Malware Analysis Report

2024-11-13 14:23

Sample ID 220323-lfhz6abfe8
Target 93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f
SHA256 93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f
Tags
44caliber njrat hacked spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f

Threat Level: Known bad

The file 93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f was found to be: Known bad.

Malicious Activity Summary

44caliber njrat hacked spyware stealer trojan

44Caliber

njRAT/Bladabindi

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Drops startup file

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-03-23 09:28

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-03-23 09:28

Reported

2022-03-23 09:38

Platform

win7-20220311-en

Max time kernel

4294211s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe"

Signatures

44Caliber

stealer 44caliber

njRAT/Bladabindi

trojan njrat

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Looks up external IP address via web service

Description Indicator Process Target
N/A freegeoip.app N/A N/A
N/A freegeoip.app N/A N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\Insidious.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\Insidious.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Insidious.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OUPPO.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2032 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2032 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2032 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2032 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2032 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\OUPPO.exe
PID 2032 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\OUPPO.exe
PID 2032 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\OUPPO.exe
PID 2032 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\OUPPO.exe
PID 2032 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\Insidious.exe
PID 2032 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\Insidious.exe
PID 2032 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\Insidious.exe
PID 2032 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\Insidious.exe
PID 1824 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\csgo.exe
PID 1824 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\csgo.exe
PID 1824 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\csgo.exe
PID 1824 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\csgo.exe

Processes

C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe

"C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\OUPPO.exe

"C:\Users\Admin\AppData\Local\Temp\OUPPO.exe"

C:\Users\Admin\AppData\Local\Temp\Insidious.exe

"C:\Users\Admin\AppData\Local\Temp\Insidious.exe"

C:\Users\Admin\AppData\Local\Temp\csgo.exe

"C:\Users\Admin\AppData\Local\Temp\csgo.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 freegeoip.app udp
US 188.114.97.0:443 freegeoip.app tcp
US 8.8.8.8:53 ouprochecker.ucoz.net udp
RU 195.216.243.20:443 ouprochecker.ucoz.net tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
RU 195.216.243.20:443 ouprochecker.ucoz.net tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp

Files

memory/2032-54-0x0000000000400000-0x00000000004AA000-memory.dmp

memory/2032-55-0x0000000075801000-0x0000000075803000-memory.dmp

\Users\Admin\AppData\Local\Temp\Server.exe

MD5 de4d468220008d0050ab60cd0091177c
SHA1 cbdd291fa512b43ef9a1a572c4d5f6c1ea590ada
SHA256 0cb50e1f328aa44d13490a50408c8f73a0f464fc895219748edeec58335f03ee
SHA512 ff58acfd1dcc7ec73aea3f13cd97033fd79eaeeb48dd77f484458dbc2378000d2229810e0eb61d0362b92214bad275c5258846f59016414fed457c7727451ca4

memory/1824-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Server.exe

MD5 de4d468220008d0050ab60cd0091177c
SHA1 cbdd291fa512b43ef9a1a572c4d5f6c1ea590ada
SHA256 0cb50e1f328aa44d13490a50408c8f73a0f464fc895219748edeec58335f03ee
SHA512 ff58acfd1dcc7ec73aea3f13cd97033fd79eaeeb48dd77f484458dbc2378000d2229810e0eb61d0362b92214bad275c5258846f59016414fed457c7727451ca4

C:\Users\Admin\AppData\Local\Temp\Server.exe

MD5 de4d468220008d0050ab60cd0091177c
SHA1 cbdd291fa512b43ef9a1a572c4d5f6c1ea590ada
SHA256 0cb50e1f328aa44d13490a50408c8f73a0f464fc895219748edeec58335f03ee
SHA512 ff58acfd1dcc7ec73aea3f13cd97033fd79eaeeb48dd77f484458dbc2378000d2229810e0eb61d0362b92214bad275c5258846f59016414fed457c7727451ca4

