Malware Analysis Report

2025-01-03 04:56

Sample ID 220404-dtaa6shda6
Target asdf.EXErzpfkfeo
SHA256 857fc01da428dccc15e996c5e737eda4148df3676c987a4416c5bb0768ce982d
Tags
azorult oski raccoon 125d9f8ed76e486f6563be097a710bd4cba7f7f2 infostealer spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

857fc01da428dccc15e996c5e737eda4148df3676c987a4416c5bb0768ce982d

Threat Level: Known bad

The file asdf.EXErzpfkfeo was found to be: Known bad.

Malicious Activity Summary

azorult oski raccoon 125d9f8ed76e486f6563be097a710bd4cba7f7f2 infostealer spyware stealer trojan

Raccoon

Azorult

Oski

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-04-04 03:17

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-04-04 03:17

Reported

2022-04-04 03:36

Platform

win7-20220311-en

Max time kernel

4294179s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\asdf.exe"

Signatures

Azorult

trojan infostealer azorult

Oski

infostealer oski

Raccoon

stealer raccoon

Reads user/profile data of web browsers

spyware stealer

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1460 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 1460 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 1460 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 1460 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 1460 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe
PID 1460 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe
PID 1460 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe
PID 1460 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe
PID 1460 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\asdf.exe
PID 1460 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\asdf.exe
PID 1460 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\asdf.exe
PID 1460 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\asdf.exe
PID 1460 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\asdf.exe
PID 572 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe
PID 572 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe
PID 572 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe
PID 572 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe
PID 572 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe
PID 1656 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 1656 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 1656 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 1656 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 1656 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 1364 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe C:\Windows\SysWOW64\WerFault.exe
PID 1364 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe C:\Windows\SysWOW64\WerFault.exe
PID 1364 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe C:\Windows\SysWOW64\WerFault.exe
PID 1364 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\asdf.exe

"C:\Users\Admin\AppData\Local\Temp\asdf.exe"

C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

"C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe"

C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe

"C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe"

C:\Users\Admin\AppData\Local\Temp\asdf.exe

"C:\Users\Admin\AppData\Local\Temp\asdf.exe"

C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe

"C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe"

C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

"C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 844

Network

Country Destination Domain Proto
RO 5.252.178.180:80 tcp
US 8.8.8.8:53 pretorian.ug udp
US 8.8.8.8:53 underdohag.ac.ug udp
SC 185.215.113.77:80 underdohag.ac.ug tcp
SC 185.215.113.77:80 underdohag.ac.ug tcp
RO 5.252.178.180:80 tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp

Files

memory/1460-56-0x0000000075C41000-0x0000000075C43000-memory.dmp

\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

MD5 3466dbd3779c31dc2fccfe73e6d6a44e
SHA1 9e3b082853d4b3b1dd1a0e4877ee4763a02c3171
SHA256 58dedea111e322e46e115f2344c5685224004c0ebac9ab1cfba88c3105e4e5d4
SHA512 4f75e9095685f6bf3a570cd437cf9251b586ab95c7b3135750efa611d347bd4b816ba1525e08fd7776dadb03d62dbc01b9f6c8d0ba5b59d0ad2b5bf2052b67b3

\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

MD5 3466dbd3779c31dc2fccfe73e6d6a44e
SHA1 9e3b082853d4b3b1dd1a0e4877ee4763a02c3171
SHA256 58dedea111e322e46e115f2344c5685224004c0ebac9ab1cfba88c3105e4e5d4
SHA512 4f75e9095685f6bf3a570cd437cf9251b586ab95c7b3135750efa611d347bd4b816ba1525e08fd7776dadb03d62dbc01b9f6c8d0ba5b59d0ad2b5bf2052b67b3

C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

MD5 3466dbd3779c31dc2fccfe73e6d6a44e
SHA1 9e3b082853d4b3b1dd1a0e4877ee4763a02c3171
SHA256 58dedea111e322e46e115f2344c5685224004c0ebac9ab1cfba88c3105e4e5d4
SHA512 4f75e9095685f6bf3a570cd437cf9251b586ab95c7b3135750efa611d347bd4b816ba1525e08fd7776dadb03d62dbc01b9f6c8d0ba5b59d0ad2b5bf2052b67b3

memory/1656-59-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\dfgasdme.exe

MD5 bead6aca8d274c82140361874ca95b59
SHA1 33d6cade432ebc63043170e1a8b049f51b093e59
SHA256 5820149ad3c898bdc7b9cf0ff98648f32192c9c5da5914aa1ae1cbe8a915c388
SHA512 293c616ca82744b34bd2ee389314de7b0fd05cc2e7d02aac08da7c11c1c201f9c026bcc66ee51d5bd0f9ee6d20660a50a9db19ca217479366ceb68d7d159eda8

