Malware Analysis Report

2024-11-13 14:22

Sample ID 220417-nc45bshbf9
Target D0A927970E230756281222C063F1A06B4637623794A26.exe
SHA256 d0a927970e230756281222c063f1a06b4637623794a26843381e4de3df3c277f
Tags
pyinstaller 44caliber njrat soryman evasion persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d0a927970e230756281222c063f1a06b4637623794a26843381e4de3df3c277f

Threat Level: Known bad

The file D0A927970E230756281222C063F1A06B4637623794A26.exe was found to be: Known bad.

Malicious Activity Summary

pyinstaller 44caliber njrat soryman evasion persistence stealer trojan

Contains code to disable Windows Defender

Modifies Windows Defender Real-time Protection settings

44Caliber

njRAT/Bladabindi

44caliber family

Downloads MZ/PE file

Modifies Windows Firewall

Blocklisted process makes network request

Executes dropped EXE

Loads dropped DLL

Windows security modification

Checks computer location settings

Drops startup file

Adds Run key to start application

Enumerates physical storage devices

Detects Pyinstaller

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-04-17 11:16

Signatures

44caliber family

44caliber

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-04-17 11:16

Reported

2022-04-17 11:18

Platform

win7-20220414-en

Max time kernel

155s

Max time network

166s

Command Line

"C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe"

Signatures

44Caliber

stealer 44caliber

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan

njRAT/Bladabindi

trojan njrat

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9dc6936092ebce7762ab0f2981bc4ba4.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9dc6936092ebce7762ab0f2981bc4ba4.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9dc6936092ebce7762ab0f2981bc4ba4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\9dc6936092ebce7762ab0f2981bc4ba4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1392 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe
PID 1392 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe
PID 1392 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe
PID 1392 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe
PID 836 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 836 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 836 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1392 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe
PID 1392 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe
PID 1392 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe
PID 1392 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe
PID 1532 wrote to memory of 292 N/A C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe C:\Windows\SysWOW64\WScript.exe
PID 1532 wrote to memory of 292 N/A C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe C:\Windows\SysWOW64\WScript.exe
PID 1532 wrote to memory of 292 N/A C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe C:\Windows\SysWOW64\WScript.exe
PID 1532 wrote to memory of 292 N/A C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe C:\Windows\SysWOW64\WScript.exe
PID 292 wrote to memory of 1856 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\svchosted32.exe
PID 292 wrote to memory of 1856 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\svchosted32.exe
PID 292 wrote to memory of 1856 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\svchosted32.exe
PID 292 wrote to memory of 1856 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\svchosted32.exe
PID 1856 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\svchosted32.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1856 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\svchosted32.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1856 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\svchosted32.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1856 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\svchosted32.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1816 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 1816 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 1816 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 1816 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe

"C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe"

C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe

"C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-MpPreference -verbose

C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe

"C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TiktokSpam.js"

C:\Users\Admin\AppData\Local\Temp\svchosted32.exe

"C:\Users\Admin\AppData\Local\Temp\svchosted32.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 us-west-11608.packetriot.net udp
US 165.227.31.192:22794 us-west-11608.packetriot.net tcp
US 165.227.31.192:22794 us-west-11608.packetriot.net tcp
US 8.8.8.8:53 us-west-11608.packetriot.net udp
US 165.227.31.192:22794 us-west-11608.packetriot.net tcp

