Malware Analysis Report

2025-01-18 16:43

Sample ID 221001-2jed5sadb6
Target ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56
SHA256 ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56
Tags
isrstealer collection persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56

Threat Level: Known bad

The file ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56 was found to be: Known bad.

Malicious Activity Summary

isrstealer collection persistence stealer trojan upx

ISR Stealer

ISR Stealer payload

Nirsoft

NirSoft MailPassView

UPX packed file

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-01 22:36

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-01 22:36

Reported

2022-10-02 00:47

Platform

win7-20220812-en

Max time kernel

110s

Max time network

47s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe"

Signatures

ISR Stealer

trojan stealer isrstealer

ISR Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\XGdES9N8RW = "C:\\Users\\Admin\\AppData\\Roaming\\dGNIWZiH\\seb2plM.exe.lnk" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1948 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\SysWOW64\cmd.exe
PID 1500 wrote to memory of 280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1500 wrote to memory of 280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1500 wrote to memory of 280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1500 wrote to memory of 280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1948 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1948 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1948 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1948 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1948 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1948 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1948 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1948 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 872 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 872 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 872 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 872 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 872 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 872 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 872 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 872 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 908 wrote to memory of 872 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe

"C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "XGdES9N8RW" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\dGNIWZiH\seb2plM.exe.lnk"

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "XGdES9N8RW" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\dGNIWZiH\seb2plM.exe.lnk"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

/scomma "C:\Users\Admin\AppData\Local\Temp\1dZsNcm1sb.ini"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

/scomma "C:\Users\Admin\AppData\Local\Temp\yTbI9GdHKa.ini"

Network

N/A

Files

memory/1948-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

memory/1948-55-0x00000000743D0000-0x000000007497B000-memory.dmp

memory/1948-56-0x0000000000AF6000-0x0000000000B07000-memory.dmp

memory/1948-57-0x00000000743D0000-0x000000007497B000-memory.dmp

memory/1948-58-0x0000000000AF6000-0x0000000000B07000-memory.dmp

\Users\Admin\AppData\Roaming\dGNIWZiH\seb2plM.exe

MD5 d4bb706e3e461f1ccf390fc2fc786faf
SHA1 94b8dee04b501862d4b66f376a806ccaaebb4122
SHA256 ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56
SHA512 384a5639ed3e9074600430183634ba7bd52b26190041241012970e164dc6f08e6b4eef5f8d4ba9ab4ff79ad01cd08ed93e7f7e0b62662a5cce80fb2b80dee3cb

memory/1500-60-0x0000000000000000-mapping.dmp

memory/280-61-0x0000000000000000-mapping.dmp

memory/908-62-0x0000000000400000-0x0000000000442000-memory.dmp

memory/908-63-0x0000000000400000-0x0000000000442000-memory.dmp

memory/908-65-0x0000000000400000-0x0000000000442000-memory.dmp

memory/908-68-0x0000000000401180-mapping.dmp

memory/908-67-0x0000000000400000-0x0000000000442000-memory.dmp

memory/1948-71-0x0000000000AF6000-0x0000000000B07000-memory.dmp

memory/1948-70-0x00000000743D0000-0x000000007497B000-memory.dmp

memory/1164-74-0x0000000000400000-0x0000000000453000-memory.dmp

memory/1164-75-0x00000000004512E0-mapping.dmp

memory/1164-78-0x0000000000400000-0x0000000000453000-memory.dmp

memory/1164-79-0x0000000000400000-0x0000000000453000-memory.dmp

memory/908-80-0x0000000000400000-0x0000000000442000-memory.dmp

memory/1164-81-0x0000000000400000-0x0000000000453000-memory.dmp

memory/1164-82-0x0000000000400000-0x0000000000453000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1dZsNcm1sb.ini

MD5 d1ea279fb5559c020a1b4137dc4de237
SHA1 db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256 fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512 720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

memory/872-85-0x000000000041C410-mapping.dmp

memory/872-84-0x0000000000400000-0x000000000041F000-memory.dmp

memory/872-88-0x0000000000400000-0x000000000041F000-memory.dmp

memory/872-89-0x0000000000400000-0x000000000041F000-memory.dmp

memory/872-90-0x0000000000400000-0x000000000041F000-memory.dmp

memory/872-91-0x0000000000400000-0x000000000041F000-memory.dmp

memory/908-92-0x0000000000400000-0x0000000000442000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-01 22:36

Reported

2022-10-02 00:47

Platform

win10v2004-20220812-en

Max time kernel

119s

Max time network

177s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe"

Signatures

ISR Stealer

trojan stealer isrstealer

ISR Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe N/A

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XGdES9N8RW = "C:\\Users\\Admin\\AppData\\Roaming\\dGNIWZiH\\seb2plM.exe.lnk" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4764 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\SysWOW64\cmd.exe
PID 4764 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\SysWOW64\cmd.exe
PID 4764 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 2312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2864 wrote to memory of 2312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2864 wrote to memory of 2312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4764 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4764 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4764 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4764 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4764 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4764 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4764 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3500 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3500 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3500 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3500 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3500 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3500 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3500 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3500 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3796 wrote to memory of 3812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe

"C:\Users\Admin\AppData\Local\Temp\ac2cfb961139a24edca708958b6f6a72666f3f711696065435fcf169bee64a56.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "XGdES9N8RW" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\dGNIWZiH\seb2plM.exe.lnk"

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "XGdES9N8RW" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\dGNIWZiH\seb2plM.exe.lnk"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

/scomma "C:\Users\Admin\AppData\Local\Temp\dEU3zCj7jT.ini"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

/scomma "C:\Users\Admin\AppData\Local\Temp\XMNmOabcSk.ini"

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
DE 51.116.253.168:443 tcp
NL 104.80.225.205:443 tcp
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 14.110.152.52.in-addr.arpa udp
US 8.8.8.8:53 obi1.cwsurf.de udp

Files

memory/4764-132-0x0000000074D20000-0x00000000752D1000-memory.dmp

memory/4764-133-0x0000000074D20000-0x00000000752D1000-memory.dmp

memory/2864-134-0x0000000000000000-mapping.dmp

memory/2312-135-0x0000000000000000-mapping.dmp

memory/3796-136-0x0000000000000000-mapping.dmp

memory/3796-137-0x0000000000400000-0x0000000000442000-memory.dmp

memory/4764-139-0x0000000074D20000-0x00000000752D1000-memory.dmp

memory/3796-142-0x0000000000400000-0x0000000000442000-memory.dmp

memory/3500-143-0x0000000000000000-mapping.dmp

memory/3500-144-0x0000000000400000-0x0000000000453000-memory.dmp

memory/3500-146-0x0000000000400000-0x0000000000453000-memory.dmp

memory/3500-147-0x0000000000400000-0x0000000000453000-memory.dmp

memory/3500-148-0x0000000000400000-0x0000000000453000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dEU3zCj7jT.ini

MD5 d1ea279fb5559c020a1b4137dc4de237
SHA1 db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256 fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512 720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

memory/3796-150-0x0000000000400000-0x0000000000442000-memory.dmp

memory/3812-151-0x0000000000000000-mapping.dmp

memory/3812-152-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3812-154-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3812-155-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3812-156-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3812-157-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3796-158-0x0000000000400000-0x0000000000442000-memory.dmp