Malware Analysis Report

2025-06-16 05:18

Sample ID 220211-3lp44adfc7
Target e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1
SHA256 e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1
Tags
cryptbot spyware stealer discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1

Threat Level: Known bad

The file e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1 was found to be: Known bad.

Malicious Activity Summary

cryptbot spyware stealer discovery

CryptBot

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Reads user/profile data of web browsers

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-11 23:36

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-11 23:36

Reported

2022-02-11 23:39

Platform

win7-en-20211208

Max time kernel

118s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe"

Signatures

CryptBot

spyware stealer cryptbot

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\repent1\KMSpico.exe C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe N/A
File opened for modification C:\Program Files (x86)\repent1\KMSpico.exe C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe N/A
File created C:\Program Files (x86)\repent1\Setup.exe C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe N/A
File opened for modification C:\Program Files (x86)\repent1\Setup.exe C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe N/A
File opened for modification C:\Program Files (x86)\repent1 C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe N/A
File created C:\Program Files (x86)\repent1\__tmp_rar_sfx_access_check_259387776 C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\repent1\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\repent1\Setup.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-NISRV.tmp\KMSpico.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1632 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\Setup.exe
PID 1632 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\Setup.exe
PID 1632 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\Setup.exe
PID 1632 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\Setup.exe
PID 1632 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\Setup.exe
PID 1632 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\Setup.exe
PID 1632 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\Setup.exe
PID 1632 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\KMSpico.exe
PID 1632 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\KMSpico.exe
PID 1632 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\KMSpico.exe
PID 1632 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\KMSpico.exe
PID 1632 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\KMSpico.exe
PID 1632 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\KMSpico.exe
PID 1632 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\KMSpico.exe
PID 668 wrote to memory of 1644 N/A C:\Program Files (x86)\repent1\KMSpico.exe C:\Users\Admin\AppData\Local\Temp\is-NISRV.tmp\KMSpico.tmp
PID 668 wrote to memory of 1644 N/A C:\Program Files (x86)\repent1\KMSpico.exe C:\Users\Admin\AppData\Local\Temp\is-NISRV.tmp\KMSpico.tmp
PID 668 wrote to memory of 1644 N/A C:\Program Files (x86)\repent1\KMSpico.exe C:\Users\Admin\AppData\Local\Temp\is-NISRV.tmp\KMSpico.tmp
PID 668 wrote to memory of 1644 N/A C:\Program Files (x86)\repent1\KMSpico.exe C:\Users\Admin\AppData\Local\Temp\is-NISRV.tmp\KMSpico.tmp
PID 668 wrote to memory of 1644 N/A C:\Program Files (x86)\repent1\KMSpico.exe C:\Users\Admin\AppData\Local\Temp\is-NISRV.tmp\KMSpico.tmp
PID 668 wrote to memory of 1644 N/A C:\Program Files (x86)\repent1\KMSpico.exe C:\Users\Admin\AppData\Local\Temp\is-NISRV.tmp\KMSpico.tmp
PID 668 wrote to memory of 1644 N/A C:\Program Files (x86)\repent1\KMSpico.exe C:\Users\Admin\AppData\Local\Temp\is-NISRV.tmp\KMSpico.tmp
PID 1060 wrote to memory of 1812 N/A C:\Program Files (x86)\repent1\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 1812 N/A C:\Program Files (x86)\repent1\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 1812 N/A C:\Program Files (x86)\repent1\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 1812 N/A C:\Program Files (x86)\repent1\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1812 wrote to memory of 944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1812 wrote to memory of 944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1812 wrote to memory of 944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1812 wrote to memory of 944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe

"C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe"

C:\Program Files (x86)\repent1\Setup.exe

"C:\Program Files (x86)\repent1\Setup.exe"

C:\Program Files (x86)\repent1\KMSpico.exe

"C:\Program Files (x86)\repent1\KMSpico.exe"

C:\Users\Admin\AppData\Local\Temp\is-NISRV.tmp\KMSpico.tmp

"C:\Users\Admin\AppData\Local\Temp\is-NISRV.tmp\KMSpico.tmp" /SL5="$90152,2952592,69120,C:\Program Files (x86)\repent1\KMSpico.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\laqIfvYcm & timeout 4 & del /f /q "C:\Program Files (x86)\repent1\Setup.exe"

