Malware Analysis Report

2025-06-16 06:49

Sample ID 220901-hmxkcahfep
Target 6a6b2af0716cb8308dddae55dd325253.bin
SHA256 2cb6acd25b8d00468dd89658dc948836f92000e031085b6b3c798eb1504157df
Tags
njrat nyan cat evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2cb6acd25b8d00468dd89658dc948836f92000e031085b6b3c798eb1504157df

Threat Level: Known bad

The file 6a6b2af0716cb8308dddae55dd325253.bin was found to be: Known bad.

Malicious Activity Summary

njrat nyan cat evasion persistence trojan

njRAT/Bladabindi

Windows security bypass

UAC bypass

Looks for VirtualBox Guest Additions in registry

Grants admin privileges

Looks for VMWare Tools registry key

Windows security modification

Checks computer location settings

Checks BIOS information in registry

Maps connected drives based on registry

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Runs net.exe

Suspicious use of AdjustPrivilegeToken

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-09-01 06:51

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-09-01 06:51

Reported

2022-09-01 07:19

Platform

win7-20220812-en

Max time kernel

140s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe"

Signatures

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Extensions C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe = "0" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\b9xe33Q\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

njRAT/Bladabindi

trojan njrat

Grants admin privileges

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe = "0" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\b9xe33Q\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Extensions C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\rF0bq16 = "C:\\Windows\\Microsoft.NET\\Framework\\b9xe33Q\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rF0bq16 = "C:\\Windows\\Microsoft.NET\\Framework\\b9xe33Q\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ROCKS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6a6b2af0716cb8308dddae55dd325253.exe\"" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1832 set thread context of 832 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\b9xe33Q\svchost.exe C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\b9xe33Q C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\w6qHIwG.raw C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1832 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1832 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1832 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1832 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1496 wrote to memory of 636 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1496 wrote to memory of 636 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1496 wrote to memory of 636 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1496 wrote to memory of 636 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1832 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1832 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1832 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1832 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1528 wrote to memory of 1412 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1528 wrote to memory of 1412 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1528 wrote to memory of 1412 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1528 wrote to memory of 1412 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1832 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1832 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1832 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1832 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 464 wrote to memory of 2012 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 464 wrote to memory of 2012 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 464 wrote to memory of 2012 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 464 wrote to memory of 2012 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1832 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1832 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1832 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1832 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1320 wrote to memory of 1324 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1320 wrote to memory of 1324 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1320 wrote to memory of 1324 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1320 wrote to memory of 1324 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1832 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\schtasks.exe
PID 1832 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\schtasks.exe
PID 1832 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\schtasks.exe
PID 1832 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\schtasks.exe
PID 1832 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe

"C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe" -Force

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" user ADMIN~1 SECRET@1234 /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 user ADMIN~1 SECRET@1234 /add

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" localgroup administrators ADMIN~1 /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup administrators ADMIN~1 /add

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" localgroup users "Admin" /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup users "Admin" /add

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" localgroup administrators "Admin" /del

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup administrators "Admin" /del

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\system32\schtasks.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\b9xe33Q\svchost.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\b9xe33Q\svchost.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe" -Force

C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 4Mekey.myftp.biz udp
US 198.23.212.148:2411 4Mekey.myftp.biz tcp

Files

memory/1832-54-0x0000000000E70000-0x0000000000FDC000-memory.dmp

memory/1832-55-0x00000000043E0000-0x000000000447C000-memory.dmp

memory/1832-56-0x0000000000420000-0x0000000000436000-memory.dmp

memory/1832-57-0x0000000076401000-0x0000000076403000-memory.dmp

memory/2020-58-0x0000000000000000-mapping.dmp

memory/1496-60-0x0000000000000000-mapping.dmp

memory/636-61-0x0000000000000000-mapping.dmp

memory/1528-62-0x0000000000000000-mapping.dmp

memory/1412-63-0x0000000000000000-mapping.dmp

\??\PIPE\samr

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/464-65-0x0000000000000000-mapping.dmp

memory/2020-66-0x0000000070070000-0x000000007061B000-memory.dmp

memory/2012-67-0x0000000000000000-mapping.dmp

\??\PIPE\samr

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1320-69-0x0000000000000000-mapping.dmp

memory/1324-70-0x0000000000000000-mapping.dmp

\??\PIPE\samr

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1056-72-0x0000000000000000-mapping.dmp

memory/1904-73-0x0000000000000000-mapping.dmp

memory/1492-74-0x0000000000000000-mapping.dmp

memory/1616-75-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 64f2556b18e31b1a25f194931eebf4c0
SHA1 fd8eed8149a90c7535a5f5f723ce18c8c9808d1f
SHA256 59a44bc4130a029d0bf24605b9db94aee57b0b6805514e5f32b3a9ba18fda82f
SHA512 5c253bf3aee393365d2108dc5a43f73b81771d45f4ee15ef33dedca90d1ada5b5a9789a14ed32e435d1bd02a6b1463c3ab019ebcfac028d100fbf6902f48c1d3