\Users\Admin\AppData\Local\Temp\OUPPO.exe

MD5 bf9e924aaf11a12005d2f2d36ac87441
SHA1 b78f005f558deea3beab17d4062fe50d40576822
SHA256 5a5fba380366ce98b4b040b2f3186dd18da4d27f67a0627e2b6f5230d4059261
SHA512 e4323d7b1242849167ff7d8fa1c5361b4b9c7a9e5240f5683aef7396ec132e005094032a0c6ddc8904e9e98a92d27947a7a65bd3d21e006f449480f0cb11e9b2

memory/872-61-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\OUPPO.exe

MD5 bf9e924aaf11a12005d2f2d36ac87441
SHA1 b78f005f558deea3beab17d4062fe50d40576822
SHA256 5a5fba380366ce98b4b040b2f3186dd18da4d27f67a0627e2b6f5230d4059261
SHA512 e4323d7b1242849167ff7d8fa1c5361b4b9c7a9e5240f5683aef7396ec132e005094032a0c6ddc8904e9e98a92d27947a7a65bd3d21e006f449480f0cb11e9b2

C:\Users\Admin\AppData\Local\Temp\OUPPO.exe

MD5 bf9e924aaf11a12005d2f2d36ac87441
SHA1 b78f005f558deea3beab17d4062fe50d40576822
SHA256 5a5fba380366ce98b4b040b2f3186dd18da4d27f67a0627e2b6f5230d4059261
SHA512 e4323d7b1242849167ff7d8fa1c5361b4b9c7a9e5240f5683aef7396ec132e005094032a0c6ddc8904e9e98a92d27947a7a65bd3d21e006f449480f0cb11e9b2

\Users\Admin\AppData\Local\Temp\Insidious.exe

MD5 818467636d598a4dc6fc6d89de7a9e57
SHA1 cb4bf08a35cf6e586bf76753fff1f43e1d61b4ca
SHA256 de55d02511c1d6b3b339299ec904b2a3605405e136d5d76b3b3d0d3818be25ea
SHA512 fe34c0ca523ae41f6ac41000f124a703f9fdfd949b80165f43898880d87be9a92c0aaca6ebc2acdea90a183e5c34bf906ceb290450d10bc5bdf86df6ba19034e

memory/560-65-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Insidious.exe

MD5 818467636d598a4dc6fc6d89de7a9e57
SHA1 cb4bf08a35cf6e586bf76753fff1f43e1d61b4ca
SHA256 de55d02511c1d6b3b339299ec904b2a3605405e136d5d76b3b3d0d3818be25ea
SHA512 fe34c0ca523ae41f6ac41000f124a703f9fdfd949b80165f43898880d87be9a92c0aaca6ebc2acdea90a183e5c34bf906ceb290450d10bc5bdf86df6ba19034e

C:\Users\Admin\AppData\Local\Temp\Insidious.exe

MD5 818467636d598a4dc6fc6d89de7a9e57
SHA1 cb4bf08a35cf6e586bf76753fff1f43e1d61b4ca
SHA256 de55d02511c1d6b3b339299ec904b2a3605405e136d5d76b3b3d0d3818be25ea
SHA512 fe34c0ca523ae41f6ac41000f124a703f9fdfd949b80165f43898880d87be9a92c0aaca6ebc2acdea90a183e5c34bf906ceb290450d10bc5bdf86df6ba19034e

memory/1824-69-0x0000000000FC0000-0x0000000000FD2000-memory.dmp

memory/872-68-0x00000000011C0000-0x00000000011E4000-memory.dmp

memory/560-70-0x00000000008F0000-0x000000000093A000-memory.dmp

memory/560-71-0x00000000004C0000-0x00000000004C2000-memory.dmp

memory/872-72-0x0000000000FF5000-0x0000000001006000-memory.dmp

\Users\Admin\AppData\Local\Temp\csgo.exe

MD5 de4d468220008d0050ab60cd0091177c
SHA1 cbdd291fa512b43ef9a1a572c4d5f6c1ea590ada
SHA256 0cb50e1f328aa44d13490a50408c8f73a0f464fc895219748edeec58335f03ee
SHA512 ff58acfd1dcc7ec73aea3f13cd97033fd79eaeeb48dd77f484458dbc2378000d2229810e0eb61d0362b92214bad275c5258846f59016414fed457c7727451ca4

memory/760-74-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\csgo.exe

MD5 de4d468220008d0050ab60cd0091177c
SHA1 cbdd291fa512b43ef9a1a572c4d5f6c1ea590ada
SHA256 0cb50e1f328aa44d13490a50408c8f73a0f464fc895219748edeec58335f03ee
SHA512 ff58acfd1dcc7ec73aea3f13cd97033fd79eaeeb48dd77f484458dbc2378000d2229810e0eb61d0362b92214bad275c5258846f59016414fed457c7727451ca4

