Malware Analysis Report

2025-08-10 19:47

Sample ID 221115-nrqv9adg24
Target RFQ.exe
SHA256 f2c7a204dd011ce0e8466c7fdd0e62de4e5bd919c00846233e8dd7adca7c1888
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f2c7a204dd011ce0e8466c7fdd0e62de4e5bd919c00846233e8dd7adca7c1888

Threat Level: Known bad

The file RFQ.exe was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Modifies registry class

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-15 11:38

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-15 11:38

Reported

2022-11-15 11:40

Platform

win10v2004-20220812-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RFQ.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8_77\\Update.vbs" C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Monitor = "C:\\Program Files (x86)\\AGP Monitor\\agpmon.exe" C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8_77\\ihnevm.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\8_77\\ooxfh.rcj" C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4804 set thread context of 4768 N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\AGP Monitor\agpmon.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
File opened for modification C:\Program Files (x86)\AGP Monitor\agpmon.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\RFQ.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\SysWOW64\WScript.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\RFQ.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\8_77\brriiae.vbe"

C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe

"C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe" ooxfh.rcj

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"

Network

Country Destination Domain Proto
N/A 8.238.110.126:80 tcp
N/A 93.184.220.29:80 tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 20.189.173.10:443 tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 8.8.8.8:53 176.122.125.40.in-addr.arpa udp
N/A 8.8.4.4:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.238.110.126:80 tcp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp

Files

memory/4952-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\temp\8_77\brriiae.vbe

MD5 dd6f3886e42acd338b4283cdf14d0579
SHA1 c453b254b9e91972b1c797218124e10d328598d0
SHA256 aa089ac025032b2d9dad118c3b6ed01ab1690bbd6e2a80ee5a6fa4155c8b62b2
SHA512 e23ffb60eff82d7589feb08b2096608e2e4ecad26514c912837f895f1a4a9690bf1e5c71364c7acff37183d827a19bab193e82d5566d4e0e45e781e9c9533791

C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe

MD5 2ce687e95f82d96214d6b0b7a3b6d83c
SHA1 2e86f893b398aec16f74fc799b29f2c7d14ba7bb
SHA256 48ba8154619448b749e4003781ddccf2da6696f7070dc95e3068b646aab9ace0
SHA512 5949c2807cf4dfc9f04500aac97cc2c9d05f1e195ed43055a79c07877cef76c9aba73f46b658c2ac1d47d12b9510dc0592c1c72ca7845d9f85fa368aa56f4055

memory/4804-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe

MD5 2ce687e95f82d96214d6b0b7a3b6d83c
SHA1 2e86f893b398aec16f74fc799b29f2c7d14ba7bb
SHA256 48ba8154619448b749e4003781ddccf2da6696f7070dc95e3068b646aab9ace0
SHA512 5949c2807cf4dfc9f04500aac97cc2c9d05f1e195ed43055a79c07877cef76c9aba73f46b658c2ac1d47d12b9510dc0592c1c72ca7845d9f85fa368aa56f4055

C:\Users\Admin\AppData\Local\Temp\8_77\ooxfh.rcj

MD5 3a3c904e6c0654518f8d976cbb225c79
SHA1 4cfaabc24ed7966c781dfa8dbb1b7bcb33733d68
SHA256 34a18bc96439be289cc16dd9dfc9e69f2a588d70a5024c3a57f099a2fdb0dd5e
SHA512 75a230ffea7e5c4b22150bc8d384afb178caeb54ec094451b330b6a6ff5de16bd08f0496e8a75550bc65fde0c65c99418c3f5359596aa0a1ce3e09244ef3ab7c

C:\Users\Admin\AppData\Local\Temp\8_77\twephvk.pdf

MD5 72bc84cf478aa689ba12c46705f99173
SHA1 6893a837376c41b088745fede67e7b806da31453
SHA256 fbd5c66fbf2346f5b0e5fe3d2d3d9dfb89cd1dcc316878b728108d8460f694c7
SHA512 a009917d69205a209392b855fd932f262e5468c526e3141a8fd65da1a8c1f59395962dede7b95a8ad1e19eb2c81851304848471db9e8d49985e8dc5310985caf

C:\Users\Admin\AppData\Local\Temp\8_77\xatpvu.tch

MD5 32c53d0d3e94095c0280fa448820b3e6
SHA1 8006048315b51f05f52525c62410b02d0e467ad0
SHA256 feb773a8447581c11e82e03c25762663f1b7712a849dd2e06e7e0e4db98462b9
SHA512 0e314182e5bbb0a2a1ec40be13dbeb3805dd528701479199e02addba2b295b16f4c2768876d39009fa494013106d5e2485eaff8aa9dd446b9d4b64b4ad78a7bc

memory/4768-140-0x0000000000000000-mapping.dmp

memory/4768-141-0x0000000000900000-0x0000000000FB9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

memory/4768-144-0x0000000000900000-0x0000000000938000-memory.dmp

memory/4768-145-0x0000000005BA0000-0x0000000006144000-memory.dmp

memory/4768-146-0x0000000005500000-0x0000000005592000-memory.dmp

memory/4768-147-0x0000000005690000-0x000000000572C000-memory.dmp

memory/4768-148-0x00000000055B0000-0x00000000055BA000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-15 11:38