\Users\Admin\AppData\Local\Temp\dfgasdme.exe

MD5 bead6aca8d274c82140361874ca95b59
SHA1 33d6cade432ebc63043170e1a8b049f51b093e59
SHA256 5820149ad3c898bdc7b9cf0ff98648f32192c9c5da5914aa1ae1cbe8a915c388
SHA512 293c616ca82744b34bd2ee389314de7b0fd05cc2e7d02aac08da7c11c1c201f9c026bcc66ee51d5bd0f9ee6d20660a50a9db19ca217479366ceb68d7d159eda8

memory/572-64-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe

MD5 bead6aca8d274c82140361874ca95b59
SHA1 33d6cade432ebc63043170e1a8b049f51b093e59
SHA256 5820149ad3c898bdc7b9cf0ff98648f32192c9c5da5914aa1ae1cbe8a915c388
SHA512 293c616ca82744b34bd2ee389314de7b0fd05cc2e7d02aac08da7c11c1c201f9c026bcc66ee51d5bd0f9ee6d20660a50a9db19ca217479366ceb68d7d159eda8

memory/1460-69-0x0000000002830000-0x0000000002836000-memory.dmp

memory/1028-76-0x000000000041A684-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

MD5 3466dbd3779c31dc2fccfe73e6d6a44e
SHA1 9e3b082853d4b3b1dd1a0e4877ee4763a02c3171
SHA256 58dedea111e322e46e115f2344c5685224004c0ebac9ab1cfba88c3105e4e5d4
SHA512 4f75e9095685f6bf3a570cd437cf9251b586ab95c7b3135750efa611d347bd4b816ba1525e08fd7776dadb03d62dbc01b9f6c8d0ba5b59d0ad2b5bf2052b67b3

C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe

MD5 bead6aca8d274c82140361874ca95b59
SHA1 33d6cade432ebc63043170e1a8b049f51b093e59
SHA256 5820149ad3c898bdc7b9cf0ff98648f32192c9c5da5914aa1ae1cbe8a915c388
SHA512 293c616ca82744b34bd2ee389314de7b0fd05cc2e7d02aac08da7c11c1c201f9c026bcc66ee51d5bd0f9ee6d20660a50a9db19ca217479366ceb68d7d159eda8

memory/1364-79-0x0000000000417A8B-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

MD5 3466dbd3779c31dc2fccfe73e6d6a44e
SHA1 9e3b082853d4b3b1dd1a0e4877ee4763a02c3171
SHA256 58dedea111e322e46e115f2344c5685224004c0ebac9ab1cfba88c3105e4e5d4
SHA512 4f75e9095685f6bf3a570cd437cf9251b586ab95c7b3135750efa611d347bd4b816ba1525e08fd7776dadb03d62dbc01b9f6c8d0ba5b59d0ad2b5bf2052b67b3

\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

MD5 3466dbd3779c31dc2fccfe73e6d6a44e
SHA1 9e3b082853d4b3b1dd1a0e4877ee4763a02c3171
SHA256 58dedea111e322e46e115f2344c5685224004c0ebac9ab1cfba88c3105e4e5d4
SHA512 4f75e9095685f6bf3a570cd437cf9251b586ab95c7b3135750efa611d347bd4b816ba1525e08fd7776dadb03d62dbc01b9f6c8d0ba5b59d0ad2b5bf2052b67b3

C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe

MD5 bead6aca8d274c82140361874ca95b59
SHA1 33d6cade432ebc63043170e1a8b049f51b093e59
SHA256 5820149ad3c898bdc7b9cf0ff98648f32192c9c5da5914aa1ae1cbe8a915c388
SHA512 293c616ca82744b34bd2ee389314de7b0fd05cc2e7d02aac08da7c11c1c201f9c026bcc66ee51d5bd0f9ee6d20660a50a9db19ca217479366ceb68d7d159eda8

\Users\Admin\AppData\Local\Temp\dfgasdme.exe

MD5 bead6aca8d274c82140361874ca95b59
SHA1 33d6cade432ebc63043170e1a8b049f51b093e59
SHA256 5820149ad3c898bdc7b9cf0ff98648f32192c9c5da5914aa1ae1cbe8a915c388
SHA512 293c616ca82744b34bd2ee389314de7b0fd05cc2e7d02aac08da7c11c1c201f9c026bcc66ee51d5bd0f9ee6d20660a50a9db19ca217479366ceb68d7d159eda8

memory/764-70-0x0000000000440D8F-mapping.dmp

memory/1364-84-0x0000000000400000-0x0000000000434000-memory.dmp

memory/764-85-0x0000000000400000-0x0000000000493000-memory.dmp

memory/1028-86-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2012-87-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

