Malware Analysis Report

2024-08-06 08:28

Sample ID 220524-dlqyysded8
Target 91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c
SHA256 91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c
Tags
elysiumstealer neshta persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c

Threat Level: Known bad

The file 91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c was found to be: Known bad.

Malicious Activity Summary

elysiumstealer neshta persistence spyware stealer

Detect Neshta Payload

ElysiumStealer Support DLL

ElysiumStealer

Modifies system executable filetype association

Elysiumstealer family

ElysiumStealer Payload

Neshta

Neshta family

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Checks computer location settings

Drops file in Program Files directory

Drops file in Windows directory

Program crash

Enumerates physical storage devices

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V6

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Change Default File Association
T1042
Privilege Escalation
TA0004
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Credentials in Files
T1081
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040

Analysis: static1

Detonation Overview

Reported

2022-05-24 03:06

Signatures

Detect Neshta Payload

Description Indicator Process Target
N/A N/A N/A N/A

ElysiumStealer Payload

Description Indicator Process Target
N/A N/A N/A N/A

Elysiumstealer family

elysiumstealer

Neshta family

neshta

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-24 03:06

Reported

2022-05-24 03:09

Platform

win7-20220414-en

Max time kernel

41s

Max time network

46s

Command Line

"C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe"

Signatures

ElysiumStealer

stealer elysiumstealer

ElysiumStealer Payload

Description Indicator Process Target
N/A N/A N/A N/A

ElysiumStealer Support DLL

Description Indicator Process Target
N/A N/A N/A N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A

Neshta

persistence spyware neshta

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1404 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe
PID 1404 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe
PID 1404 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe
PID 1404 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe
PID 2044 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe C:\Windows\SysWOW64\WerFault.exe
PID 2044 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe C:\Windows\SysWOW64\WerFault.exe
PID 2044 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe C:\Windows\SysWOW64\WerFault.exe
PID 2044 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

"C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 640

Network

N/A

Files

memory/1404-54-0x0000000075A61000-0x0000000075A63000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

MD5 def2f420993c7111ac3eba4f5f7d3b15
SHA1 ec3ec0580062e5c2cc4e6f948fee2d45f0a14faf
SHA256 2cc971e53dcc25efc6975ae8f9a19fabb1d217374655a6ba735edd7695ecbc27
SHA512 b5427760deb83867a97e0f6c51466764b899e47e87e01d58d795e062bd418905d91d0bb28d8e4550ba701d6e7159515712029946285c456282750b00eb5973b6

memory/2044-56-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

MD5 a9bfd02a78e9b21cdfacd3b97f81e7e1
SHA1 76c49ef318185e6855d6ad4eb6caec0aa1487986
SHA256 03d14e6d190aaa6cf8a3ba3e2957ec20a2bead10f387d39505b14a28851f55bb
SHA512 0a13f9662512bdcd3e151f3d223b9238645d2a8c7adff7f09341cb6c6e28e461671bc00115560087862a5438250e28ef707306f51a32c0261c9622088ebc3e34

C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

MD5 fb8a0dc2ebc73e3300aad30b0ab5379c
SHA1 a3f59d8a54a5633a0079baf078a7dd2f3fa7222e
SHA256 0853d148c93b086ceab60a39fcbd8f27404a6a94511c66fd3ccaa3f93857faa1
SHA512 1a18b03634f524c5f50499bbf455afd160623e11e2b674a09eba797202ee522a191390a9b872198b9bca1ffdcd7fb8f8ad0302678dee25df0c8013f13a2314d8

memory/2044-59-0x00000000011E0000-0x00000000013E4000-memory.dmp

memory/2044-60-0x0000000000470000-0x000000000047C000-memory.dmp

\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

MD5 94173de2e35aa8d621fc1c4f54b2a082
SHA1 fbb2266ee47f88462560f0370edb329554cd5869
SHA256 7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f
SHA512 cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

memory/964-64-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

MD5 509abc7fde5a015aef1d1490cb6c4012
SHA1 47b2fb7ee375de58243f8da7197bfa0667108fd7
SHA256 513e0ae987d5ee5c1e8c6c04d6f26d58c8220a6ea39d57a3ca2d10190296b1eb
SHA512 3fb4685d595a2470e72ee8d936b49f1ec4c50c01f0ff108201458e59a7f264448f06c1ad66eadfd6ce8b24cc86d98cc98b8578b49321789fc45b5b246e026859