Files

memory/1392-54-0x0000000000EB0000-0x000000000193E000-memory.dmp

\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe

MD5 64a7e0429947daec5c28503be3d0d7ac
SHA1 c86c62a7f49ccb499af8eebf22950fc54dcb9bdd
SHA256 6fc10838bdf49d8dfdd5d28e223be97e3813924d9ba116ac4c3dc40e2170e772
SHA512 74c432e51a513c969e1525a9eb0babb740d0b62b81f330971fb700e47c897cfa1842aa0d4fe594219ec450654300205d6ebd77678fe8ffdcac19fcb6716814a6

memory/836-56-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe

MD5 64a7e0429947daec5c28503be3d0d7ac
SHA1 c86c62a7f49ccb499af8eebf22950fc54dcb9bdd
SHA256 6fc10838bdf49d8dfdd5d28e223be97e3813924d9ba116ac4c3dc40e2170e772
SHA512 74c432e51a513c969e1525a9eb0babb740d0b62b81f330971fb700e47c897cfa1842aa0d4fe594219ec450654300205d6ebd77678fe8ffdcac19fcb6716814a6

C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe

MD5 64a7e0429947daec5c28503be3d0d7ac
SHA1 c86c62a7f49ccb499af8eebf22950fc54dcb9bdd
SHA256 6fc10838bdf49d8dfdd5d28e223be97e3813924d9ba116ac4c3dc40e2170e772
SHA512 74c432e51a513c969e1525a9eb0babb740d0b62b81f330971fb700e47c897cfa1842aa0d4fe594219ec450654300205d6ebd77678fe8ffdcac19fcb6716814a6

memory/836-59-0x0000000001080000-0x0000000001088000-memory.dmp

memory/1580-60-0x0000000000000000-mapping.dmp

memory/1580-61-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

memory/1580-62-0x000007FEEE150000-0x000007FEEECAD000-memory.dmp

memory/1580-63-0x0000000002924000-0x0000000002927000-memory.dmp

memory/1580-64-0x000000000292B000-0x000000000294A000-memory.dmp

memory/1392-65-0x0000000000535000-0x0000000000546000-memory.dmp

\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe

MD5 5046a2ac28aa9c84e62eb49c7581028e
SHA1 f1966bab316f3c5d5675c46bd2d8fc82cb05390e
SHA256 77204ac3121a0bf6b0d221428e829da740bb6f63fbf4858ccadb927a16a107f2
SHA512 913bab9d02cf88f6b2ee451b218c90ab73d00a8f904e9b8df2430880edc2b9410f8a1f0545f1e09fbcdef74649a1b8de5eb4298796a7f520d216d2066498fa39

memory/1532-67-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe

MD5 5046a2ac28aa9c84e62eb49c7581028e
SHA1 f1966bab316f3c5d5675c46bd2d8fc82cb05390e
SHA256 77204ac3121a0bf6b0d221428e829da740bb6f63fbf4858ccadb927a16a107f2
SHA512 913bab9d02cf88f6b2ee451b218c90ab73d00a8f904e9b8df2430880edc2b9410f8a1f0545f1e09fbcdef74649a1b8de5eb4298796a7f520d216d2066498fa39

C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe

MD5 5046a2ac28aa9c84e62eb49c7581028e
SHA1 f1966bab316f3c5d5675c46bd2d8fc82cb05390e
SHA256 77204ac3121a0bf6b0d221428e829da740bb6f63fbf4858ccadb927a16a107f2
SHA512 913bab9d02cf88f6b2ee451b218c90ab73d00a8f904e9b8df2430880edc2b9410f8a1f0545f1e09fbcdef74649a1b8de5eb4298796a7f520d216d2066498fa39

memory/1532-70-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

memory/292-71-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\TiktokSpam.js

MD5 db484f181ba5b3d4b3ab651428501009
SHA1 407e2f2525f8be6da321a4f3915ab83627fc8ef5
SHA256 59a5f971895e0e23251c91d0d9e7830c4e0f553607c7e2b72502dc66d97bc0b7
SHA512 849dbc4850ec45b350171b6a9dd961b6d02bef3d9294f79b02aaea45815e5b170001a0656a43e0e12ff9b02f01f3f57f3d6f20f23218a6aa5b30e404294f9f9e

memory/292-73-0x0000000075951000-0x0000000075953000-memory.dmp

\Users\Admin\AppData\Local\Temp\svchosted32.exe

MD5 418c9939f93a41b2a91402a767ddf5ca
SHA1 284f5611c1dc4fe764cfc16303ddea7bec8d3f56
SHA256 fd44aa995fef8a05f659c47ffeb958ebd347b458387216263cc316fb8e05300a
SHA512 03b262b780dd34bb592539423bb57e5f2f7aae28a2c41fb46dda03de6357e7fd37f76fe2c87f2e08b0019dba0b70046b830908e9bc0faf398e2e8c586b06bd2c

memory/1856-75-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\svchosted32.exe

