Malware Analysis Report

2024-11-30 15:58

Sample ID 220712-xvdvjacefp
Target 4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95
SHA256 4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95
Tags
imminent spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95

Threat Level: Known bad

The file 4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95 was found to be: Known bad.

Malicious Activity Summary

imminent spyware trojan

Imminent RAT

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

NTFS ADS

Suspicious use of WriteProcessMemory

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-12 19:10

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-12 19:10

Reported

2022-07-13 02:22

Platform

win7-20220414-en

Max time kernel

152s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe"

Signatures

Imminent RAT

trojan spyware imminent

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 756 set thread context of 1736 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\Update\Updater.exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 756 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 756 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 756 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 756 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 1224 wrote to memory of 1396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1224 wrote to memory of 1396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1224 wrote to memory of 1396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1224 wrote to memory of 1396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 756 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\tmp.exe
PID 756 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\tmp.exe
PID 756 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\tmp.exe
PID 756 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\tmp.exe
PID 756 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 756 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 756 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 756 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 756 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 756 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 756 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 756 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 756 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1736 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 1736 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 1736 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 1736 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 756 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 756 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 756 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 756 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 756 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 756 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 756 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 1140 wrote to memory of 1160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1140 wrote to memory of 1160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1140 wrote to memory of 1160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1140 wrote to memory of 1160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe

"C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe"

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Update\Updater.exe.lnk" /f

C:\Users\Admin\AppData\Local\Temp\tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp.exe"

C:\Users\Admin\AppData\Local\Temp\svhost.exe

"C:\Users\Admin\AppData\Local\Temp\svhost.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 384

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Update\Updater.exe.bat

C:\Windows\SysWOW64\timeout.exe

timeout /t 180

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp

Files

memory/756-54-0x00000000763E1000-0x00000000763E3000-memory.dmp

memory/756-55-0x0000000074660000-0x0000000074C0B000-memory.dmp

memory/1224-56-0x0000000000000000-mapping.dmp

memory/1396-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Update\Updater.exe

MD5 4b66d7bf224196da8a0a5eeb040e1a0d
SHA1 0e149b61f868b3561f495eca8a9754705a1b132e
SHA256 4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95
SHA512 ed9c4027971a6abccf5d3e1286e858a3da33741328097d92bc650c7272b6e929c3b08fdb4a07d1bf3b8b6e15c56a12d7b6994e1102517e453ebf27ba2aa5c79a

\Users\Admin\AppData\Local\Temp\Update\Updater.exe

MD5 4b66d7bf224196da8a0a5eeb040e1a0d
SHA1 0e149b61f868b3561f495eca8a9754705a1b132e
SHA256 4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95
SHA512 ed9c4027971a6abccf5d3e1286e858a3da33741328097d92bc650c7272b6e929c3b08fdb4a07d1bf3b8b6e15c56a12d7b6994e1102517e453ebf27ba2aa5c79a

\Users\Admin\AppData\Local\Temp\tmp.exe

MD5 7d596e849f4a2fa6478d4d3f5dc83e13
SHA1 02c7f54a7b10f3aeb0c4582ffa6b3eb357827b87
SHA256 f7ab67cef3dc598a937745b18685591096a95c076555598d69f0a8c4975f0064
SHA512 b0dbd754a2e837ef2f9098a48b61861575e96393ad2ced90e70052007267046f068c9ffb5fb3c645cd28e5fb3d66c7c3eee6bf8324035b402b13d51f49cfeee3

memory/1988-61-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp.exe

MD5 7d596e849f4a2fa6478d4d3f5dc83e13
SHA1 02c7f54a7b10f3aeb0c4582ffa6b3eb357827b87
SHA256 f7ab67cef3dc598a937745b18685591096a95c076555598d69f0a8c4975f0064
SHA512 b0dbd754a2e837ef2f9098a48b61861575e96393ad2ced90e70052007267046f068c9ffb5fb3c645cd28e5fb3d66c7c3eee6bf8324035b402b13d51f49cfeee3

C:\Users\Admin\AppData\Local\Temp\tmp.exe

MD5 7d596e849f4a2fa6478d4d3f5dc83e13
SHA1 02c7f54a7b10f3aeb0c4582ffa6b3eb357827b87
SHA256 f7ab67cef3dc598a937745b18685591096a95c076555598d69f0a8c4975f0064
SHA512 b0dbd754a2e837ef2f9098a48b61861575e96393ad2ced90e70052007267046f068c9ffb5fb3c645cd28e5fb3d66c7c3eee6bf8324035b402b13d51f49cfeee3

