Malware Analysis Report

2025-01-02 01:59

Sample ID 220630-3tlfwaefa6
Target 3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651
SHA256 3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651
Tags
adwind netwire botnet rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651

Threat Level: Known bad

The file 3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651 was found to be: Known bad.

Malicious Activity Summary

adwind netwire botnet rat stealer trojan

NetWire RAT payload

Netwire

AdWind

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-06-30 23:48

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-06-30 23:48

Reported

2022-06-30 23:56

Platform

win7-20220414-en

Max time kernel

163s

Max time network

48s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe"

Signatures

AdWind

trojan adwind

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Roaming\svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 848 set thread context of 2016 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Java\jre7\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre7\bin\java.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 848 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\schtasks.exe
PID 848 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\schtasks.exe
PID 848 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\schtasks.exe
PID 848 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\schtasks.exe
PID 848 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 848 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 848 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 848 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 848 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 848 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 848 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 848 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 848 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 848 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 848 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 848 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 848 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 2016 wrote to memory of 1308 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Roaming\Roaming\svchost.exe
PID 2016 wrote to memory of 1308 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Roaming\Roaming\svchost.exe
PID 2016 wrote to memory of 1308 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Roaming\Roaming\svchost.exe
PID 2016 wrote to memory of 1308 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Roaming\Roaming\svchost.exe
PID 1696 wrote to memory of 1468 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1696 wrote to memory of 1468 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1696 wrote to memory of 1468 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1468 wrote to memory of 1460 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1468 wrote to memory of 1460 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1468 wrote to memory of 1460 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1460 wrote to memory of 2000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1460 wrote to memory of 2000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1460 wrote to memory of 2000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1468 wrote to memory of 1592 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1468 wrote to memory of 1592 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1468 wrote to memory of 1592 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1592 wrote to memory of 1192 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1592 wrote to memory of 1192 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1592 wrote to memory of 1192 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1468 wrote to memory of 1748 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\xcopy.exe
PID 1468 wrote to memory of 1748 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\xcopy.exe
PID 1468 wrote to memory of 1748 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\xcopy.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe

"C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "ALGKF\ALGKF" /XML "C:\Users\Admin\AppData\Roaming\ALGKF\aqqqqq.xml"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\System32\svchost.exe"

C:\Users\Admin\AppData\Roaming\Roaming\svchost.exe

-m "C:\Windows\SysWOW64\svchost.exe"

C:\Program Files\Java\jre7\bin\javaw.exe

"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\EAWET.jar"

C:\Program Files\Java\jre7\bin\java.exe

"C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.4871153365732568949495036599929600.class

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1016837867290675563.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1016837867290675563.vbs

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8467573201941676963.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8467573201941676963.vbs

C:\Windows\system32\xcopy.exe

xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e

Network

N/A

Files

memory/848-54-0x0000000075941000-0x0000000075943000-memory.dmp

memory/848-55-0x00000000745C0000-0x0000000074B6B000-memory.dmp

memory/1292-56-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\ALGKF\aqqqqq.xml

MD5 c8325ecb9abbb228d3b5d4e84c96f320
SHA1 9a84f6658bbe3a769bb204f7667672ce936fbb87
SHA256 a85c2c8e56106858330b70f234c37b0a7f6aaae75139a88bd446b46168490b7e
SHA512 31f6b28b61d31a127e8c4dcfcd5538b127ce82e31d1ae9172085d92636687dfa159e5ff31e047b35401575b6c92987eba2da3a5d1e7eaf980a4b950bb7efe278

memory/848-58-0x00000000745C0000-0x0000000074B6B000-memory.dmp

memory/2016-59-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2016-60-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2016-62-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2016-65-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2016-69-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2016-71-0x00000000004022CA-mapping.dmp

memory/2016-74-0x0000000000400000-0x0000000000420000-memory.dmp

\Users\Admin\AppData\Roaming\Roaming\svchost.exe

MD5 54a47f6b5e09a77e61649109c6a08866
SHA1 4af001b3c3816b860660cf2de2c0fd3c1dfb4878
SHA256 121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2
SHA512 88ee0ef5af1b0b38c19ab4c307636352fc403ea74f3bfb17e246f7fd815ac042183086133cd9fe805bd47e15854776871bb7d384e419862c91503eeb82bfb419