MD5 3466dbd3779c31dc2fccfe73e6d6a44e
SHA1 9e3b082853d4b3b1dd1a0e4877ee4763a02c3171
SHA256 58dedea111e322e46e115f2344c5685224004c0ebac9ab1cfba88c3105e4e5d4
SHA512 4f75e9095685f6bf3a570cd437cf9251b586ab95c7b3135750efa611d347bd4b816ba1525e08fd7776dadb03d62dbc01b9f6c8d0ba5b59d0ad2b5bf2052b67b3

\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

MD5 3466dbd3779c31dc2fccfe73e6d6a44e
SHA1 9e3b082853d4b3b1dd1a0e4877ee4763a02c3171
SHA256 58dedea111e322e46e115f2344c5685224004c0ebac9ab1cfba88c3105e4e5d4
SHA512 4f75e9095685f6bf3a570cd437cf9251b586ab95c7b3135750efa611d347bd4b816ba1525e08fd7776dadb03d62dbc01b9f6c8d0ba5b59d0ad2b5bf2052b67b3

\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

MD5 3466dbd3779c31dc2fccfe73e6d6a44e
SHA1 9e3b082853d4b3b1dd1a0e4877ee4763a02c3171
SHA256 58dedea111e322e46e115f2344c5685224004c0ebac9ab1cfba88c3105e4e5d4
SHA512 4f75e9095685f6bf3a570cd437cf9251b586ab95c7b3135750efa611d347bd4b816ba1525e08fd7776dadb03d62dbc01b9f6c8d0ba5b59d0ad2b5bf2052b67b3

\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

MD5 3466dbd3779c31dc2fccfe73e6d6a44e
SHA1 9e3b082853d4b3b1dd1a0e4877ee4763a02c3171
SHA256 58dedea111e322e46e115f2344c5685224004c0ebac9ab1cfba88c3105e4e5d4
SHA512 4f75e9095685f6bf3a570cd437cf9251b586ab95c7b3135750efa611d347bd4b816ba1525e08fd7776dadb03d62dbc01b9f6c8d0ba5b59d0ad2b5bf2052b67b3

\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

MD5 3466dbd3779c31dc2fccfe73e6d6a44e
SHA1 9e3b082853d4b3b1dd1a0e4877ee4763a02c3171
SHA256 58dedea111e322e46e115f2344c5685224004c0ebac9ab1cfba88c3105e4e5d4
SHA512 4f75e9095685f6bf3a570cd437cf9251b586ab95c7b3135750efa611d347bd4b816ba1525e08fd7776dadb03d62dbc01b9f6c8d0ba5b59d0ad2b5bf2052b67b3

Analysis: behavioral2

Detonation Overview

Submitted

2022-04-04 03:17

Reported

2022-04-04 03:39

Platform

win10v2004-20220310-en

Max time kernel

120s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\asdf.exe"

Signatures

Azorult

trojan infostealer azorult

Oski

infostealer oski

Raccoon

stealer raccoon

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\asdf.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1924 set thread context of 3804 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\asdf.exe
PID 5084 set thread context of 3440 N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 5100 set thread context of 3660 N/A C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1924 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 1924 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 1924 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 1924 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe
PID 1924 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe
PID 1924 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe
PID 1924 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\asdf.exe
PID 1924 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\asdf.exe
PID 1924 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\asdf.exe
PID 1924 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\asdf.exe C:\Users\Admin\AppData\Local\Temp\asdf.exe
PID 5084 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 5084 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 5084 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 5084 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe
PID 5100 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe
PID 5100 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe
PID 5100 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe
PID 5100 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe

Processes

C:\Users\Admin\AppData\Local\Temp\asdf.exe

"C:\Users\Admin\AppData\Local\Temp\asdf.exe"

C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

"C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe"

C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe

"C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe"

C:\Users\Admin\AppData\Local\Temp\asdf.exe

"C:\Users\Admin\AppData\Local\Temp\asdf.exe"

C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

"C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe"

C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe

"C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3440 -ip 3440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 1320