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 64f2556b18e31b1a25f194931eebf4c0
SHA1 fd8eed8149a90c7535a5f5f723ce18c8c9808d1f
SHA256 59a44bc4130a029d0bf24605b9db94aee57b0b6805514e5f32b3a9ba18fda82f
SHA512 5c253bf3aee393365d2108dc5a43f73b81771d45f4ee15ef33dedca90d1ada5b5a9789a14ed32e435d1bd02a6b1463c3ab019ebcfac028d100fbf6902f48c1d3

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 64f2556b18e31b1a25f194931eebf4c0
SHA1 fd8eed8149a90c7535a5f5f723ce18c8c9808d1f
SHA256 59a44bc4130a029d0bf24605b9db94aee57b0b6805514e5f32b3a9ba18fda82f
SHA512 5c253bf3aee393365d2108dc5a43f73b81771d45f4ee15ef33dedca90d1ada5b5a9789a14ed32e435d1bd02a6b1463c3ab019ebcfac028d100fbf6902f48c1d3

memory/1904-82-0x0000000070070000-0x000000007061B000-memory.dmp

memory/1492-83-0x0000000070070000-0x000000007061B000-memory.dmp

memory/1616-84-0x0000000070070000-0x000000007061B000-memory.dmp

memory/1296-85-0x0000000000000000-mapping.dmp

memory/1408-86-0x0000000000000000-mapping.dmp

memory/2012-88-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 64f2556b18e31b1a25f194931eebf4c0
SHA1 fd8eed8149a90c7535a5f5f723ce18c8c9808d1f
SHA256 59a44bc4130a029d0bf24605b9db94aee57b0b6805514e5f32b3a9ba18fda82f
SHA512 5c253bf3aee393365d2108dc5a43f73b81771d45f4ee15ef33dedca90d1ada5b5a9789a14ed32e435d1bd02a6b1463c3ab019ebcfac028d100fbf6902f48c1d3

memory/1904-92-0x0000000070070000-0x000000007061B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 64f2556b18e31b1a25f194931eebf4c0
SHA1 fd8eed8149a90c7535a5f5f723ce18c8c9808d1f
SHA256 59a44bc4130a029d0bf24605b9db94aee57b0b6805514e5f32b3a9ba18fda82f
SHA512 5c253bf3aee393365d2108dc5a43f73b81771d45f4ee15ef33dedca90d1ada5b5a9789a14ed32e435d1bd02a6b1463c3ab019ebcfac028d100fbf6902f48c1d3

memory/1616-94-0x0000000070070000-0x000000007061B000-memory.dmp

memory/1492-95-0x0000000070070000-0x000000007061B000-memory.dmp

memory/1296-96-0x0000000070070000-0x000000007061B000-memory.dmp

memory/1408-97-0x0000000070070000-0x000000007061B000-memory.dmp

memory/2012-99-0x0000000070070000-0x000000007061B000-memory.dmp

memory/2020-98-0x0000000070070000-0x000000007061B000-memory.dmp

memory/1408-101-0x0000000070070000-0x000000007061B000-memory.dmp

memory/1296-100-0x0000000070070000-0x000000007061B000-memory.dmp

memory/832-103-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2012-102-0x0000000070070000-0x000000007061B000-memory.dmp

memory/832-104-0x0000000000400000-0x000000000040C000-memory.dmp

memory/832-106-0x0000000000400000-0x000000000040C000-memory.dmp

memory/832-107-0x0000000000400000-0x000000000040C000-memory.dmp

memory/832-109-0x000000000040676E-mapping.dmp

memory/832-108-0x0000000000400000-0x000000000040C000-memory.dmp

memory/832-111-0x0000000000400000-0x000000000040C000-memory.dmp

memory/832-113-0x0000000000400000-0x000000000040C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-09-01 06:51

Reported

2022-09-01 07:19

Platform

win10v2004-20220812-en

Max time kernel

148s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe"