memory/1308-77-0x0000000000000000-mapping.dmp

memory/1696-76-0x0000000000000000-mapping.dmp

memory/2016-78-0x0000000000400000-0x0000000000420000-memory.dmp

C:\Users\Admin\AppData\Roaming\Roaming\svchost.exe

MD5 54a47f6b5e09a77e61649109c6a08866
SHA1 4af001b3c3816b860660cf2de2c0fd3c1dfb4878
SHA256 121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2
SHA512 88ee0ef5af1b0b38c19ab4c307636352fc403ea74f3bfb17e246f7fd815ac042183086133cd9fe805bd47e15854776871bb7d384e419862c91503eeb82bfb419

memory/848-81-0x00000000745C0000-0x0000000074B6B000-memory.dmp

memory/1696-80-0x000007FEFBAA1000-0x000007FEFBAA3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EAWET.jar

MD5 d6d2b3e890041545cc409ab31157aa1a
SHA1 5b569bce8f9f00b2ce684738496cbffc908131f7
SHA256 fea9e7094bc95dc152f595f7b45c78ec15a76fc6ceec9812d38de6c601c4170e
SHA512 16419ec9491e8fc85a5ea7b71234e656cc33dd95703bbb6c2b05d2edf50f8f58f9bab624d395cd64e28d4ac56eb7af24f97264b79fe12d9bce4d2df1257c6ff1

memory/1696-92-0x00000000022A0000-0x00000000052A0000-memory.dmp

memory/1468-93-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\_0.4871153365732568949495036599929600.class

MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

memory/1468-100-0x0000000002200000-0x0000000005200000-memory.dmp

memory/1696-109-0x00000000022A0000-0x00000000052A0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2277218442-1199762539-2004043321-1000\83aa4cc77f591dfc2374580bbd95f6ba_4cab856c-2ae4-4cbd-8a04-329969ee64da

MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

memory/1468-111-0x0000000002200000-0x0000000005200000-memory.dmp

memory/1460-114-0x0000000000000000-mapping.dmp

memory/2000-115-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive1016837867290675563.vbs

MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

memory/1592-117-0x0000000000000000-mapping.dmp

memory/1192-118-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive8467573201941676963.vbs

MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

Analysis: behavioral2

Detonation Overview

Submitted

2022-06-30 23:48

Reported

2022-06-30 23:56

Platform

win10v2004-20220414-en

Max time kernel

174s

Max time network

182s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe"

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Roaming\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 916 set thread context of 4460 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 916 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\schtasks.exe
PID 916 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\schtasks.exe
PID 916 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\schtasks.exe
PID 916 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 916 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 916 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 916 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 916 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 916 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 916 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 916 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 916 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Windows\SysWOW64\svchost.exe
PID 4460 wrote to memory of 4812 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Roaming\Roaming\svchost.exe
PID 4460 wrote to memory of 4812 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Roaming\Roaming\svchost.exe
PID 4460 wrote to memory of 4812 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Roaming\Roaming\svchost.exe
PID 916 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
PID 916 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
PID 4452 wrote to memory of 2152 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Program Files\Java\jre1.8.0_66\bin\java.exe
PID 4452 wrote to memory of 2152 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Program Files\Java\jre1.8.0_66\bin\java.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe

"C:\Users\Admin\AppData\Local\Temp\3fa2905c28d4a7835efb745dc22ba8a033e46be44085d8db48be2a525cf3f651.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "ALGKF\ALGKF" /XML "C:\Users\Admin\AppData\Roaming\ALGKF\aOOOOO.xml"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\System32\svchost.exe"

C:\Users\Admin\AppData\Roaming\Roaming\svchost.exe

-m "C:\Windows\SysWOW64\svchost.exe"

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe

"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\EAWET.jar"

C:\Program Files\Java\jre1.8.0_66\bin\java.exe

"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.3906858704923446546710497355773653.class