C:\Users\Admin\AppData\Local\Temp\csgo.exe

MD5 de4d468220008d0050ab60cd0091177c
SHA1 cbdd291fa512b43ef9a1a572c4d5f6c1ea590ada
SHA256 0cb50e1f328aa44d13490a50408c8f73a0f464fc895219748edeec58335f03ee
SHA512 ff58acfd1dcc7ec73aea3f13cd97033fd79eaeeb48dd77f484458dbc2378000d2229810e0eb61d0362b92214bad275c5258846f59016414fed457c7727451ca4

memory/760-77-0x0000000000FE0000-0x0000000000FF2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-03-23 09:28

Reported

2022-03-23 09:38

Platform

win10v2004-en-20220113

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe"

Signatures

44Caliber

stealer 44caliber

njRAT/Bladabindi

trojan njrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Server.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Looks up external IP address via web service

Description Indicator Process Target
N/A freegeoip.app N/A N/A
N/A freegeoip.app N/A N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\Insidious.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\Insidious.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Users\Admin\AppData\Local\Temp\OUPPO.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Users\Admin\AppData\Local\Temp\OUPPO.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Insidious.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OUPPO.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csgo.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 548 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 548 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 548 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 548 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\OUPPO.exe
PID 548 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\OUPPO.exe
PID 548 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\OUPPO.exe
PID 548 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\Insidious.exe
PID 548 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe C:\Users\Admin\AppData\Local\Temp\Insidious.exe
PID 1664 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\csgo.exe
PID 1664 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\csgo.exe
PID 1664 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\csgo.exe

Processes

C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe

"C:\Users\Admin\AppData\Local\Temp\93667713af8e23ecde25e78d05f762ecd77d8a7b8667ec78a3cafbf43d724c4f.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\OUPPO.exe

"C:\Users\Admin\AppData\Local\Temp\OUPPO.exe"

C:\Users\Admin\AppData\Local\Temp\Insidious.exe

"C:\Users\Admin\AppData\Local\Temp\Insidious.exe"

C:\Users\Admin\AppData\Local\Temp\csgo.exe

"C:\Users\Admin\AppData\Local\Temp\csgo.exe"

Network

Country Destination Domain Proto
US 20.189.173.1:443 tcp
US 8.8.8.8:53 freegeoip.app udp
US 188.114.97.0:443 freegeoip.app tcp
US 8.8.8.8:53 ouprochecker.ucoz.net udp
RU 195.216.243.20:443 ouprochecker.ucoz.net tcp
N/A 127.0.0.1:25565 tcp
RU 195.216.243.20:443 ouprochecker.ucoz.net tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp
N/A 127.0.0.1:25565 tcp

Files

memory/548-130-0x0000000000400000-0x00000000004AA000-memory.dmp

memory/1664-131-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Server.exe

MD5 de4d468220008d0050ab60cd0091177c
SHA1 cbdd291fa512b43ef9a1a572c4d5f6c1ea590ada
SHA256 0cb50e1f328aa44d13490a50408c8f73a0f464fc895219748edeec58335f03ee
SHA512 ff58acfd1dcc7ec73aea3f13cd97033fd79eaeeb48dd77f484458dbc2378000d2229810e0eb61d0362b92214bad275c5258846f59016414fed457c7727451ca4

C:\Users\Admin\AppData\Local\Temp\Server.exe

MD5 de4d468220008d0050ab60cd0091177c
SHA1 cbdd291fa512b43ef9a1a572c4d5f6c1ea590ada
SHA256 0cb50e1f328aa44d13490a50408c8f73a0f464fc895219748edeec58335f03ee
SHA512 ff58acfd1dcc7ec73aea3f13cd97033fd79eaeeb48dd77f484458dbc2378000d2229810e0eb61d0362b92214bad275c5258846f59016414fed457c7727451ca4