MD5 418c9939f93a41b2a91402a767ddf5ca
SHA1 284f5611c1dc4fe764cfc16303ddea7bec8d3f56
SHA256 fd44aa995fef8a05f659c47ffeb958ebd347b458387216263cc316fb8e05300a
SHA512 03b262b780dd34bb592539423bb57e5f2f7aae28a2c41fb46dda03de6357e7fd37f76fe2c87f2e08b0019dba0b70046b830908e9bc0faf398e2e8c586b06bd2c

C:\Users\Admin\AppData\Local\Temp\svchosted32.exe

MD5 418c9939f93a41b2a91402a767ddf5ca
SHA1 284f5611c1dc4fe764cfc16303ddea7bec8d3f56
SHA256 fd44aa995fef8a05f659c47ffeb958ebd347b458387216263cc316fb8e05300a
SHA512 03b262b780dd34bb592539423bb57e5f2f7aae28a2c41fb46dda03de6357e7fd37f76fe2c87f2e08b0019dba0b70046b830908e9bc0faf398e2e8c586b06bd2c

memory/1856-79-0x000000006D220000-0x000000006D7CB000-memory.dmp

memory/1816-81-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 418c9939f93a41b2a91402a767ddf5ca
SHA1 284f5611c1dc4fe764cfc16303ddea7bec8d3f56
SHA256 fd44aa995fef8a05f659c47ffeb958ebd347b458387216263cc316fb8e05300a
SHA512 03b262b780dd34bb592539423bb57e5f2f7aae28a2c41fb46dda03de6357e7fd37f76fe2c87f2e08b0019dba0b70046b830908e9bc0faf398e2e8c586b06bd2c

\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 418c9939f93a41b2a91402a767ddf5ca
SHA1 284f5611c1dc4fe764cfc16303ddea7bec8d3f56
SHA256 fd44aa995fef8a05f659c47ffeb958ebd347b458387216263cc316fb8e05300a
SHA512 03b262b780dd34bb592539423bb57e5f2f7aae28a2c41fb46dda03de6357e7fd37f76fe2c87f2e08b0019dba0b70046b830908e9bc0faf398e2e8c586b06bd2c

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 418c9939f93a41b2a91402a767ddf5ca
SHA1 284f5611c1dc4fe764cfc16303ddea7bec8d3f56
SHA256 fd44aa995fef8a05f659c47ffeb958ebd347b458387216263cc316fb8e05300a
SHA512 03b262b780dd34bb592539423bb57e5f2f7aae28a2c41fb46dda03de6357e7fd37f76fe2c87f2e08b0019dba0b70046b830908e9bc0faf398e2e8c586b06bd2c

memory/1816-85-0x000000006D220000-0x000000006D7CB000-memory.dmp

memory/952-86-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-04-17 11:16

Reported

2022-04-17 11:18

Platform

win10v2004-20220414-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe"