\Users\Admin\AppData\Local\Temp\svhost.exe

MD5 2e5f1cf69f92392f8829fc9c9263ae9b
SHA1 97b9ca766bbbdaa8c9ec960dc41b598f7fad82a5
SHA256 51985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b
SHA512 f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883

memory/1736-65-0x0000000000400000-0x0000000000456000-memory.dmp

memory/1736-66-0x0000000000400000-0x0000000000456000-memory.dmp

memory/1736-68-0x0000000000400000-0x0000000000456000-memory.dmp

memory/1736-69-0x0000000000400000-0x0000000000456000-memory.dmp

memory/1736-70-0x0000000000400000-0x0000000000456000-memory.dmp

memory/1736-71-0x0000000000451EDE-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\svhost.exe

MD5 2e5f1cf69f92392f8829fc9c9263ae9b
SHA1 97b9ca766bbbdaa8c9ec960dc41b598f7fad82a5
SHA256 51985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b
SHA512 f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883

memory/1736-74-0x0000000000400000-0x0000000000456000-memory.dmp

memory/1736-76-0x0000000000400000-0x0000000000456000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svhost.exe

MD5 2e5f1cf69f92392f8829fc9c9263ae9b
SHA1 97b9ca766bbbdaa8c9ec960dc41b598f7fad82a5
SHA256 51985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b
SHA512 f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883

memory/1952-79-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\svhost.exe

MD5 2e5f1cf69f92392f8829fc9c9263ae9b
SHA1 97b9ca766bbbdaa8c9ec960dc41b598f7fad82a5
SHA256 51985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b
SHA512 f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883

\Users\Admin\AppData\Local\Temp\svhost.exe

MD5 2e5f1cf69f92392f8829fc9c9263ae9b
SHA1 97b9ca766bbbdaa8c9ec960dc41b598f7fad82a5
SHA256 51985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b
SHA512 f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883

\Users\Admin\AppData\Local\Temp\svhost.exe

MD5 2e5f1cf69f92392f8829fc9c9263ae9b
SHA1 97b9ca766bbbdaa8c9ec960dc41b598f7fad82a5
SHA256 51985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b
SHA512 f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883

memory/1736-84-0x0000000074660000-0x0000000074C0B000-memory.dmp

memory/1988-85-0x0000000000DF0000-0x0000000000E46000-memory.dmp

memory/1140-86-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Update\Updater.exe.bat

MD5 e9aa18d65a46c29f541659d8c50ffb69
SHA1 1c96de6414501b277396e128525f4db5bde1eaef
SHA256 c8bbc82d2aaf9b0506d83a4b41b3acc6ab9a77fee1706544569e179f21b3b2a9
SHA512 8418b43c5086913c1989d7b7881d8ec7479c3572f4fef2676530b2f43a5184edbeea5536b91c50480bf6b748e70eeb7a71d7551583db2e785492493d62299afe

memory/1160-88-0x0000000000000000-mapping.dmp

memory/1988-89-0x0000000000260000-0x0000000000270000-memory.dmp

memory/1988-90-0x00000000048C0000-0x000000000496E000-memory.dmp

memory/1988-91-0x00000000004E0000-0x0000000000508000-memory.dmp

memory/1988-93-0x0000000000630000-0x0000000000646000-memory.dmp

memory/756-94-0x0000000074660000-0x0000000074C0B000-memory.dmp

memory/1736-95-0x0000000074660000-0x0000000074C0B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-12 19:10

Reported

2022-07-13 02:22

Platform

win10v2004-20220414-en

Max time kernel

155s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe"

Signatures

Imminent RAT

trojan spyware imminent

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1624 set thread context of 4992 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\Update\Updater.exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1624 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 3572 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3572 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3572 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1624 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\tmp.exe
PID 1624 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\tmp.exe
PID 1624 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\tmp.exe
PID 1624 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1624 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1624 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1624 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1624 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1624 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1624 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1624 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1624 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe C:\Windows\SysWOW64\cmd.exe
PID 4992 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 4992 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 4992 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 1996 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1996 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1996 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe

