Malware Analysis Report

2024-10-19 08:25

Sample ID 220521-br59qafdfj
Target 85154403167f9e85756b38d9b46d9846a04ae2c8a2d96524c644ba83a8087e65
SHA256 85154403167f9e85756b38d9b46d9846a04ae2c8a2d96524c644ba83a8087e65
Tags
snakebot snakebot nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

85154403167f9e85756b38d9b46d9846a04ae2c8a2d96524c644ba83a8087e65

Threat Level: Known bad

The file 85154403167f9e85756b38d9b46d9846a04ae2c8a2d96524c644ba83a8087e65 was found to be: Known bad.

Malicious Activity Summary

snakebot snakebot nanocore evasion keylogger persistence spyware stealer trojan

Snakebot family

NanoCore

Contains SnakeBOT related strings

Checks computer location settings

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-21 01:23

Signatures

Snakebot family

snakebot

Contains SnakeBOT related strings

snakebot
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-21 01:23

Reported

2022-05-21 02:06

Platform

win7-20220414-en

Max time kernel

45s

Max time network

108s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe"

Signatures

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1624 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Windows\SysWOW64\schtasks.exe
PID 1624 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Windows\SysWOW64\schtasks.exe
PID 1624 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Windows\SysWOW64\schtasks.exe
PID 1624 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Windows\SysWOW64\schtasks.exe
PID 1624 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1624 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe

"C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WTxkFEIOFYPJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7014.tmp"

C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe

"{path}"

C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe

"{path}"

C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe

"{path}"

C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe

"{path}"

C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe

"{path}"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.google.com.br udp
NL 142.250.179.131:443 www.google.com.br tcp
US 8.8.8.8:53 consent.google.com.br udp
NL 142.251.39.110:443 consent.google.com.br tcp

Files

memory/1624-54-0x0000000075741000-0x0000000075743000-memory.dmp

memory/1624-55-0x0000000074C00000-0x00000000751AB000-memory.dmp

memory/1624-56-0x0000000001D89000-0x0000000001D9A000-memory.dmp

memory/784-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp7014.tmp

MD5 33b76a55318af924a35321cab7091a27
SHA1 7be69bd3a3102681764caa67eac80039b2ae3347
SHA256 a1c3efe4fbababb40c77a20ad82e2c75c706a15e689e6f8e4b3fe245b5314226
SHA512 737b1d3c883eaa1baa09656574b7a78c52d7d10567fbbcf4d6acc48c398d1f7a942521d5d0812aa89070711727180d475d75d2b29949c15fc1db1b9be9520816

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-21 01:23

Reported

2022-05-21 02:06

Platform

win10v2004-20220414-en

Max time kernel

146s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Monitor = "C:\\Program Files (x86)\\WPA Monitor\\wpamon.exe" C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\WPA Monitor\wpamon.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe N/A
File opened for modification C:\Program Files (x86)\WPA Monitor\wpamon.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1340 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Windows\SysWOW64\schtasks.exe
PID 1340 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Windows\SysWOW64\schtasks.exe
PID 1340 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Windows\SysWOW64\schtasks.exe
PID 1340 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 260 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 260 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 260 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 1340 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe
PID 4964 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Windows\SysWOW64\schtasks.exe
PID 4964 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Windows\SysWOW64\schtasks.exe
PID 4964 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Windows\SysWOW64\schtasks.exe
PID 4964 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Windows\SysWOW64\schtasks.exe
PID 4964 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Windows\SysWOW64\schtasks.exe
PID 4964 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe

"C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WTxkFEIOFYPJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE6AB.tmp"

C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe

"{path}"

C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe

"{path}"

C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe

"{path}"