Signatures

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe = "0" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\b9xe33Q\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

njRAT/Bladabindi

trojan njrat

Grants admin privileges

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe = "0" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\b9xe33Q\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ROCKS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6a6b2af0716cb8308dddae55dd325253.exe\"" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rF0bq16 = "C:\\Windows\\Microsoft.NET\\Framework\\b9xe33Q\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rF0bq16 = "C:\\Windows\\Microsoft.NET\\Framework\\b9xe33Q\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4920 set thread context of 2236 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework\b9xe33Q C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\w6qHIwG.raw C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
File created C:\Windows\Microsoft.NET\Framework\b9xe33Q\svchost.exe C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4920 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 4920 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 4920 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 1812 wrote to memory of 1104 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1812 wrote to memory of 1104 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1812 wrote to memory of 1104 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4920 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 4920 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 4920 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 4108 wrote to memory of 2108 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4108 wrote to memory of 2108 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4108 wrote to memory of 2108 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4920 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 4920 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 4920 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 532 wrote to memory of 2664 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 532 wrote to memory of 2664 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 532 wrote to memory of 2664 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4920 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 4920 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 4920 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\net.exe
PID 344 wrote to memory of 1076 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 344 wrote to memory of 1076 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 344 wrote to memory of 1076 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4920 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\schtasks.exe
PID 4920 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\schtasks.exe
PID 4920 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\schtasks.exe
PID 4920 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
PID 4920 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
PID 4920 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4920 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4920 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4920 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4920 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4920 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4920 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4920 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe

"C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe" -Force

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" user ADMIN~1 SECRET@1234 /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 user ADMIN~1 SECRET@1234 /add

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" localgroup administrators ADMIN~1 /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup administrators ADMIN~1 /add

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" localgroup users "Admin" /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup users "Admin" /add

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" localgroup administrators "Admin" /del

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup administrators "Admin" /del

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\system32\schtasks.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\b9xe33Q\svchost.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\b9xe33Q\svchost.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe" -Force

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.253.208.113:80 tcp
NL 40.126.32.138:443 tcp
US 8.8.8.8:53 4Mekey.myftp.biz udp
US 198.23.212.148:2411 4Mekey.myftp.biz tcp
US 93.184.220.29:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 8.253.208.113:80 tcp
BE 67.27.153.254:80 tcp
US 93.184.220.29:80 tcp
US 198.23.212.148:2411 4Mekey.myftp.biz tcp
US 20.42.65.84:443 tcp
US 8.253.208.113:80 tcp
US 8.253.208.113:80 tcp
US 8.253.208.113:80 tcp