C:\Windows\SysWOW64\timeout.exe

timeout 4

Network

N/A

Files

memory/1632-55-0x0000000075801000-0x0000000075803000-memory.dmp

\Program Files (x86)\repent1\Setup.exe

MD5 194ccdaaf83d6e231a54101ba116ee49
SHA1 5da268cda9ac6a389f6c367f3073e00ff119fb71
SHA256 3ac00939fdb736bfb3c7c90d47f4d161b839431b75d65512392e4e0f5c6b2a71
SHA512 c7957181ba95b448f78cef041e75581a3590dc1f48c199b9522b36be698a4648259392566c786b61eb186eeddcf0190ab4edfffd85bb87671618cc6ee6c521c1

\Program Files (x86)\repent1\Setup.exe

MD5 194ccdaaf83d6e231a54101ba116ee49
SHA1 5da268cda9ac6a389f6c367f3073e00ff119fb71
SHA256 3ac00939fdb736bfb3c7c90d47f4d161b839431b75d65512392e4e0f5c6b2a71
SHA512 c7957181ba95b448f78cef041e75581a3590dc1f48c199b9522b36be698a4648259392566c786b61eb186eeddcf0190ab4edfffd85bb87671618cc6ee6c521c1

\Program Files (x86)\repent1\Setup.exe

MD5 194ccdaaf83d6e231a54101ba116ee49
SHA1 5da268cda9ac6a389f6c367f3073e00ff119fb71
SHA256 3ac00939fdb736bfb3c7c90d47f4d161b839431b75d65512392e4e0f5c6b2a71
SHA512 c7957181ba95b448f78cef041e75581a3590dc1f48c199b9522b36be698a4648259392566c786b61eb186eeddcf0190ab4edfffd85bb87671618cc6ee6c521c1

\Program Files (x86)\repent1\Setup.exe

MD5 194ccdaaf83d6e231a54101ba116ee49
SHA1 5da268cda9ac6a389f6c367f3073e00ff119fb71
SHA256 3ac00939fdb736bfb3c7c90d47f4d161b839431b75d65512392e4e0f5c6b2a71
SHA512 c7957181ba95b448f78cef041e75581a3590dc1f48c199b9522b36be698a4648259392566c786b61eb186eeddcf0190ab4edfffd85bb87671618cc6ee6c521c1

C:\Program Files (x86)\repent1\Setup.exe

MD5 194ccdaaf83d6e231a54101ba116ee49
SHA1 5da268cda9ac6a389f6c367f3073e00ff119fb71
SHA256 3ac00939fdb736bfb3c7c90d47f4d161b839431b75d65512392e4e0f5c6b2a71
SHA512 c7957181ba95b448f78cef041e75581a3590dc1f48c199b9522b36be698a4648259392566c786b61eb186eeddcf0190ab4edfffd85bb87671618cc6ee6c521c1

C:\Program Files (x86)\repent1\Setup.exe

MD5 194ccdaaf83d6e231a54101ba116ee49
SHA1 5da268cda9ac6a389f6c367f3073e00ff119fb71
SHA256 3ac00939fdb736bfb3c7c90d47f4d161b839431b75d65512392e4e0f5c6b2a71
SHA512 c7957181ba95b448f78cef041e75581a3590dc1f48c199b9522b36be698a4648259392566c786b61eb186eeddcf0190ab4edfffd85bb87671618cc6ee6c521c1

\Program Files (x86)\repent1\KMSpico.exe

MD5 a02164371a50c5ff9fa2870ef6e8cfa3
SHA1 060614723f8375ecaad8b249ff07e3be082d7f25
SHA256 64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a
SHA512 6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

\Program Files (x86)\repent1\KMSpico.exe

MD5 a02164371a50c5ff9fa2870ef6e8cfa3
SHA1 060614723f8375ecaad8b249ff07e3be082d7f25
SHA256 64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a
SHA512 6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

\Program Files (x86)\repent1\KMSpico.exe

MD5 a02164371a50c5ff9fa2870ef6e8cfa3
SHA1 060614723f8375ecaad8b249ff07e3be082d7f25
SHA256 64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a
SHA512 6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

