227-0x0000000000450000-0x000000000050E000-memory.dmp

Download

memory/1840-240-0x00000000016D0000-0x00000000016DC000-memory.dmp

Download

memory/1840-239-0x0000000001780000-0x00000000018D6000-memory.dmp

Download

memory/2432-128-0x00007FF7EDC60000-0x00007FF7EDC7E000-memory.dmp

Download

memory/2432-123-0x00007FF7EDC60000-0x00007FF7EDC7E000-memory.dmp

Download

memory/2956-84-0x0000027B065A0000-0x0000027B065A2000-memory.dmp

Download

memory/2956-29-0x0000027B06570000-0x0000027B06573000-memory.dmp

Download

memory/2956-37-0x0000027B06580000-0x0000027B06587000-memory.dmp

Download

memory/3020-39-0x000002A0630F0000-0x000002A0630F7000-memory.dmp

Download

memory/3136-125-0x0000000007680000-0x00000000076A5000-memory.dmp

Download

memory/3136-107-0x0000000008C40000-0x0000000008C85000-memory.dmp

Download

memory/3136-152-0x0000000007680000-0x00000000076A5000-memory.dmp

Download

memory/3136-198-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/3136-131-0x0000000007680000-0x00000000076A5000-memory.dmp

Download

memory/3136-101-0x0000000002290000-0x0000000002291000-memory.dmp

Download

memory/3136-221-0x0000000008750000-0x0000000008791000-memory.dmp

Download

memory/3136-222-0x0000000008750000-0x0000000008791000-memory.dmp

Download

memory/3136-224-0x0000000008750000-0x0000000008791000-memory.dmp

Download

memory/3136-223-0x0000000008750000-0x0000000008791000-memory.dmp

Download

memory/3136-225-0x0000000008750000-0x0000000008791000-memory.dmp

Download

memory/3136-133-0x0000000007680000-0x00000000076A5000-memory.dmp

Download

memory/3136-135-0x0000000007680000-0x00000000076A5000-memory.dmp

Download

memory/3136-136-0x0000000007680000-0x00000000076A5000-memory.dmp

Download

memory/3136-130-0x0000000007680000-0x00000000076A5000-memory.dmp

Download

memory/3136-129-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/3136-124-0x0000000007680000-0x00000000076A5000-memory.dmp

Download

memory/3136-143-0x0000000002730000-0x0000000002731000-memory.dmp

Download

memory/3136-159-0x0000000008450000-0x0000000008495000-memory.dmp

Download

memory/3136-32-0x00000000022E0000-0x00000000022E7000-memory.dmp

Download

memory/3136-132-0x0000000007680000-0x00000000076A5000-memory.dmp

Download

memory/3136-50-0x0000000002720000-0x0000000002721000-memory.dmp

Download

memory/3136-49-0x0000000002710000-0x0000000002711000-memory.dmp

Download

memory/3136-89-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/3136-73-0x00000000085D0000-0x0000000008615000-memory.dmp

Download

memory/3136-52-0x00000000027A0000-0x00000000027E0000-memory.dmp

Download

memory/3136-53-0x0000000008290000-0x00000000082D5000-memory.dmp

Download

memory/3344-100-0x0000000000230000-0x0000000000690000-memory.dmp

Download

memory/3344-154-0x0000000000230000-0x0000000000690000-memory.dmp

Download

memory/3344-111-0x0000000000230000-0x0000000000690000-memory.dmp

Download

memory/3380-45-0x0000022CF77C0000-0x0000022CF77C7000-memory.dmp

Download

memory/3616-41-0x00000246D8050000-0x00000246D8057000-memory.dmp

Download

memory/3860-43-0x000001BBBD8C0000-0x000001BBBD8C7000-memory.dmp

Download

memory/3940-140-0x00007FF6D6A80000-0x00007FF6D6A9E000-memory.dmp

Download

memory/3940-141-0x00007FF6D6A80000-0x00007FF6D6A9E000-memory.dmp

Download

memory/4552-99-0x0000000000040000-0x0000000000146000-memory.dmp

Download

memory/4552-7-0x0000000000040000-0x0000000000146000-memory.dmp

Download