C:\Users\Admin\AppData\Local\Temp\OUPPO.exe

MD5 bf9e924aaf11a12005d2f2d36ac87441
SHA1 b78f005f558deea3beab17d4062fe50d40576822
SHA256 5a5fba380366ce98b4b040b2f3186dd18da4d27f67a0627e2b6f5230d4059261
SHA512 e4323d7b1242849167ff7d8fa1c5361b4b9c7a9e5240f5683aef7396ec132e005094032a0c6ddc8904e9e98a92d27947a7a65bd3d21e006f449480f0cb11e9b2

memory/1824-133-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\OUPPO.exe

MD5 bf9e924aaf11a12005d2f2d36ac87441
SHA1 b78f005f558deea3beab17d4062fe50d40576822
SHA256 5a5fba380366ce98b4b040b2f3186dd18da4d27f67a0627e2b6f5230d4059261
SHA512 e4323d7b1242849167ff7d8fa1c5361b4b9c7a9e5240f5683aef7396ec132e005094032a0c6ddc8904e9e98a92d27947a7a65bd3d21e006f449480f0cb11e9b2

memory/1756-137-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Insidious.exe

MD5 818467636d598a4dc6fc6d89de7a9e57
SHA1 cb4bf08a35cf6e586bf76753fff1f43e1d61b4ca
SHA256 de55d02511c1d6b3b339299ec904b2a3605405e136d5d76b3b3d0d3818be25ea
SHA512 fe34c0ca523ae41f6ac41000f124a703f9fdfd949b80165f43898880d87be9a92c0aaca6ebc2acdea90a183e5c34bf906ceb290450d10bc5bdf86df6ba19034e

C:\Users\Admin\AppData\Local\Temp\Insidious.exe

MD5 818467636d598a4dc6fc6d89de7a9e57
SHA1 cb4bf08a35cf6e586bf76753fff1f43e1d61b4ca
SHA256 de55d02511c1d6b3b339299ec904b2a3605405e136d5d76b3b3d0d3818be25ea
SHA512 fe34c0ca523ae41f6ac41000f124a703f9fdfd949b80165f43898880d87be9a92c0aaca6ebc2acdea90a183e5c34bf906ceb290450d10bc5bdf86df6ba19034e

memory/1756-140-0x000002952A720000-0x000002952A76A000-memory.dmp

memory/1824-141-0x0000000000C60000-0x0000000000C84000-memory.dmp

memory/1664-142-0x0000000000450000-0x0000000000462000-memory.dmp

memory/1824-145-0x0000000005BF0000-0x0000000006194000-memory.dmp

memory/1756-144-0x00007FF804A70000-0x00007FF805531000-memory.dmp

memory/1664-143-0x0000000004CD0000-0x0000000004D6C000-memory.dmp

memory/1756-146-0x000002952AAC0000-0x000002952AAC2000-memory.dmp

memory/1824-147-0x0000000005540000-0x00000000055D2000-memory.dmp

memory/1824-148-0x00000000054F0000-0x00000000054FA000-memory.dmp

memory/1824-149-0x0000000005640000-0x0000000005BE4000-memory.dmp

memory/2724-150-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\csgo.exe

MD5 de4d468220008d0050ab60cd0091177c
SHA1 cbdd291fa512b43ef9a1a572c4d5f6c1ea590ada
SHA256 0cb50e1f328aa44d13490a50408c8f73a0f464fc895219748edeec58335f03ee
SHA512 ff58acfd1dcc7ec73aea3f13cd97033fd79eaeeb48dd77f484458dbc2378000d2229810e0eb61d0362b92214bad275c5258846f59016414fed457c7727451ca4

C:\Users\Admin\AppData\Local\Temp\csgo.exe

MD5 de4d468220008d0050ab60cd0091177c
SHA1 cbdd291fa512b43ef9a1a572c4d5f6c1ea590ada
SHA256 0cb50e1f328aa44d13490a50408c8f73a0f464fc895219748edeec58335f03ee
SHA512 ff58acfd1dcc7ec73aea3f13cd97033fd79eaeeb48dd77f484458dbc2378000d2229810e0eb61d0362b92214bad275c5258846f59016414fed457c7727451ca4