Malware Analysis Report

2024-09-23 04:56

Sample ID 210518-4arfgah6sa
Target f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33
SHA256 f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33
Tags
vmprotect qulab discovery evasion ransomware spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33

Threat Level: Known bad

The file f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33 was found to be: Known bad.

Malicious Activity Summary

vmprotect qulab discovery evasion ransomware spyware stealer upx

Qulab Stealer & Clipper

ACProtect 1.3x - 1.4x DLL software

Executes dropped EXE

UPX packed file

VMProtect packed file

Sets file to hidden

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Suspicious behavior: RenamesItself

Views/modifies file attributes

Suspicious use of WriteProcessMemory

NTFS ADS

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2021-05-18 09:55

Signatures

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-05-18 09:55

Reported

2021-05-18 22:56

Platform

win7v20210408

Max time kernel

135s

Max time network

85s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe N/A

Sets file to hidden

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe N/A
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1120 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe
PID 1120 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe
PID 1120 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe
PID 1120 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe
PID 1780 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe
PID 1780 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe
PID 1780 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe
PID 1780 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe
PID 1848 wrote to memory of 1692 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe
PID 1848 wrote to memory of 1692 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe
PID 1848 wrote to memory of 1692 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe
PID 1848 wrote to memory of 1692 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe
PID 1780 wrote to memory of 916 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1780 wrote to memory of 916 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1780 wrote to memory of 916 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1780 wrote to memory of 916 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1780 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1780 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1780 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1780 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1780 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1780 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1780 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1780 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1780 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1780 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1780 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1780 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 1848 wrote to memory of 1728 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe
PID 1848 wrote to memory of 1728 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe
PID 1848 wrote to memory of 1728 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe
PID 1848 wrote to memory of 1728 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe

"C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\ENU_687FE97D0543F71E9D41.7z" "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\1\*"

C:\Windows\system32\taskeng.exe

taskeng.exe {3CF6321E-CCCD-4BE9-AFAC-2D4FAADE8A93} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 api.telegram.org udp
N/A 8.8.8.8:53 ipapi.co udp
N/A 45.89.19.4:8696 tcp
N/A 45.89.19.4:8696 tcp

Files

memory/1120-60-0x0000000074D91000-0x0000000074D93000-memory.dmp

memory/1120-61-0x0000000000A30000-0x0000000000FCD000-memory.dmp

memory/1120-62-0x0000000077170000-0x0000000077171000-memory.dmp

memory/1780-63-0x0000000000000000-mapping.dmp

memory/1780-65-0x0000000000A30000-0x0000000000FCD000-memory.dmp

\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

memory/1780-69-0x00000000048C0000-0x00000000049E4000-memory.dmp

\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

memory/1032-72-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\1\Information.txt

MD5 645432012930d65dc8efb0afc67fdb7b
SHA1 4f5baafb1001c4167a6dc55635a0720089f5a791
SHA256 08e8a1f525ad4fab8c1ec9c9c08efb7bf78a77d12a743d664cb10777eef9afeb
SHA512 6156b6dc453d36d603ac762d6248039aa5f38a31dc4fd4e1ad8493878a4f605fedcf7c3e2e4194da7f9e94193c5be9e3936e927dd34302171aeb59b9fc578020

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\1\Screen.jpg

MD5 c995c9a24962eabe84a758ba94ac7c45
SHA1 99bad45bf1e295a69ef7122c6a9afd836f891159
SHA256 961655ea27ee29e084669c9b43f6cc56415fbcff08b5a409e0f9e688063e23fa
SHA512 245d0cfa41224a023586313d150d21e3a262fef96fbc16ae251e9bbc56786f77ab8c746f6cf025367d268fcb0a1312d76c72004bba9bc693d983f1e285aec4ea

memory/1780-76-0x00000000766B0000-0x00000000766B1000-memory.dmp

memory/1692-77-0x0000000000000000-mapping.dmp

memory/1692-79-0x0000000000A30000-0x0000000000FCD000-memory.dmp

memory/916-81-0x0000000000000000-mapping.dmp

memory/1704-82-0x0000000000000000-mapping.dmp

memory/1120-83-0x0000000000000000-mapping.dmp

memory/1576-84-0x0000000000000000-mapping.dmp

memory/1780-88-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

memory/1780-87-0x0000000002B40000-0x0000000002B41000-memory.dmp

memory/1780-86-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

memory/1780-85-0x0000000001070000-0x0000000001071000-memory.dmp

memory/1728-89-0x0000000000000000-mapping.dmp

memory/1728-91-0x0000000000A30000-0x0000000000FCD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-05-18 09:55

Reported

2021-05-18 22:55

Platform

win10v20210410

Max time kernel

145s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe N/A

Sets file to hidden

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe N/A
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3972 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe
PID 3972 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe
PID 3972 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe
PID 2752 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe
PID 2752 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe
PID 2752 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe
PID 2752 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 2752 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe
PID 2752 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe C:\Windows\SysWOW64\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe

"C:\Users\Admin\AppData\Local\Temp\f0e9e44c5e6baee47e3f6d946155c305c3175c8150d948120b7ca2d393df2a33.exe"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\ENU_801FE97E4621DA2E9D41.7z" "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\1\*"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.exe

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 api.telegram.org udp
N/A 149.154.167.220:443 api.telegram.org tcp
N/A 8.8.8.8:53 ipapi.co udp
N/A 104.26.9.44:443 ipapi.co tcp
N/A 45.89.19.4:8696 api.telegram.org tcp
N/A 45.89.19.4:8696 api.telegram.org tcp

Files

memory/3972-114-0x0000000001040000-0x00000000015DD000-memory.dmp

memory/3972-117-0x0000000077EB0000-0x0000000077EB1000-memory.dmp

memory/2752-118-0x0000000000000000-mapping.dmp

memory/2752-119-0x0000000001040000-0x00000000015DD000-memory.dmp

\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

memory/2752-125-0x0000000076D40000-0x0000000076D41000-memory.dmp

memory/3052-126-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\kbd101a.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\1\Information.txt

MD5 1e02e95ad4bb767e3023d7267680ce37
SHA1 562d34b2c0bebd4d3f37482cf921e02b0b2665bc
SHA256 797692b82099eddcbcb732fa5f079ff57578af1571333eb3bdc3f3488b5a4c6a
SHA512 fd0037b79b6fd639314c8af28cc35484f9646e70c422cd6c5fc8434e8604d42d8d37b2d30bb22da7f37b6840a58f199d67f62004fc3a77133bf6868667495491

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-security-ngc-ctnrsvc\1\Screen.jpg

MD5 b6e39866f5e24be63e024d1eeb4c5b0f
SHA1 1d71339fee62acdb680e0446e7d772e6e1f3ce3e
SHA256 b4960cce8157fd254eb98785c336669c46aa1c24ef33492fdadcc22963e6cbf4
SHA512 417cff93073ed4a995805cfebee3ebe48136190c8954ddcd52bdf60165c9ff00ee825f5d0d02ec77984477f23395cb9b48be0ad524b86151a5c7e50ef1cf6f1f

memory/1780-131-0x0000000000000000-mapping.dmp

memory/2752-133-0x0000000006330000-0x0000000006331000-memory.dmp

memory/2752-132-0x0000000006310000-0x0000000006311000-memory.dmp

memory/2752-134-0x0000000006320000-0x0000000006321000-memory.dmp

memory/2752-135-0x0000000006340000-0x0000000006341000-memory.dmp

memory/2672-136-0x0000000001040000-0x00000000015DD000-memory.dmp

memory/3856-138-0x0000000001040000-0x00000000015DD000-memory.dmp