Malware Analysis Report

2024-11-30 16:01

Sample ID 220616-kv1yvabffp
Target 264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2
SHA256 264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2
Tags
imminent spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

Threat Level: Known bad

The file 264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2 was found to be: Known bad.

Malicious Activity Summary

imminent spyware trojan

Imminent RAT

Executes dropped EXE

Drops startup file

Loads dropped DLL

Checks computer location settings

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

NTFS ADS

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-06-16 08:56

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-06-16 08:56

Reported

2022-06-16 11:33

Platform

win7-20220414-en

Max time kernel

151s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe"

Signatures

Imminent RAT

trojan spyware imminent

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenRotate.lnk C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe\:Zone.Identifier:$DATA C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1944 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 1944 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 1944 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 1944 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 1944 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 1944 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 1944 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 1944 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 1944 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 1944 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 1944 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 1944 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 1096 wrote to memory of 852 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe
PID 1096 wrote to memory of 852 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe
PID 1096 wrote to memory of 852 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe
PID 1096 wrote to memory of 852 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe
PID 852 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe C:\Windows\SysWOW64\cmd.exe
PID 852 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe C:\Windows\SysWOW64\cmd.exe
PID 852 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe C:\Windows\SysWOW64\cmd.exe
PID 852 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe C:\Windows\SysWOW64\cmd.exe
PID 852 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe
PID 852 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe
PID 852 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe
PID 852 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe
PID 852 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe
PID 852 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe
PID 852 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe
PID 852 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe
PID 852 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe

Processes

C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe

"C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe:Zone.Identifier"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe"

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe

"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe:Zone.Identifier"

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe

"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 linkadrum.nl udp
DE 185.140.53.144:9630 linkadrum.nl tcp

Files

memory/1944-54-0x0000000000E20000-0x0000000000F32000-memory.dmp

memory/1944-55-0x00000000003A0000-0x00000000003C2000-memory.dmp

memory/1944-56-0x00000000753C1000-0x00000000753C3000-memory.dmp

memory/1728-57-0x0000000000000000-mapping.dmp

memory/2028-58-0x0000000000000000-mapping.dmp

memory/1096-59-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe

MD5 c0b375a5c4bcfc0a08699ad368de0b67
SHA1 644ec97218b4b0b41e560a1e8f57221de1b3fbf5
SHA256 264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2
SHA512 bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe

MD5 c0b375a5c4bcfc0a08699ad368de0b67
SHA1 644ec97218b4b0b41e560a1e8f57221de1b3fbf5
SHA256 264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2
SHA512 bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

memory/852-62-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe

MD5 c0b375a5c4bcfc0a08699ad368de0b67
SHA1 644ec97218b4b0b41e560a1e8f57221de1b3fbf5
SHA256 264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2
SHA512 bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

memory/852-64-0x00000000003D0000-0x00000000004E2000-memory.dmp

memory/1072-66-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe

MD5 c0b375a5c4bcfc0a08699ad368de0b67
SHA1 644ec97218b4b0b41e560a1e8f57221de1b3fbf5
SHA256 264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2
SHA512 bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe

MD5 c0b375a5c4bcfc0a08699ad368de0b67
SHA1 644ec97218b4b0b41e560a1e8f57221de1b3fbf5
SHA256 264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2
SHA512 bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

memory/1884-69-0x0000000000080000-0x00000000000D6000-memory.dmp

memory/1884-70-0x0000000000080000-0x00000000000D6000-memory.dmp

memory/1884-72-0x0000000000080000-0x00000000000D6000-memory.dmp

memory/1884-73-0x0000000000080000-0x00000000000D6000-memory.dmp

memory/1884-74-0x0000000000400000-0x0000000000456000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe

MD5 c0b375a5c4bcfc0a08699ad368de0b67
SHA1 644ec97218b4b0b41e560a1e8f57221de1b3fbf5
SHA256 264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2
SHA512 bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

memory/1884-75-0x0000000000451D1E-mapping.dmp

memory/1884-78-0x0000000000080000-0x00000000000D6000-memory.dmp

memory/1884-77-0x0000000000080000-0x00000000000D6000-memory.dmp

memory/1884-82-0x0000000000080000-0x00000000000D6000-memory.dmp

memory/1884-85-0x0000000000080000-0x00000000000D6000-memory.dmp

memory/1884-86-0x00000000004F0000-0x0000000000500000-memory.dmp

memory/1884-87-0x0000000004880000-0x000000000492E000-memory.dmp

memory/1884-88-0x0000000000700000-0x0000000000728000-memory.dmp

memory/1884-90-0x0000000001F40000-0x0000000001F56000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-06-16 08:56

Reported

2022-06-16 11:33

Platform

win10v2004-20220414-en

Max time kernel

147s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenRotate.lnk C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2364 set thread context of 2544 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe\:Zone.Identifier:$DATA C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4628 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 4628 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 4628 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 4628 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 4628 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 4628 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 4628 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 4628 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 4628 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe C:\Windows\SysWOW64\cmd.exe
PID 2312 wrote to memory of 2364 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe
PID 2312 wrote to memory of 2364 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe
PID 2312 wrote to memory of 2364 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe
PID 2364 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe C:\Windows\SysWOW64\cmd.exe
PID 2364 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe C:\Windows\SysWOW64\cmd.exe
PID 2364 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe C:\Windows\SysWOW64\cmd.exe
PID 2364 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe
PID 2364 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe
PID 2364 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe
PID 2364 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe
PID 2364 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe
PID 2364 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe
PID 2364 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe
PID 2364 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe

Processes

C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe

"C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe:Zone.Identifier"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe"

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe

"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe:Zone.Identifier"

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe

Network

Country Destination Domain Proto
NL 20.190.160.67:443 tcp
NL 88.221.144.192:80 tcp
NL 88.221.144.192:80 tcp
NL 20.190.160.6:443 tcp
NL 20.190.160.69:443 tcp
NL 20.190.160.4:443 tcp
NL 20.190.160.134:443 tcp
NL 20.190.160.8:443 tcp
US 204.79.197.200:443 tcp
NL 20.190.160.71:443 tcp

Files

memory/4628-130-0x00000000005C0000-0x00000000006D2000-memory.dmp

memory/4628-131-0x0000000004FE0000-0x0000000005002000-memory.dmp

memory/4628-132-0x00000000050B0000-0x0000000005142000-memory.dmp

memory/4628-133-0x0000000005150000-0x00000000051B6000-memory.dmp

memory/4628-134-0x0000000005040000-0x0000000005062000-memory.dmp

memory/4628-135-0x0000000005390000-0x0000000005552000-memory.dmp

memory/2952-136-0x0000000000000000-mapping.dmp

memory/4628-137-0x0000000006330000-0x00000000068D4000-memory.dmp

memory/4764-138-0x0000000000000000-mapping.dmp

memory/2312-139-0x0000000000000000-mapping.dmp

memory/2364-140-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe

MD5 c0b375a5c4bcfc0a08699ad368de0b67
SHA1 644ec97218b4b0b41e560a1e8f57221de1b3fbf5
SHA256 264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2
SHA512 bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe

MD5 c0b375a5c4bcfc0a08699ad368de0b67
SHA1 644ec97218b4b0b41e560a1e8f57221de1b3fbf5
SHA256 264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2
SHA512 bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

memory/3036-143-0x0000000000000000-mapping.dmp

memory/2364-144-0x0000000007470000-0x000000000750C000-memory.dmp

memory/2544-145-0x0000000000000000-mapping.dmp

memory/2544-146-0x0000000000400000-0x0000000000456000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe

MD5 c0b375a5c4bcfc0a08699ad368de0b67
SHA1 644ec97218b4b0b41e560a1e8f57221de1b3fbf5
SHA256 264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2
SHA512 bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c