Signatures

44Caliber

stealer 44caliber

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan

njRAT/Bladabindi

trojan njrat

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\svchosted32.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9dc6936092ebce7762ab0f2981bc4ba4.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9dc6936092ebce7762ab0f2981bc4ba4.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9dc6936092ebce7762ab0f2981bc4ba4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9dc6936092ebce7762ab0f2981bc4ba4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1336 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe
PID 1336 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe
PID 1592 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1592 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1336 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe
PID 1336 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe
PID 1336 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe
PID 3004 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe C:\Windows\SysWOW64\WScript.exe
PID 3004 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe C:\Windows\SysWOW64\WScript.exe
PID 3004 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe C:\Windows\SysWOW64\WScript.exe
PID 4972 wrote to memory of 2668 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\svchosted32.exe
PID 4972 wrote to memory of 2668 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\svchosted32.exe
PID 4972 wrote to memory of 2668 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\svchosted32.exe
PID 2668 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\svchosted32.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2668 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\svchosted32.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2668 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\svchosted32.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1412 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 1412 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 1412 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe

"C:\Users\Admin\AppData\Local\Temp\D0A927970E230756281222C063F1A06B4637623794A26.exe"

C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe

"C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-MpPreference -verbose

C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe

"C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TiktokSpam.js"

C:\Users\Admin\AppData\Local\Temp\svchosted32.exe

"C:\Users\Admin\AppData\Local\Temp\svchosted32.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 us-west-11608.packetriot.net udp
US 165.227.31.192:22794 us-west-11608.packetriot.net tcp
US 20.189.173.6:443 tcp
CH 173.222.108.226:80 tcp
US 204.79.197.203:80 tcp
NL 104.97.14.80:80 tcp
US 165.227.31.192:22794 us-west-11608.packetriot.net tcp
US 8.8.8.8:53 us-west-11608.packetriot.net udp
US 165.227.31.192:22794 us-west-11608.packetriot.net tcp

Files

memory/1336-130-0x0000000000500000-0x0000000000F8E000-memory.dmp

memory/1336-131-0x0000000005F20000-0x00000000064C4000-memory.dmp

memory/1336-132-0x0000000005970000-0x0000000005A02000-memory.dmp

memory/1336-133-0x0000000005920000-0x000000000592A000-memory.dmp

memory/1592-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe

MD5 64a7e0429947daec5c28503be3d0d7ac
SHA1 c86c62a7f49ccb499af8eebf22950fc54dcb9bdd
SHA256 6fc10838bdf49d8dfdd5d28e223be97e3813924d9ba116ac4c3dc40e2170e772
SHA512 74c432e51a513c969e1525a9eb0babb740d0b62b81f330971fb700e47c897cfa1842aa0d4fe594219ec450654300205d6ebd77678fe8ffdcac19fcb6716814a6

C:\Users\Admin\AppData\Local\Temp\TiktokSpammerTool.exe

MD5 64a7e0429947daec5c28503be3d0d7ac
SHA1 c86c62a7f49ccb499af8eebf22950fc54dcb9bdd
SHA256 6fc10838bdf49d8dfdd5d28e223be97e3813924d9ba116ac4c3dc40e2170e772
SHA512 74c432e51a513c969e1525a9eb0babb740d0b62b81f330971fb700e47c897cfa1842aa0d4fe594219ec450654300205d6ebd77678fe8ffdcac19fcb6716814a6

memory/1592-137-0x0000000000470000-0x0000000000478000-memory.dmp

memory/4840-138-0x0000000000000000-mapping.dmp

memory/4840-139-0x000001E17C0F0000-0x000001E17C112000-memory.dmp

memory/1592-140-0x00007FFF9A210000-0x00007FFF9ACD1000-memory.dmp

memory/4840-141-0x000001E1632A6000-0x000001E1632A8000-memory.dmp

memory/4840-142-0x00007FFF9A210000-0x00007FFF9ACD1000-memory.dmp

memory/4840-143-0x000001E1632A0000-0x000001E1632A2000-memory.dmp

memory/4840-144-0x000001E1632A3000-0x000001E1632A5000-memory.dmp

memory/3004-145-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe

MD5 5046a2ac28aa9c84e62eb49c7581028e
SHA1 f1966bab316f3c5d5675c46bd2d8fc82cb05390e
SHA256 77204ac3121a0bf6b0d221428e829da740bb6f63fbf4858ccadb927a16a107f2
SHA512 913bab9d02cf88f6b2ee451b218c90ab73d00a8f904e9b8df2430880edc2b9410f8a1f0545f1e09fbcdef74649a1b8de5eb4298796a7f520d216d2066498fa39