\Program Files (x86)\repent1\KMSpico.exe

MD5 a02164371a50c5ff9fa2870ef6e8cfa3
SHA1 060614723f8375ecaad8b249ff07e3be082d7f25
SHA256 64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a
SHA512 6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

C:\Program Files (x86)\repent1\KMSpico.exe

MD5 a02164371a50c5ff9fa2870ef6e8cfa3
SHA1 060614723f8375ecaad8b249ff07e3be082d7f25
SHA256 64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a
SHA512 6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

memory/668-68-0x0000000000400000-0x0000000000417000-memory.dmp

C:\Program Files (x86)\repent1\KMSpico.exe

MD5 a02164371a50c5ff9fa2870ef6e8cfa3
SHA1 060614723f8375ecaad8b249ff07e3be082d7f25
SHA256 64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a
SHA512 6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

\Users\Admin\AppData\Local\Temp\is-NISRV.tmp\KMSpico.tmp

MD5 1778c1f66ff205875a6435a33229ab3c
SHA1 5b6189159b16c6f85feed66834af3e06c0277a19
SHA256 95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6
SHA512 8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

C:\Users\Admin\AppData\Local\Temp\is-NISRV.tmp\KMSpico.tmp

MD5 1778c1f66ff205875a6435a33229ab3c
SHA1 5b6189159b16c6f85feed66834af3e06c0277a19
SHA256 95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6
SHA512 8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

\Users\Admin\AppData\Local\Temp\is-2JI6S.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

\Users\Admin\AppData\Local\Temp\is-2JI6S.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/1060-77-0x0000000000400000-0x0000000000564000-memory.dmp

memory/1060-78-0x0000000000A40000-0x0000000000A88000-memory.dmp

memory/1644-79-0x0000000000240000-0x0000000000241000-memory.dmp

memory/668-80-0x0000000000401000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-11 23:36

Reported

2022-02-11 23:39

Platform

win10v2004-en-20220113

Max time kernel

158s

Max time network

170s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe"

Signatures

CryptBot

spyware stealer cryptbot

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\repent1\__tmp_rar_sfx_access_check_30246171 C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe N/A
File created C:\Program Files (x86)\repent1\KMSpico.exe C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe N/A
File opened for modification C:\Program Files (x86)\repent1\KMSpico.exe C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe N/A
File created C:\Program Files (x86)\repent1\Setup.exe C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe N/A
File opened for modification C:\Program Files (x86)\repent1\Setup.exe C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe N/A
File opened for modification C:\Program Files (x86)\repent1 C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WinSxS\pending.xml C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\Logs\CBS\CBS.log C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\repent1\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\repent1\Setup.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1880 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\Setup.exe
PID 1880 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\Setup.exe
PID 1880 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\Setup.exe
PID 1880 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\KMSpico.exe
PID 1880 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\KMSpico.exe
PID 1880 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe C:\Program Files (x86)\repent1\KMSpico.exe
PID 4376 wrote to memory of 2700 N/A C:\Program Files (x86)\repent1\KMSpico.exe C:\Users\Admin\AppData\Local\Temp\is-5L8S7.tmp\KMSpico.tmp
PID 4376 wrote to memory of 2700 N/A C:\Program Files (x86)\repent1\KMSpico.exe C:\Users\Admin\AppData\Local\Temp\is-5L8S7.tmp\KMSpico.tmp
PID 4376 wrote to memory of 2700 N/A C:\Program Files (x86)\repent1\KMSpico.exe C:\Users\Admin\AppData\Local\Temp\is-5L8S7.tmp\KMSpico.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe

"C:\Users\Admin\AppData\Local\Temp\e0949a201bce683fd955b895d6a80f2021fe83d5c7ba44ab0f0d16086683ced1.exe"

C:\Program Files (x86)\repent1\Setup.exe

"C:\Program Files (x86)\repent1\Setup.exe"

C:\Program Files (x86)\repent1\KMSpico.exe

"C:\Program Files (x86)\repent1\KMSpico.exe"

