Malware Analysis Report

2024-11-15 08:09

Sample ID 221003-bstmbacadk
Target 366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b
SHA256 366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b
Tags
imminent persistence spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b

Threat Level: Known bad

The file 366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b was found to be: Known bad.

Malicious Activity Summary

imminent persistence spyware trojan

Imminent RAT

Executes dropped EXE

Deletes itself

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in Windows directory

Enumerates physical storage devices

Enumerates system info in registry

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-03 01:24

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-03 01:24

Reported

2022-10-03 06:29

Platform

win10v2004-20220812-en

Max time kernel

45s

Max time network

50s

Command Line

"C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe"

Signatures

Imminent RAT

trojan spyware imminent

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IgfxTray = "C:\\Users\\Admin\\AppData\\Roaming\\Intel Corporation\\igfxtray.exe" C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IgfxTray = "\\Intel Corporation\\igfxtray.exe" C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2604 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe
PID 2604 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe
PID 2604 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe
PID 2604 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Windows\SysWOW64\cmd.exe
PID 2768 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2768 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2768 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2196 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2196 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2196 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

Processes

C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe

"C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe"

C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe

"C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe"

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 1000

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 1528

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
IE 20.82.228.9:443 tcp
US 8.8.8.8:53 microsoftcorporation.duckdns.org udp
IE 52.109.77.0:443 tcp
US 192.169.69.25:82 microsoftcorporation.duckdns.org tcp
US 93.184.220.29:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 93.184.220.29:80 tcp
NL 104.80.225.205:443 tcp
US 192.169.69.25:82 microsoftcorporation.duckdns.org tcp
FR 40.79.150.121:443 tcp

Files

memory/2604-132-0x0000000075210000-0x00000000757C1000-memory.dmp

memory/2196-133-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe

MD5 74e3fa4922117a3590762f656b370460
SHA1 366230a669899cf18bed70829fbfe4988fd784bc
SHA256 366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b
SHA512 6bae7a1e7f83a65d486731eb2c9638e18a485e535304c0f3dfaa746f50a21a3ea6e23db7e5407ed063b08261831475fbf8826506cbf1d2574a9d320670c48a8a

C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe

MD5 74e3fa4922117a3590762f656b370460
SHA1 366230a669899cf18bed70829fbfe4988fd784bc
SHA256 366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b
SHA512 6bae7a1e7f83a65d486731eb2c9638e18a485e535304c0f3dfaa746f50a21a3ea6e23db7e5407ed063b08261831475fbf8826506cbf1d2574a9d320670c48a8a

memory/2768-136-0x0000000000000000-mapping.dmp

memory/2604-137-0x0000000075210000-0x00000000757C1000-memory.dmp

memory/2740-138-0x0000000000000000-mapping.dmp

memory/2196-139-0x0000000075210000-0x00000000757C1000-memory.dmp

memory/2196-140-0x0000000075210000-0x00000000757C1000-memory.dmp

memory/3240-141-0x0000000000000000-mapping.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-03 01:24

Reported

2022-10-03 06:29

Platform

win7-20220812-en

Max time kernel

149s

Max time network

45s

Command Line

"C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe"

Signatures

Imminent RAT

trojan spyware imminent

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\IgfxTray = "\\Intel Corporation\\igfxtray.exe" C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\IgfxTray = "C:\\Users\\Admin\\AppData\\Roaming\\Intel Corporation\\igfxtray.exe" C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1976 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe
PID 1976 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe
PID 1976 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe
PID 1976 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe
PID 1976 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe C:\Windows\SysWOW64\cmd.exe
PID 1368 wrote to memory of 1992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1368 wrote to memory of 1992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1368 wrote to memory of 1992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1368 wrote to memory of 1992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe

"C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe"

C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe

"C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe"

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 1000

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoftcorporation.duckdns.org udp
US 192.169.69.25:82 microsoftcorporation.duckdns.org tcp
US 192.169.69.25:82 microsoftcorporation.duckdns.org tcp
US 192.169.69.25:82 microsoftcorporation.duckdns.org tcp

Files

memory/1976-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

memory/1976-55-0x0000000075040000-0x00000000755EB000-memory.dmp

\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe

MD5 74e3fa4922117a3590762f656b370460
SHA1 366230a669899cf18bed70829fbfe4988fd784bc
SHA256 366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b
SHA512 6bae7a1e7f83a65d486731eb2c9638e18a485e535304c0f3dfaa746f50a21a3ea6e23db7e5407ed063b08261831475fbf8826506cbf1d2574a9d320670c48a8a

C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe

MD5 74e3fa4922117a3590762f656b370460
SHA1 366230a669899cf18bed70829fbfe4988fd784bc
SHA256 366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b
SHA512 6bae7a1e7f83a65d486731eb2c9638e18a485e535304c0f3dfaa746f50a21a3ea6e23db7e5407ed063b08261831475fbf8826506cbf1d2574a9d320670c48a8a

memory/1364-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b\366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b.exe

MD5 74e3fa4922117a3590762f656b370460
SHA1 366230a669899cf18bed70829fbfe4988fd784bc
SHA256 366637c07a173edd0f75c648329d28ccd90b3023e36d9f0d286cd0b4fb20d16b
SHA512 6bae7a1e7f83a65d486731eb2c9638e18a485e535304c0f3dfaa746f50a21a3ea6e23db7e5407ed063b08261831475fbf8826506cbf1d2574a9d320670c48a8a

memory/1368-61-0x0000000000000000-mapping.dmp

memory/1992-62-0x0000000000000000-mapping.dmp

memory/1976-63-0x0000000075040000-0x00000000755EB000-memory.dmp

memory/1364-64-0x0000000075040000-0x00000000755EB000-memory.dmp

memory/1364-65-0x0000000075040000-0x00000000755EB000-memory.dmp