C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe

"{path}"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "WPA Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmpEE7B.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "WPA Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpEECB.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.google.com.br udp
NL 142.250.179.131:443 www.google.com.br tcp
US 8.8.8.8:53 consent.google.com.br udp
NL 142.251.39.110:443 consent.google.com.br tcp
US 8.253.208.112:80 tcp
FR 194.5.97.48:4488 tcp
FR 194.5.97.48:4488 tcp
FR 194.5.97.48:4488 tcp
US 52.168.117.170:443 tcp
N/A 127.0.0.1:4488 tcp
N/A 127.0.0.1:4488 tcp
US 8.253.208.112:80 tcp
US 8.253.208.112:80 tcp
US 8.253.208.112:80 tcp
N/A 127.0.0.1:4488 tcp
FR 194.5.97.48:4488 tcp
FR 194.5.97.48:4488 tcp
FR 194.5.97.48:4488 tcp
N/A 127.0.0.1:4488 tcp
N/A 127.0.0.1:4488 tcp
N/A 127.0.0.1:4488 tcp
FR 194.5.97.48:4488 tcp
FR 194.5.97.48:4488 tcp
FR 194.5.97.48:4488 tcp
N/A 127.0.0.1:4488 tcp
N/A 127.0.0.1:4488 tcp
N/A 127.0.0.1:4488 tcp
FR 194.5.97.48:4488 tcp
FR 194.5.97.48:4488 tcp
FR 194.5.97.48:4488 tcp

Files

memory/1340-130-0x0000000074690000-0x0000000074C41000-memory.dmp

memory/5116-131-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmpE6AB.tmp

MD5 8b3c23da36ce756ba9fc47c474f8b02f
SHA1 79c18ca92dfef9be152f1249dd94062c28e6bcb9
SHA256 2d5b97db344f2133c2d5cdcd2a3537b33fda99e274bbe4872d373e7597ab1095
SHA512 e969a02b0c3e4d3d746bc930030bf43d90eca301933095df63fd1701d0bef1ff0c9c6c75c70a483438507c2764d37730990c40582cb5494796d90055d85afc89

memory/224-133-0x0000000000000000-mapping.dmp

memory/260-134-0x0000000000000000-mapping.dmp

memory/3872-135-0x0000000000000000-mapping.dmp

memory/4964-136-0x0000000000000000-mapping.dmp

memory/4964-137-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\PurchaseOrder#PO7211A20_RFQs_Samples_Pacific_Keystone_co.exe.log

MD5 7baa6583f69f63f7230df9bf98448356
SHA1 fe9eb85b57192362da704a3c130377fe83862320
SHA256 a632504621b4cac1d5ba5465c7ad9b30f3d036e9838682506782124a211bed4f
SHA512 0e72541791281c0fdac1f5fc6beea0b9eb8766b2a386aecb92cb8a44e5b59b7114c79194393ddeff957ffe86021a311caed7ce2731b863d97ad441870efbc051

memory/4964-139-0x0000000074690000-0x0000000074C41000-memory.dmp

memory/1408-140-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmpEE7B.tmp

MD5 7504208b9c8da7afbbbe416e9934d29f
SHA1 1ee2a1d596764ed9c1f181f84aeeb7976d3553f1
SHA256 d76b68871ac5e93e7a0203278887f5b7f9241845165ca88509ab58f062508442
SHA512 1dc4d0d8d164be9b5933748a01dcfcd69369933573627f292b62494fb13eb3af6ff34626a570e6ebe4a049db5d3f49df85079c30ede5118e6cc4d87a394c9dad

memory/2184-142-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmpEECB.tmp

MD5 a246b3561d823177f3586e629f144233
SHA1 0f05d12e55a1d2e5e6a4f307c193882fba093315
SHA256 6abae7707b06e52b58f537b335e367cc54b093e899d78f16e94ceaf7ceafca52
SHA512 4246aa9a96331e2c7e36b37fa778e31ecae055c77164e0dc673aa50cdec368f08d356ab06ef1a4540816c474828048ab1bebed7e211a4eb929f2918e1fac9c6d