C:\Users\Admin\AppData\Local\Temp\is-5L8S7.tmp\KMSpico.tmp

"C:\Users\Admin\AppData\Local\Temp\is-5L8S7.tmp\KMSpico.tmp" /SL5="$6002C,2952592,69120,C:\Program Files (x86)\repent1\KMSpico.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

Network

Country Destination Domain Proto
NL 104.110.191.133:80 tcp
NL 104.110.191.133:80 tcp
US 8.8.8.8:53 sezwex34.top udp
US 8.8.8.8:53 sezwex34.top udp
US 8.8.8.8:53 sezwex34.top udp
US 8.8.8.8:53 sezwex34.top udp
US 8.8.8.8:53 sezwex34.top udp
US 8.8.8.8:53 sezwex34.top udp
US 8.8.8.8:53 sezwex34.top udp
US 8.8.8.8:53 sezwex34.top udp
US 8.8.8.8:53 sezwex34.top udp
US 8.8.8.8:53 sezwex34.top udp
US 8.8.8.8:53 sezwex34.top udp
US 8.8.8.8:53 sezwex34.top udp
US 8.8.8.8:53 sezwex34.top udp
US 8.8.8.8:53 sezwex34.top udp
US 8.8.8.8:53 sezwex34.top udp
US 8.8.8.8:53 sezwex34.top udp

Files

C:\Program Files (x86)\repent1\Setup.exe

MD5 194ccdaaf83d6e231a54101ba116ee49
SHA1 5da268cda9ac6a389f6c367f3073e00ff119fb71
SHA256 3ac00939fdb736bfb3c7c90d47f4d161b839431b75d65512392e4e0f5c6b2a71
SHA512 c7957181ba95b448f78cef041e75581a3590dc1f48c199b9522b36be698a4648259392566c786b61eb186eeddcf0190ab4edfffd85bb87671618cc6ee6c521c1

C:\Program Files (x86)\repent1\Setup.exe

MD5 194ccdaaf83d6e231a54101ba116ee49
SHA1 5da268cda9ac6a389f6c367f3073e00ff119fb71
SHA256 3ac00939fdb736bfb3c7c90d47f4d161b839431b75d65512392e4e0f5c6b2a71
SHA512 c7957181ba95b448f78cef041e75581a3590dc1f48c199b9522b36be698a4648259392566c786b61eb186eeddcf0190ab4edfffd85bb87671618cc6ee6c521c1

C:\Program Files (x86)\repent1\KMSpico.exe

MD5 a02164371a50c5ff9fa2870ef6e8cfa3
SHA1 060614723f8375ecaad8b249ff07e3be082d7f25
SHA256 64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a
SHA512 6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

C:\Program Files (x86)\repent1\KMSpico.exe

MD5 a02164371a50c5ff9fa2870ef6e8cfa3
SHA1 060614723f8375ecaad8b249ff07e3be082d7f25
SHA256 64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a
SHA512 6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

memory/4376-134-0x0000000000400000-0x0000000000417000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-5L8S7.tmp\KMSpico.tmp

MD5 1778c1f66ff205875a6435a33229ab3c
SHA1 5b6189159b16c6f85feed66834af3e06c0277a19
SHA256 95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6
SHA512 8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

C:\Users\Admin\AppData\Local\Temp\is-5L8S7.tmp\KMSpico.tmp

MD5 1778c1f66ff205875a6435a33229ab3c
SHA1 5b6189159b16c6f85feed66834af3e06c0277a19
SHA256 95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6
SHA512 8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

memory/2364-138-0x00000232DD360000-0x00000232DD370000-memory.dmp

memory/2364-139-0x00000232DD920000-0x00000232DD930000-memory.dmp

memory/2364-140-0x00000232DFFE0000-0x00000232DFFE4000-memory.dmp

memory/1256-141-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2700-143-0x0000000000750000-0x0000000000751000-memory.dmp

memory/1256-146-0x0000000000760000-0x00000000007A8000-memory.dmp

memory/1256-145-0x0000000000640000-0x0000000000641000-memory.dmp

memory/1256-144-0x00000000004C6000-0x00000000004C8000-memory.dmp

memory/4376-142-0x0000000000401000-0x000000000040B000-memory.dmp