Files

memory/4920-132-0x0000000000C90000-0x0000000000DFC000-memory.dmp

memory/4920-133-0x0000000005940000-0x00000000059DC000-memory.dmp

memory/4920-134-0x0000000007200000-0x00000000077A4000-memory.dmp

memory/4920-135-0x0000000006D40000-0x0000000006DA6000-memory.dmp

memory/4768-136-0x0000000000000000-mapping.dmp

memory/4768-137-0x00000000023A0000-0x00000000023D6000-memory.dmp

memory/4768-138-0x0000000004EA0000-0x00000000054C8000-memory.dmp

memory/1812-139-0x0000000000000000-mapping.dmp

memory/4768-140-0x0000000004E50000-0x0000000004E72000-memory.dmp

memory/1104-141-0x0000000000000000-mapping.dmp

memory/4768-142-0x0000000005570000-0x00000000055D6000-memory.dmp

memory/4108-143-0x0000000000000000-mapping.dmp

memory/2108-144-0x0000000000000000-mapping.dmp

memory/532-145-0x0000000000000000-mapping.dmp

memory/2664-146-0x0000000000000000-mapping.dmp

memory/4768-147-0x0000000005C20000-0x0000000005C3E000-memory.dmp

memory/344-148-0x0000000000000000-mapping.dmp

memory/1076-149-0x0000000000000000-mapping.dmp

memory/4496-150-0x0000000000000000-mapping.dmp

memory/368-151-0x0000000000000000-mapping.dmp

memory/2380-152-0x0000000000000000-mapping.dmp

memory/3228-153-0x0000000000000000-mapping.dmp

memory/4920-154-0x0000000007850000-0x00000000078E2000-memory.dmp

memory/4920-155-0x00000000077E0000-0x00000000077EA000-memory.dmp

memory/3152-156-0x0000000000000000-mapping.dmp

memory/1804-157-0x0000000000000000-mapping.dmp

memory/1932-158-0x0000000000000000-mapping.dmp

memory/4256-159-0x0000000000000000-mapping.dmp

memory/4768-160-0x00000000061E0000-0x0000000006212000-memory.dmp

memory/4768-161-0x0000000070630000-0x000000007067C000-memory.dmp

memory/2236-162-0x0000000000000000-mapping.dmp

memory/2236-164-0x0000000000400000-0x000000000040C000-memory.dmp

memory/4768-163-0x00000000061C0000-0x00000000061DE000-memory.dmp

memory/4768-166-0x0000000006F20000-0x0000000006F3A000-memory.dmp

memory/4768-165-0x0000000007560000-0x0000000007BDA000-memory.dmp

memory/4768-167-0x0000000006F90000-0x0000000006F9A000-memory.dmp

memory/4768-168-0x00000000071A0000-0x0000000007236000-memory.dmp

memory/368-169-0x0000000070630000-0x000000007067C000-memory.dmp

memory/2380-170-0x0000000070630000-0x000000007067C000-memory.dmp

memory/3228-171-0x0000000070630000-0x000000007067C000-memory.dmp

memory/4768-172-0x0000000007160000-0x000000000716E000-memory.dmp

memory/3152-173-0x0000000070630000-0x000000007067C000-memory.dmp

memory/4768-174-0x0000000007270000-0x000000000728A000-memory.dmp

memory/1932-175-0x0000000070630000-0x000000007067C000-memory.dmp

memory/1804-176-0x0000000070630000-0x000000007067C000-memory.dmp

memory/4768-177-0x0000000007250000-0x0000000007258000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7c3087a0aee7c503ba955ae610dbe17f
SHA1 a54f5fb575aaeb82a2173f8c35fdd998e8fbd6f8
SHA256 3bb2c4a3ea0d707277302c1db7325caec9fecb57ba70cc16f572bbc95a240290
SHA512 9b6b443ab98c1b331dcb6d61e92ed67f1470f51f5c780f80a669c93ab10e41d60d17d9e3f2aeee379d08c2854188a988ee7709285d1d4ace7e444994c46ae02f

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7c3087a0aee7c503ba955ae610dbe17f
SHA1 a54f5fb575aaeb82a2173f8c35fdd998e8fbd6f8
SHA256 3bb2c4a3ea0d707277302c1db7325caec9fecb57ba70cc16f572bbc95a240290
SHA512 9b6b443ab98c1b331dcb6d61e92ed67f1470f51f5c780f80a669c93ab10e41d60d17d9e3f2aeee379d08c2854188a988ee7709285d1d4ace7e444994c46ae02f

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 668c5594ff4dd020220942a9ac26b6ef
SHA1 b8af808417375697f20ccedc0566c227ea724b88
SHA256 7e21033009816712729472a94727ec2996499b22f8eacc5eb3cfbec7283ed50e
SHA512 c5c7de4128a88c296324ef6d5e2bd67ee6da8aca6489632855d9b8f8d1a59d66cf87a1e3b2e2f03a932c4c38ecfa5cd3394d5191671e92442c63d6898ba4a299

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cbb25066e0804b16bfc9f752af051ea6
SHA1 4b5bb186ab6c62a8cd80e995a71f93369d19f35e
SHA256 78b8f76876de25a28bf87c39da2dd0b2c01e70bfc101c8d25aad046db376527c
SHA512 73baf74d38102a7ae9b9617b1db471e09032f0c9376b091f0d76f019e0ade49bee4115a791d3aed250c48417c9f6910791fa6742f50a63b8be1d19f8e6686bac

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6fd551029db2c93e1a1d8b9d7cf0d816
SHA1 3e35dc141094c434a000627d446c2558a0d8b961
SHA256 420326958326c6db11d8ff589d6f72f7efbf7acfa37befe9345a64d126077014
SHA512 9545da834b53bd693eda01b8a828eddc3964288ab0f1ba8ffde54a85a9357fde50e133c9ba9527df68f9abeec7c2d15db0ffcb07463d6b2f95404d823d29c4f6

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b8c6445e99c777b6a50e4e20d9c403d7
SHA1 208ab6812378b5ca3aa946049c8a6f8178168677
SHA256 139634c39cc9afbeb22ea86ff528eb196f8dbfc592cc8a9e5b2ff15e199cf77a
SHA512 eb3ad9ddc2843b22e7f198f0b88a5e92a8da0463b48a54d74c7b1a7314012d3670efede4766b9a0c7c161835b6237847c7ccca77fe4e56c3d0216193b371ed05