"C:\Users\Admin\AppData\Local\Temp\4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe"

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Update\Updater.exe.lnk" /f

C:\Users\Admin\AppData\Local\Temp\tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp.exe"

C:\Users\Admin\AppData\Local\Temp\svhost.exe

"C:\Users\Admin\AppData\Local\Temp\svhost.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 816

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Update\Updater.exe.bat

C:\Windows\SysWOW64\timeout.exe

timeout /t 180

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
IE 20.54.110.249:443 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp
UA 217.12.210.23:4080 tcp

Files

memory/1624-130-0x00000000746B0000-0x0000000074C61000-memory.dmp

memory/3572-131-0x0000000000000000-mapping.dmp

memory/3724-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Update\Updater.exe

MD5 4b66d7bf224196da8a0a5eeb040e1a0d
SHA1 0e149b61f868b3561f495eca8a9754705a1b132e
SHA256 4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95
SHA512 ed9c4027971a6abccf5d3e1286e858a3da33741328097d92bc650c7272b6e929c3b08fdb4a07d1bf3b8b6e15c56a12d7b6994e1102517e453ebf27ba2aa5c79a

memory/2564-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp.exe

MD5 7d596e849f4a2fa6478d4d3f5dc83e13
SHA1 02c7f54a7b10f3aeb0c4582ffa6b3eb357827b87
SHA256 f7ab67cef3dc598a937745b18685591096a95c076555598d69f0a8c4975f0064
SHA512 b0dbd754a2e837ef2f9098a48b61861575e96393ad2ced90e70052007267046f068c9ffb5fb3c645cd28e5fb3d66c7c3eee6bf8324035b402b13d51f49cfeee3

C:\Users\Admin\AppData\Local\Temp\tmp.exe

MD5 7d596e849f4a2fa6478d4d3f5dc83e13
SHA1 02c7f54a7b10f3aeb0c4582ffa6b3eb357827b87
SHA256 f7ab67cef3dc598a937745b18685591096a95c076555598d69f0a8c4975f0064
SHA512 b0dbd754a2e837ef2f9098a48b61861575e96393ad2ced90e70052007267046f068c9ffb5fb3c645cd28e5fb3d66c7c3eee6bf8324035b402b13d51f49cfeee3

memory/4992-137-0x0000000000000000-mapping.dmp

memory/4992-138-0x0000000000400000-0x0000000000456000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svhost.exe

MD5 84c42d0f2c1ae761bef884638bc1eacd
SHA1 4353881e7f4e9c7610f4e0489183b55bb58bb574
SHA256 331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3
SHA512 43c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87

C:\Users\Admin\AppData\Local\Temp\svhost.exe

MD5 84c42d0f2c1ae761bef884638bc1eacd
SHA1 4353881e7f4e9c7610f4e0489183b55bb58bb574
SHA256 331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3
SHA512 43c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87

memory/4124-142-0x0000000000000000-mapping.dmp

memory/1996-141-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Update\Updater.exe.bat

MD5 e9aa18d65a46c29f541659d8c50ffb69
SHA1 1c96de6414501b277396e128525f4db5bde1eaef
SHA256 c8bbc82d2aaf9b0506d83a4b41b3acc6ab9a77fee1706544569e179f21b3b2a9
SHA512 8418b43c5086913c1989d7b7881d8ec7479c3572f4fef2676530b2f43a5184edbeea5536b91c50480bf6b748e70eeb7a71d7551583db2e785492493d62299afe

memory/2696-144-0x0000000000000000-mapping.dmp

memory/4992-145-0x00000000746B0000-0x0000000074C61000-memory.dmp

memory/4992-146-0x00000000746B0000-0x0000000074C61000-memory.dmp

memory/2564-147-0x0000000004DF0000-0x0000000004E8C000-memory.dmp

memory/2564-148-0x0000000005440000-0x00000000059E4000-memory.dmp

memory/2564-149-0x0000000005070000-0x0000000005102000-memory.dmp

memory/2564-150-0x0000000005A60000-0x0000000005AC6000-memory.dmp

memory/2564-151-0x0000000006170000-0x000000000617A000-memory.dmp

memory/1624-152-0x00000000746B0000-0x0000000074C61000-memory.dmp

memory/1624-153-0x00000000746B0000-0x0000000074C61000-memory.dmp