C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe

MD5 5046a2ac28aa9c84e62eb49c7581028e
SHA1 f1966bab316f3c5d5675c46bd2d8fc82cb05390e
SHA256 77204ac3121a0bf6b0d221428e829da740bb6f63fbf4858ccadb927a16a107f2
SHA512 913bab9d02cf88f6b2ee451b218c90ab73d00a8f904e9b8df2430880edc2b9410f8a1f0545f1e09fbcdef74649a1b8de5eb4298796a7f520d216d2066498fa39

memory/1336-148-0x0000000005970000-0x0000000005F14000-memory.dmp

memory/3004-149-0x0000000000CF0000-0x0000000000CFA000-memory.dmp

memory/4972-150-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\TiktokSpam.js

MD5 db484f181ba5b3d4b3ab651428501009
SHA1 407e2f2525f8be6da321a4f3915ab83627fc8ef5
SHA256 59a5f971895e0e23251c91d0d9e7830c4e0f553607c7e2b72502dc66d97bc0b7
SHA512 849dbc4850ec45b350171b6a9dd961b6d02bef3d9294f79b02aaea45815e5b170001a0656a43e0e12ff9b02f01f3f57f3d6f20f23218a6aa5b30e404294f9f9e

memory/2668-152-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\svchosted32.exe

MD5 418c9939f93a41b2a91402a767ddf5ca
SHA1 284f5611c1dc4fe764cfc16303ddea7bec8d3f56
SHA256 fd44aa995fef8a05f659c47ffeb958ebd347b458387216263cc316fb8e05300a
SHA512 03b262b780dd34bb592539423bb57e5f2f7aae28a2c41fb46dda03de6357e7fd37f76fe2c87f2e08b0019dba0b70046b830908e9bc0faf398e2e8c586b06bd2c

C:\Users\Admin\AppData\Local\Temp\svchosted32.exe

MD5 418c9939f93a41b2a91402a767ddf5ca
SHA1 284f5611c1dc4fe764cfc16303ddea7bec8d3f56
SHA256 fd44aa995fef8a05f659c47ffeb958ebd347b458387216263cc316fb8e05300a
SHA512 03b262b780dd34bb592539423bb57e5f2f7aae28a2c41fb46dda03de6357e7fd37f76fe2c87f2e08b0019dba0b70046b830908e9bc0faf398e2e8c586b06bd2c

memory/2668-155-0x000000006C4D0000-0x000000006CA81000-memory.dmp

memory/1412-156-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 418c9939f93a41b2a91402a767ddf5ca
SHA1 284f5611c1dc4fe764cfc16303ddea7bec8d3f56
SHA256 fd44aa995fef8a05f659c47ffeb958ebd347b458387216263cc316fb8e05300a
SHA512 03b262b780dd34bb592539423bb57e5f2f7aae28a2c41fb46dda03de6357e7fd37f76fe2c87f2e08b0019dba0b70046b830908e9bc0faf398e2e8c586b06bd2c

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 418c9939f93a41b2a91402a767ddf5ca
SHA1 284f5611c1dc4fe764cfc16303ddea7bec8d3f56
SHA256 fd44aa995fef8a05f659c47ffeb958ebd347b458387216263cc316fb8e05300a
SHA512 03b262b780dd34bb592539423bb57e5f2f7aae28a2c41fb46dda03de6357e7fd37f76fe2c87f2e08b0019dba0b70046b830908e9bc0faf398e2e8c586b06bd2c

memory/1412-159-0x000000006C4D0000-0x000000006CA81000-memory.dmp

memory/4964-160-0x0000000000000000-mapping.dmp