IOC Report
kFrGefsAK3.exe

kFrGefsAK3.exe

PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

initial sample

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_kFrGefsAK3.exe_71d7d36b2611530c69ddb8f49ab6d9892148_4b5bc6ba_5e39449e-084e-4963-9b16-48ae3216df9f\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\Desktop\kFrGefsAK3.exe

"C:\Users\user\Desktop\kFrGefsAK3.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2284,i,17304781938837466691,17340018191184435159,262144 /prefetch:8

C:\Users\user\AppData\Local\Temp\service123.exe

"C:\Users\user\AppData\Local\Temp\service123.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user~1\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Users\user\AppData\Local\Temp\service123.exe

C:\Users\user~1\AppData\Local\Temp\/service123.exe

C:\Users\user\AppData\Local\Temp\service123.exe

C:\Users\user~1\AppData\Local\Temp\/service123.exe

C:\Users\user\AppData\Local\Temp\service123.exe

C:\Users\user~1\AppData\Local\Temp\/service123.exe

C:\Users\user\AppData\Local\Temp\service123.exe

C:\Users\user\AppData\Local\Temp\service123.exe