Analysis Overview
SHA256
bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251
Threat Level: Known bad
The file bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251 was found to be: Known bad.
Malicious Activity Summary
MassLogger Main Payload
MassLogger
Checks computer location settings
Drops startup file
Reads user/profile data of web browsers
Deletes itself
Looks up external IP address via web service
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_win_path
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious behavior: AddClipboardFormatListener
outlook_office_path
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-04-15 09:14
Signatures
Analysis: behavioral2
Detonation Overview
Submitted
2022-04-15 09:14
Reported
2022-04-15 11:29
Platform
win10v2004-20220414-en
Max time kernel
49s
Max time network
79s
Command Line
Signatures
MassLogger
MassLogger Main Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tttttttttt.vbs | C:\Windows\SysWOW64\notepad.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1452 set thread context of 3988 | N/A | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe
"C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe"
C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe
"C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe'
Network
| Country | Destination | Domain | Proto |
| US | 52.109.8.21:443 | tcp | |
| US | 20.42.72.131:443 | tcp | |
| NL | 104.110.191.140:80 | tcp | |
| NL | 104.110.191.140:80 | tcp | |
| NL | 104.110.191.140:80 | tcp |
Files
memory/1452-131-0x0000000002190000-0x00000000021A3000-memory.dmp
memory/944-132-0x0000000000000000-mapping.dmp
memory/3988-133-0x0000000000000000-mapping.dmp
memory/3988-134-0x0000000000B20000-0x0000000000BA6000-memory.dmp
memory/3988-135-0x0000000000B20000-0x0000000000BA6000-memory.dmp
memory/3988-137-0x0000000000C32000-0x0000000000C33000-memory.dmp
memory/3988-136-0x0000000000C32000-0x0000000000C33000-memory.dmp
memory/3988-139-0x0000000000C32000-0x0000000000C33000-memory.dmp
memory/3988-138-0x0000000000C32000-0x0000000000C33000-memory.dmp
memory/3988-141-0x0000000000C32000-0x0000000000C33000-memory.dmp
memory/3988-140-0x0000000000C32000-0x0000000000C33000-memory.dmp
memory/3988-143-0x0000000000C32000-0x0000000000C33000-memory.dmp
memory/3988-142-0x0000000000C32000-0x0000000000C33000-memory.dmp
memory/3988-145-0x0000000000C32000-0x0000000000C33000-memory.dmp
memory/3988-144-0x0000000000C32000-0x0000000000C33000-memory.dmp
memory/3988-146-0x0000000004D00000-0x0000000004D92000-memory.dmp
memory/3988-147-0x0000000004E50000-0x00000000053F4000-memory.dmp
memory/3988-148-0x0000000005400000-0x0000000005466000-memory.dmp
memory/2436-149-0x0000000000000000-mapping.dmp
memory/2436-150-0x0000000004DD0000-0x0000000004E06000-memory.dmp
memory/2436-151-0x00000000054F0000-0x0000000005B18000-memory.dmp
memory/2436-152-0x0000000005C10000-0x0000000005C32000-memory.dmp
memory/2436-153-0x0000000005CB0000-0x0000000005D16000-memory.dmp
memory/2436-154-0x0000000006390000-0x00000000063AE000-memory.dmp
memory/2436-155-0x0000000004EB5000-0x0000000004EB7000-memory.dmp
memory/2436-156-0x0000000007BE0000-0x000000000825A000-memory.dmp
memory/2436-157-0x0000000006890000-0x00000000068AA000-memory.dmp
memory/2436-158-0x0000000007600000-0x0000000007696000-memory.dmp
memory/2436-159-0x0000000006970000-0x0000000006992000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2022-04-15 09:14
Reported
2022-04-15 11:29
Platform
win7-20220414-en
Max time kernel
45s
Max time network
44s
Command Line
Signatures
MassLogger
MassLogger Main Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tttttttttt.vbs | C:\Windows\SysWOW64\notepad.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 784 set thread context of 340 | N/A | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe
"C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe"
C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe
"C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\bd11065fb2166c65ceacbb5630b8adc9467be8e7cda2202f703230f4c745f251.exe'
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 52.20.78.240:80 | api.ipify.org | tcp |
| US | 8.8.8.8:53 | mail.nirongrup.com | udp |
| NL | 212.7.211.17:587 | mail.nirongrup.com | tcp |
Files
memory/784-55-0x0000000000250000-0x0000000000263000-memory.dmp
memory/784-56-0x0000000076391000-0x0000000076393000-memory.dmp
memory/776-57-0x0000000000000000-mapping.dmp
memory/776-58-0x0000000000080000-0x0000000000081000-memory.dmp
memory/340-62-0x000000000051C9C0-mapping.dmp
memory/340-63-0x00000000005B0000-0x0000000000636000-memory.dmp
memory/340-64-0x00000000005B0000-0x0000000000636000-memory.dmp
memory/340-67-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/340-66-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/340-68-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/340-69-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/340-75-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/340-74-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/340-73-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/340-72-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/340-71-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/340-70-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/340-76-0x0000000004A75000-0x0000000004A86000-memory.dmp
memory/340-77-0x0000000006630000-0x000000000666E000-memory.dmp
memory/340-78-0x0000000006A50000-0x0000000006AE0000-memory.dmp
memory/1124-79-0x0000000000000000-mapping.dmp
memory/1124-81-0x00000000742A0000-0x000000007484B000-memory.dmp
memory/1124-82-0x0000000000232000-0x0000000000234000-memory.dmp