Malware Analysis Report

2025-06-16 01:03

Sample ID 221123-vzp29add5z
Target cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3
SHA256 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3
Tags
xtremerat persistence rat spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3

Threat Level: Known bad

The file cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3 was found to be: Known bad.

Malicious Activity Summary

xtremerat persistence rat spyware

XtremeRAT

Detect XtremeRAT payload

Modifies Installed Components in the registry

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Program crash

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-23 17:25

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-23 17:25

Reported

2022-11-23 19:12

Platform

win7-20220812-en

Max time kernel

155s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe"

Signatures

Detect XtremeRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XtremeRAT

persistence spyware rat xtremerat

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{2G322806-LSB1-H68O-3UB5-J14X74R3834E} C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2G322806-LSB1-H68O-3UB5-J14X74R3834E}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{2G322806-LSB1-H68O-3UB5-J14X74R3834E} C:\Windows\SysWOW64\calc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2G322806-LSB1-H68O-3UB5-J14X74R3834E}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart" C:\Windows\SysWOW64\calc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\calc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Program Files (x86)\\InstallDir\\Server.exe" C:\Windows\SysWOW64\calc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\calc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Program Files (x86)\\InstallDir\\Server.exe" C:\Windows\SysWOW64\calc.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Program Files (x86)\\InstallDir\\Server.exe" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Program Files (x86)\\InstallDir\\Server.exe" C:\Windows\SysWOW64\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\InstallDir\Server.exe C:\Windows\SysWOW64\calc.exe N/A
File created C:\Program Files (x86)\InstallDir\Server.exe C:\Windows\SysWOW64\calc.exe N/A

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe N/A
N/A N/A C:\Windows\SysWOW64\calc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 288 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 288 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 288 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 288 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 288 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 288 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 288 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 288 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 288 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 288 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 288 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 288 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 288 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 288 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 1788 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\svchost.exe
PID 1788 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\svchost.exe
PID 1788 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\svchost.exe
PID 1788 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\svchost.exe
PID 1788 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\svchost.exe
PID 1788 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\calc.exe
PID 1788 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\calc.exe
PID 1788 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\calc.exe
PID 1788 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\calc.exe
PID 1788 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\calc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe

"C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe"

C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe

"C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\calc.exe

calc.exe

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 trx3000.dyndns.biz udp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp
N/A 127.0.0.1:83 tcp

Files

memory/1788-56-0x0000000010000000-0x0000000010047000-memory.dmp

memory/1788-57-0x000000001000C664-mapping.dmp

memory/1788-58-0x0000000010000000-0x0000000010047000-memory.dmp

memory/288-60-0x0000000000400000-0x00000000004BE000-memory.dmp

memory/1788-59-0x0000000075B11000-0x0000000075B13000-memory.dmp

memory/1788-61-0x0000000010000000-0x0000000010047000-memory.dmp

memory/1788-62-0x0000000010000000-0x0000000010047000-memory.dmp

memory/1788-63-0x0000000000400000-0x00000000004BE000-memory.dmp

memory/784-64-0x0000000010000000-0x0000000010047000-memory.dmp

memory/784-66-0x0000000000000000-mapping.dmp

memory/912-70-0x0000000000000000-mapping.dmp

memory/1788-71-0x0000000010000000-0x0000000010047000-memory.dmp

memory/912-73-0x0000000010000000-0x0000000010047000-memory.dmp

memory/784-74-0x0000000010000000-0x0000000010047000-memory.dmp

C:\Program Files (x86)\InstallDir\Server.exe

MD5 04089bb15a915c801c49d538f2499cf9
SHA1 0b6a8a5663e028ebe8ce28d2d2607b42404edd2c
SHA256 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3
SHA512 3e3cbb0d602dbbce710192d8082563c7c487320684959dbfc56bcaf0b7e824c1e629f96e83c510d247494846cb7cde1d8a4ebed62c50c26682cf5811edad065e

memory/912-76-0x0000000010000000-0x0000000010047000-memory.dmp

memory/784-77-0x0000000010000000-0x0000000010047000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-23 17:25

Reported

2022-11-23 19:12

Platform

win10v2004-20220812-en

Max time kernel

152s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe"

Signatures

Detect XtremeRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XtremeRAT

persistence spyware rat xtremerat

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5104 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 5104 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 5104 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 5104 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 5104 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 5104 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 5104 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 5104 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 5104 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 5104 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 5104 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 5104 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 5104 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
PID 2232 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\svchost.exe
PID 2232 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\svchost.exe
PID 2232 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\svchost.exe
PID 2232 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\svchost.exe
PID 2232 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\calc.exe
PID 2232 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\calc.exe
PID 2232 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\calc.exe
PID 2232 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe C:\Windows\SysWOW64\calc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe

"C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe"

C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe

"C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\calc.exe

calc.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3440 -ip 3440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3044 -ip 3044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 468

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 480

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3044 -ip 3044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3440 -ip 3440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 504

Network

Country Destination Domain Proto
N/A 93.184.221.240:80 tcp
N/A 8.238.23.254:80 tcp
N/A 8.238.23.254:80 tcp
N/A 93.184.221.240:80 tcp
N/A 51.116.253.170:443 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.220.29:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 20.190.160.20:443 tcp

Files

memory/5104-132-0x0000000000400000-0x00000000004BE000-memory.dmp

memory/2232-135-0x0000000000000000-mapping.dmp

memory/2232-136-0x0000000010000000-0x0000000010047000-memory.dmp

memory/2232-137-0x0000000010000000-0x0000000010047000-memory.dmp

memory/5104-138-0x0000000000400000-0x00000000004BE000-memory.dmp

memory/2232-139-0x0000000010000000-0x0000000010047000-memory.dmp

memory/3440-140-0x0000000000000000-mapping.dmp

memory/3044-141-0x0000000000000000-mapping.dmp

memory/2232-142-0x0000000010000000-0x0000000010047000-memory.dmp

memory/3044-143-0x0000000010000000-0x0000000010047000-memory.dmp

memory/3440-144-0x0000000010000000-0x0000000010047000-memory.dmp