Reported

2022-11-15 11:40

Platform

win7-20221111-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8_77\\ihnevm.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\8_77\\ooxfh.rcj" C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8_77\\Update.vbs" C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Subsystem = "C:\\Program Files (x86)\\DDP Subsystem\\ddpss.exe" C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1508 set thread context of 820 N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DDP Subsystem\ddpss.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
File opened for modification C:\Program Files (x86)\DDP Subsystem\ddpss.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1232 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.exe C:\Windows\SysWOW64\WScript.exe
PID 1232 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.exe C:\Windows\SysWOW64\WScript.exe
PID 1232 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.exe C:\Windows\SysWOW64\WScript.exe
PID 1232 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.exe C:\Windows\SysWOW64\WScript.exe
PID 2032 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe
PID 2032 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe
PID 2032 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe
PID 2032 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe
PID 2032 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe
PID 2032 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe
PID 2032 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe
PID 1508 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1508 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1508 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1508 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1508 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1508 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1508 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1508 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1508 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\RFQ.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\8_77\brriiae.vbe"

C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe

"C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe" ooxfh.rcj

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp
N/A 8.8.8.8:53 azizurfattahtradin.ddns.net udp
N/A 91.193.75.132:7664 azizurfattahtradin.ddns.net tcp

Files

memory/1232-54-0x0000000076391000-0x0000000076393000-memory.dmp

memory/2032-55-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\temp\8_77\brriiae.vbe

MD5 dd6f3886e42acd338b4283cdf14d0579
SHA1 c453b254b9e91972b1c797218124e10d328598d0
SHA256 aa089ac025032b2d9dad118c3b6ed01ab1690bbd6e2a80ee5a6fa4155c8b62b2
SHA512 e23ffb60eff82d7589feb08b2096608e2e4ecad26514c912837f895f1a4a9690bf1e5c71364c7acff37183d827a19bab193e82d5566d4e0e45e781e9c9533791

C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe

MD5 2ce687e95f82d96214d6b0b7a3b6d83c
SHA1 2e86f893b398aec16f74fc799b29f2c7d14ba7bb
SHA256 48ba8154619448b749e4003781ddccf2da6696f7070dc95e3068b646aab9ace0
SHA512 5949c2807cf4dfc9f04500aac97cc2c9d05f1e195ed43055a79c07877cef76c9aba73f46b658c2ac1d47d12b9510dc0592c1c72ca7845d9f85fa368aa56f4055

\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe

MD5 2ce687e95f82d96214d6b0b7a3b6d83c
SHA1 2e86f893b398aec16f74fc799b29f2c7d14ba7bb
SHA256 48ba8154619448b749e4003781ddccf2da6696f7070dc95e3068b646aab9ace0
SHA512 5949c2807cf4dfc9f04500aac97cc2c9d05f1e195ed43055a79c07877cef76c9aba73f46b658c2ac1d47d12b9510dc0592c1c72ca7845d9f85fa368aa56f4055

memory/1508-60-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\8_77\ihnevm.exe

MD5 2ce687e95f82d96214d6b0b7a3b6d83c
SHA1 2e86f893b398aec16f74fc799b29f2c7d14ba7bb
SHA256 48ba8154619448b749e4003781ddccf2da6696f7070dc95e3068b646aab9ace0
SHA512 5949c2807cf4dfc9f04500aac97cc2c9d05f1e195ed43055a79c07877cef76c9aba73f46b658c2ac1d47d12b9510dc0592c1c72ca7845d9f85fa368aa56f4055

C:\Users\Admin\AppData\Local\Temp\8_77\ooxfh.rcj

MD5 3a3c904e6c0654518f8d976cbb225c79
SHA1 4cfaabc24ed7966c781dfa8dbb1b7bcb33733d68
SHA256 34a18bc96439be289cc16dd9dfc9e69f2a588d70a5024c3a57f099a2fdb0dd5e
SHA512 75a230ffea7e5c4b22150bc8d384afb178caeb54ec094451b330b6a6ff5de16bd08f0496e8a75550bc65fde0c65c99418c3f5359596aa0a1ce3e09244ef3ab7c

C:\Users\Admin\AppData\Local\Temp\8_77\twephvk.pdf

MD5 72bc84cf478aa689ba12c46705f99173
SHA1 6893a837376c41b088745fede67e7b806da31453
SHA256 fbd5c66fbf2346f5b0e5fe3d2d3d9dfb89cd1dcc316878b728108d8460f694c7
SHA512 a009917d69205a209392b855fd932f262e5468c526e3141a8fd65da1a8c1f59395962dede7b95a8ad1e19eb2c81851304848471db9e8d49985e8dc5310985caf

C:\Users\Admin\AppData\Local\Temp\8_77\xatpvu.tch

MD5 32c53d0d3e94095c0280fa448820b3e6
SHA1 8006048315b51f05f52525c62410b02d0e467ad0
SHA256 feb773a8447581c11e82e03c25762663f1b7712a849dd2e06e7e0e4db98462b9
SHA512 0e314182e5bbb0a2a1ec40be13dbeb3805dd528701479199e02addba2b295b16f4c2768876d39009fa494013106d5e2485eaff8aa9dd446b9d4b64b4ad78a7bc

\Users\Admin\AppData\Local\Temp\RegSvcs.exe

MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

memory/820-67-0x00000000003C0000-0x00000000009CB000-memory.dmp

memory/820-69-0x00000000003C0000-0x00000000009CB000-memory.dmp

memory/820-70-0x00000000003DE792-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

memory/820-73-0x00000000003C0000-0x00000000009CB000-memory.dmp

memory/820-75-0x00000000003C0000-0x00000000009CB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

memory/820-77-0x00000000003C0000-0x00000000003F8000-memory.dmp

memory/820-79-0x0000000000A90000-0x0000000000A9A000-memory.dmp

memory/820-80-0x0000000000AA0000-0x0000000000ABE000-memory.dmp

memory/820-81-0x0000000000AC0000-0x0000000000ACA000-memory.dmp