Malware Analysis Report

2024-10-19 07:36

Sample ID 210930-gsm3esgfgl
Target cb12b24b0f69225693168e9c35761a1b.exe
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
Tags
xpertrat test evasion persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

Threat Level: Known bad

The file cb12b24b0f69225693168e9c35761a1b.exe was found to be: Known bad.

Malicious Activity Summary

xpertrat test evasion persistence rat trojan

UAC bypass

XpertRAT

Windows security bypass

XpertRAT Core Payload

Adds policy Run key to start application

Deletes itself

Windows security modification

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

System policy modification

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-30 06:04

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-30 06:04

Reported

2021-09-30 06:06

Platform

win7-en-20210920

Max time kernel

148s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe"

Signatures

UAC bypass

evasion trojan

Windows security bypass

evasion trojan

XpertRAT

rat xpertrat

XpertRAT Core Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1324 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1324 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1324 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1324 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1324 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1324 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1324 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1324 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1324 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 1324 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 1324 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 1324 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 1324 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 1324 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 1324 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 1324 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 1324 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 1324 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 1324 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 1880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 552 wrote to memory of 1016 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 552 wrote to memory of 1016 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 552 wrote to memory of 1016 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 552 wrote to memory of 1016 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 552 wrote to memory of 1016 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe

"C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitch.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5

C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe

C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe

C:\Windows\SysWOW64\notepad.exe

notepad.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 kapasky-antivirus.firewall-gateway.net udp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
US 8.8.8.8:53 kapasky-antivirus.firewall-gateway.net udp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
US 8.8.8.8:53 kapasky-antivirus.firewall-gateway.net udp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp

Files

memory/1324-54-0x00000000010B0000-0x00000000010B1000-memory.dmp

memory/1324-56-0x0000000075661000-0x0000000075663000-memory.dmp

memory/1324-57-0x0000000004B40000-0x0000000004B41000-memory.dmp

memory/1644-58-0x0000000000000000-mapping.dmp

memory/1644-61-0x0000000002531000-0x0000000002532000-memory.dmp

memory/1644-60-0x0000000002530000-0x0000000002531000-memory.dmp

memory/1644-62-0x0000000002532000-0x0000000002534000-memory.dmp

memory/268-63-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 cd5fce51bb8b4dc69d0249c4e85dc95b
SHA1 735173046504155064e79fbdb31f5d89b840b005
SHA256 eaa773519fc09fffdf46c8fb5521a8de21626afde318a1519fce1f333831669e
SHA512 f8a4b1884d9c163440a755b65f1bec3a728ca6e87c27fd19bb216fc2ed0b0785181aced4b06ba397e47fc9495e61f53d26f21e82dbd0791d9ee36033418d6d79

memory/268-66-0x0000000002340000-0x0000000002F8A000-memory.dmp

memory/1324-67-0x00000000049C0000-0x0000000004A0F000-memory.dmp

memory/1324-68-0x0000000000AD0000-0x0000000000B00000-memory.dmp

memory/1880-69-0x0000000000400000-0x000000000042C000-memory.dmp

memory/1880-70-0x00000000004010B8-mapping.dmp

memory/552-73-0x0000000000400000-0x0000000000443000-memory.dmp

memory/552-74-0x0000000000401364-mapping.dmp

memory/552-75-0x0000000000560000-0x00000000006B3000-memory.dmp

memory/1016-78-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-30 06:04

Reported

2021-09-30 06:06

Platform

win10v20210408

Max time kernel

151s

Max time network

166s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe"

Signatures

UAC bypass

evasion trojan

Windows security bypass

evasion trojan

XpertRAT

rat xpertrat

XpertRAT Core Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3260 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3260 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3260 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3260 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3260 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3260 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3260 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 3260 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 3260 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 3260 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 3260 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 3260 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 3260 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
PID 992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2532 wrote to memory of 4052 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2532 wrote to memory of 4052 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2532 wrote to memory of 4052 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2532 wrote to memory of 4052 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe

"C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitch.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5

C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe

C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe

C:\Windows\SysWOW64\notepad.exe

notepad.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 twitch.com udp
US 8.8.8.8:53 twitch.com udp
US 8.8.8.8:53 twitch.com udp
US 8.8.8.8:53 twitch.com udp
US 8.8.8.8:53 twitch.com udp
US 8.8.8.8:53 kapasky-antivirus.firewall-gateway.net udp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp

Files

memory/3260-114-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

memory/3260-116-0x0000000001250000-0x000000000139A000-memory.dmp

memory/3548-117-0x0000000000000000-mapping.dmp

memory/3548-120-0x0000000007220000-0x0000000007221000-memory.dmp

memory/3548-121-0x0000000007950000-0x0000000007951000-memory.dmp

memory/3548-123-0x0000000007312000-0x0000000007313000-memory.dmp

memory/3548-122-0x0000000007310000-0x0000000007311000-memory.dmp

memory/3548-124-0x0000000007FF0000-0x0000000007FF1000-memory.dmp

memory/3548-125-0x0000000008090000-0x0000000008091000-memory.dmp

memory/3548-126-0x0000000008200000-0x0000000008201000-memory.dmp

memory/3548-127-0x0000000008270000-0x0000000008271000-memory.dmp

memory/3548-128-0x0000000008640000-0x0000000008641000-memory.dmp

memory/3548-129-0x0000000008670000-0x0000000008671000-memory.dmp

memory/3548-130-0x0000000008A40000-0x0000000008A41000-memory.dmp

memory/3548-138-0x0000000009780000-0x00000000097B3000-memory.dmp

memory/3548-145-0x0000000009760000-0x0000000009761000-memory.dmp

memory/3548-150-0x0000000009AD0000-0x0000000009AD1000-memory.dmp

memory/3548-151-0x000000007E540000-0x000000007E541000-memory.dmp

memory/3548-152-0x0000000009D80000-0x0000000009D81000-memory.dmp

memory/3548-153-0x0000000007313000-0x0000000007314000-memory.dmp

memory/3548-381-0x000000000B520000-0x000000000B521000-memory.dmp

memory/3548-382-0x0000000009D60000-0x0000000009D61000-memory.dmp

memory/3548-393-0x0000000002F60000-0x0000000002F61000-memory.dmp

memory/3548-469-0x0000000003200000-0x0000000003201000-memory.dmp

memory/3548-552-0x0000000003430000-0x0000000003431000-memory.dmp

memory/3548-562-0x0000000007316000-0x0000000007318000-memory.dmp

memory/3548-571-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

memory/1000-677-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 1712dab0a1bf4e9e3ff666b9c431550d
SHA1 34d1dec8fa95f62c72cb3f92a22c13ad9eece10f
SHA256 7184a35390c8d6549ef4ddf2909c8fc3446572229bb1788fe178332d80ebfa97
SHA512 6ae29c37c11c851ed337afee3c3ad654593063e76df88a6974933e449ac8d86bfa005b9bf2e0ee29aad4647b8f8f32ac753587077fd745424be7f9765688e7b7

memory/1000-687-0x0000000004320000-0x0000000004321000-memory.dmp

memory/1000-688-0x0000000004322000-0x0000000004323000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9959b6d1155a9c0618a8b07d46b6ef07
SHA1 8518e8e6a0ecdeab03fcbe2bcb71b4b14f0c5786
SHA256 a5f17b4a70aea4f8ba4b85adf88ffc793e1e06af10cb9d9504bd762c3d9632a5
SHA512 78c5a5319ee2f2bded6ae0c268a05886ff88b4b03a45f466b8ba73f10f2436bf54d5b489f423b21650685fa21c212f0102487aa72aee9b2c49e888153ff3d65e

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 1c33ff599b382b705675229c91fc2f99
SHA1 c20086746c14c5d57be9a3df47bd75fa77abe7e0
SHA256 d46b6790776328125154bb8231deafcc7786911bea48fbcd2742c05fa1c4da0a
SHA512 5b975f6b0d5407d8d43975c0fd0c26ecb155f6ee9b7416e39478f84e97deea590d1eb0cf2a972adcf96eba6745fdef472f6fcf51d85cd53c2da9b4c550ee413c

memory/3260-701-0x00000000014A0000-0x00000000014EF000-memory.dmp

memory/3260-702-0x00000000016D0000-0x0000000001700000-memory.dmp

memory/992-703-0x0000000000400000-0x000000000042C000-memory.dmp

memory/992-704-0x00000000004010B8-mapping.dmp

memory/992-708-0x0000000000400000-0x000000000042C000-memory.dmp

memory/1000-707-0x0000000004323000-0x0000000004324000-memory.dmp

memory/2532-709-0x0000000000400000-0x0000000000443000-memory.dmp

memory/2532-710-0x0000000000401364-mapping.dmp

memory/2532-713-0x0000000003300000-0x0000000003453000-memory.dmp

memory/2532-714-0x0000000003301000-0x00000000033FD000-memory.dmp

memory/4052-717-0x0000000000000000-mapping.dmp