\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

MD5 897cb9d3a3e2e430584af60d74fbeb27
SHA1 a3a90c9df8e7f15d0322ea8070cbf7b0b21ac1f2
SHA256 013ebaf163e5ff385f86108dbed7a20bec71603e461ab72ff40b639892fb6a7b
SHA512 2e6c4595cddefd1e603fd483d38b1468a755c654b2848a90694670313d163ca54e46ac6035615131c91da422daea86f2d1c9509b8d97a24da5ddd39d9bfb93d7

\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

MD5 5dcd1bfe185822e78f4dd54d47676eae
SHA1 ba10220f59c824742437c9b2ccdec451387c619a
SHA256 cadf8f3e87399f24f465bd681d33e72e4d40a04567f996737b3943b0759fbe40
SHA512 9b1863312339144f297fb54fb3e6b3d5da5225586c3d50ef776045dc6c1f6bed18c910eeab5c4a9121dc3f16b41f331955ac5d67e5cc9b8e3665258c162e1f4b

\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

MD5 a207d0ea9d75cc8c66d3362f7cc95f39
SHA1 c49d55cb5ea2ad27cb55c80f6f1b74013d53cbe5
SHA256 09e2b05815c729c55ab84e4c6a168effb7b92566ddd76f77ff7d81325b17b6cd
SHA512 67050348299d1d04e4598b1bc3edb5b35450f87fe951ef0e244b9a8200dffb65cd8dcd0f0ff11bacd0f84255868872c6f6131c92bf6e96ecb0839369b3805451

\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

MD5 896738a684b4792e1197acabc960b119
SHA1 6bf0accdec9bf7591738c72bd52cf1dd02ca6f6e
SHA256 3dcc23bd71152814c122b3e4e1bc9684d8a3d26ebf3137ca7bceef8ad2cf8121
SHA512 c8ce8de9572061fb78344549f59b57985eb41bfa817d8da1e6f0d81c30dbc6135f0f7f0901672991b0b47b33dc4bb12a1414e9f22d5be60aeae03e25bf31a8e5

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-24 03:06

Reported

2022-05-24 03:09

Platform

win10v2004-20220414-en

Max time kernel

154s

Max time network

183s

Command Line

"C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe"

Signatures

ElysiumStealer

stealer elysiumstealer

ElysiumStealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

ElysiumStealer Support DLL

Description Indicator Process Target
N/A N/A N/A N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A

Neshta

persistence spyware neshta

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~2.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MI391D~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MI9C33~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4780 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe
PID 4780 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe
PID 4780 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

Processes

C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

"C:\Users\Admin\AppData\Local\Temp\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4876 -ip 4876

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 1092

Network

Country Destination Domain Proto
US 20.42.65.85:443 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 13.107.42.16:443 tcp

Files

memory/4876-130-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

MD5 328363afedfb05a045788fc37273ab0b
SHA1 38a3e9d74af2b746382c8fab5666cac1b0300297
SHA256 ee7666c6cd823b082bfd9ecc8fe2c090e23e4882da3759c3d07bd5d8ade47790
SHA512 5db66eb7275c6f127117dc25612dc3fbd3ffc129057498ae2fe125526b95cf17e3a4fe56f58d72c10ec21c54e13a9aac182c3c35727219fa0f86f4e030d8f448

C:\Users\Admin\AppData\Local\Temp\3582-490\91da0c134350b0c47432593bf1d6d09bab05aa076c94c16cea90404fadbfed7c.exe

MD5 328363afedfb05a045788fc37273ab0b
SHA1 38a3e9d74af2b746382c8fab5666cac1b0300297
SHA256 ee7666c6cd823b082bfd9ecc8fe2c090e23e4882da3759c3d07bd5d8ade47790
SHA512 5db66eb7275c6f127117dc25612dc3fbd3ffc129057498ae2fe125526b95cf17e3a4fe56f58d72c10ec21c54e13a9aac182c3c35727219fa0f86f4e030d8f448

memory/4876-133-0x0000000000140000-0x0000000000344000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

MD5 94173de2e35aa8d621fc1c4f54b2a082
SHA1 fbb2266ee47f88462560f0370edb329554cd5869
SHA256 7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f
SHA512 cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

memory/4876-135-0x0000000004DA0000-0x0000000004E3C000-memory.dmp

memory/4876-136-0x0000000005480000-0x0000000005A24000-memory.dmp

memory/4876-137-0x0000000004F70000-0x0000000005002000-memory.dmp

memory/4876-138-0x0000000004E40000-0x0000000004E4A000-memory.dmp

memory/4876-139-0x0000000004ED0000-0x0000000004F26000-memory.dmp