Network

Country Destination Domain Proto
NL 8.248.1.254:80 tcp
US 52.168.112.67:443 tcp
IE 20.54.110.249:443 tcp
NL 20.190.160.73:443 tcp
NL 104.97.14.80:80 tcp
NL 104.97.14.80:80 tcp
US 8.247.211.126:80 tcp
NL 20.190.160.73:443 tcp
NL 20.190.160.67:443 tcp
NL 20.190.160.67:443 tcp
NL 20.190.160.2:443 tcp
NL 20.190.160.2:443 tcp
NL 20.190.160.136:443 tcp
NL 20.190.160.136:443 tcp

Files

memory/916-130-0x0000000074BC0000-0x0000000075171000-memory.dmp

memory/916-131-0x0000000074BC0000-0x0000000075171000-memory.dmp

memory/1740-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\ALGKF\aOOOOO.xml

MD5 244445d8e0121079b25f44d0b527e333
SHA1 10853217b97d2b256083e9756444552c05d7b8da
SHA256 2833be5ffc4003f66bb2d3ea80556d89cd393f4453ad269efedb4707416b9e6c
SHA512 c2a87f1f7a50eef4384e3e5d29add3e5fe841f4026d75847b83ab5a117d09694e6a29412ef82a143bad139b5ac62c7e716f38a5d74baee58d2515fcc3f2d570b

memory/4460-134-0x0000000000000000-mapping.dmp

memory/4460-136-0x0000000000400000-0x0000000000420000-memory.dmp

memory/4460-135-0x0000000000400000-0x0000000000420000-memory.dmp

memory/4460-138-0x0000000000400000-0x0000000000420000-memory.dmp

memory/4460-141-0x0000000000400000-0x0000000000420000-memory.dmp

memory/4452-143-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Roaming\svchost.exe

MD5 b7c999040d80e5bf87886d70d992c51e
SHA1 a8ed9a51cc14ccf99b670e60ebbc110756504929
SHA256 5c3257b277f160109071e7e716040e67657341d8c42aa68d9afafe1630fcc53e
SHA512 71ba2fbd705e51b488afe3bb33a67212cf297e97e8b1b20ada33e16956f7ec8f89a79e04a4b256fd61a442fada690aff0c807c2bdcc9165a9c7be3de725de309

memory/4460-145-0x0000000000400000-0x0000000000420000-memory.dmp

memory/4812-142-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\EAWET.jar

MD5 d6d2b3e890041545cc409ab31157aa1a
SHA1 5b569bce8f9f00b2ce684738496cbffc908131f7
SHA256 fea9e7094bc95dc152f595f7b45c78ec15a76fc6ceec9812d38de6c601c4170e
SHA512 16419ec9491e8fc85a5ea7b71234e656cc33dd95703bbb6c2b05d2edf50f8f58f9bab624d395cd64e28d4ac56eb7af24f97264b79fe12d9bce4d2df1257c6ff1

memory/916-147-0x0000000074BC0000-0x0000000075171000-memory.dmp

memory/4452-157-0x00000000029A0000-0x00000000039A0000-memory.dmp

memory/2152-158-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\_0.3906858704923446546710497355773653.class

MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

MD5 8f5d0c9e226a450b9170d10bcadd68e2
SHA1 174ad28520d9aedd6d6f7e0e05c878581ac37556
SHA256 ef7f258cb736b42b6b7648401d6a62b0de1a6778d070fbeff1a6fb4e8001f20d
SHA512 3438a1331638bdb686ad110cf21457c68aeefc541b6d0ae135ba334adda83415094c8e2ee65f8d2f4cc03bf4f9edb048a69e0b8fc2dadf76d9fbef00fb40ef24

memory/2152-170-0x0000000002AA0000-0x0000000003AA0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3751123196-3323558407-1869646069-1000\83aa4cc77f591dfc2374580bbd95f6ba_6bb404a8-25bc-4cef-a831-797f8d1e89c0

MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

memory/4452-179-0x00000000029A0000-0x00000000039A0000-memory.dmp

memory/4452-180-0x00000000029A0000-0x00000000039A0000-memory.dmp