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 8.8.8.8:53 licensing.mp.microsoft.com udp
US 20.223.25.224:443 licensing.mp.microsoft.com tcp
US 8.8.8.8:53 storesdk.dsx.mp.microsoft.com udp
FR 2.18.109.224:443 storesdk.dsx.mp.microsoft.com tcp
US 8.8.8.8:53 ocsp.msocsp.com udp
US 104.18.24.243:80 ocsp.msocsp.com tcp
US 8.8.8.8:53 licensing.mp.microsoft.com udp
US 20.223.25.224:443 licensing.mp.microsoft.com tcp
US 20.223.25.224:443 licensing.mp.microsoft.com tcp
US 20.223.25.224:443 licensing.mp.microsoft.com tcp
RO 5.252.178.180:80 tcp
US 8.8.8.8:53 underdohag.ac.ug udp
US 8.8.8.8:53 pretorian.ug udp
SC 185.215.113.77:80 pretorian.ug tcp
SC 185.215.113.77:80 pretorian.ug tcp
RO 5.252.178.180:80 tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
NL 103.155.93.70:80 tcp
NL 103.155.93.70:80 tcp

Files

memory/5084-136-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

MD5 3466dbd3779c31dc2fccfe73e6d6a44e
SHA1 9e3b082853d4b3b1dd1a0e4877ee4763a02c3171
SHA256 58dedea111e322e46e115f2344c5685224004c0ebac9ab1cfba88c3105e4e5d4
SHA512 4f75e9095685f6bf3a570cd437cf9251b586ab95c7b3135750efa611d347bd4b816ba1525e08fd7776dadb03d62dbc01b9f6c8d0ba5b59d0ad2b5bf2052b67b3

C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

MD5 3466dbd3779c31dc2fccfe73e6d6a44e
SHA1 9e3b082853d4b3b1dd1a0e4877ee4763a02c3171
SHA256 58dedea111e322e46e115f2344c5685224004c0ebac9ab1cfba88c3105e4e5d4
SHA512 4f75e9095685f6bf3a570cd437cf9251b586ab95c7b3135750efa611d347bd4b816ba1525e08fd7776dadb03d62dbc01b9f6c8d0ba5b59d0ad2b5bf2052b67b3

memory/5100-141-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe

MD5 bead6aca8d274c82140361874ca95b59
SHA1 33d6cade432ebc63043170e1a8b049f51b093e59
SHA256 5820149ad3c898bdc7b9cf0ff98648f32192c9c5da5914aa1ae1cbe8a915c388
SHA512 293c616ca82744b34bd2ee389314de7b0fd05cc2e7d02aac08da7c11c1c201f9c026bcc66ee51d5bd0f9ee6d20660a50a9db19ca217479366ceb68d7d159eda8

C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe

MD5 bead6aca8d274c82140361874ca95b59
SHA1 33d6cade432ebc63043170e1a8b049f51b093e59
SHA256 5820149ad3c898bdc7b9cf0ff98648f32192c9c5da5914aa1ae1cbe8a915c388
SHA512 293c616ca82744b34bd2ee389314de7b0fd05cc2e7d02aac08da7c11c1c201f9c026bcc66ee51d5bd0f9ee6d20660a50a9db19ca217479366ceb68d7d159eda8

memory/3804-146-0x0000000000000000-mapping.dmp

memory/1924-147-0x0000000002D70000-0x0000000002D76000-memory.dmp

memory/3440-148-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Dbvsdfe.exe

MD5 3466dbd3779c31dc2fccfe73e6d6a44e
SHA1 9e3b082853d4b3b1dd1a0e4877ee4763a02c3171
SHA256 58dedea111e322e46e115f2344c5685224004c0ebac9ab1cfba88c3105e4e5d4
SHA512 4f75e9095685f6bf3a570cd437cf9251b586ab95c7b3135750efa611d347bd4b816ba1525e08fd7776dadb03d62dbc01b9f6c8d0ba5b59d0ad2b5bf2052b67b3

memory/3660-150-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\dfgasdme.exe

MD5 bead6aca8d274c82140361874ca95b59
SHA1 33d6cade432ebc63043170e1a8b049f51b093e59
SHA256 5820149ad3c898bdc7b9cf0ff98648f32192c9c5da5914aa1ae1cbe8a915c388
SHA512 293c616ca82744b34bd2ee389314de7b0fd05cc2e7d02aac08da7c11c1c201f9c026bcc66ee51d5bd0f9ee6d20660a50a9db19ca217479366ceb68d7d159eda8

memory/3804-152-0x0000000000400000-0x0000000000493000-memory.dmp

memory/3660-153-0x0000000000400000-0x0000000000420000-memory.dmp

memory/3440-154-0x0000000000400000-0x0000000000434000-memory.dmp