Malware Analysis Report

2025-08-05 14:33

Sample ID 221126-3rwttshb2z
Target 96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322
SHA256 96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322

Threat Level: Known bad

The file 96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

Modifies WinLogon for persistence

NanoCore

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Drops startup file

Drops desktop.ini file(s)

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-26 23:45

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-26 23:45

Reported

2022-11-27 17:43

Platform

win7-20220812-en

Max time kernel

151s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\amptask.exe" C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe N/A

NanoCore

keylogger trojan stealer spyware nanocore

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Pop4.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\notepad .exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pop4.exe C:\Users\Admin\AppData\Local\Temp\Pop4.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amptask.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amptask.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pop4.exe C:\Users\Admin\AppData\Local\Temp\Pop4.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Monitor = "C:\\Program Files (x86)\\NTFS Monitor\\ntfsmon.exe" C:\Users\Admin\AppData\Roaming\notepad .exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pop = "C:\\Users\\Admin\\AppData\\Roaming\\Pop_Ads\\My\\1.0.0.0\\Pop4.exe" C:\Users\Admin\AppData\Local\Temp\Pop4.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\notepad .exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2016 set thread context of 1472 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Roaming\notepad .exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe C:\Users\Admin\AppData\Roaming\notepad .exe N/A
File opened for modification C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe C:\Users\Admin\AppData\Roaming\notepad .exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\notepad .exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\notepad .exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2016 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Local\Temp\Pop4.exe
PID 2016 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Local\Temp\Pop4.exe
PID 2016 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Local\Temp\Pop4.exe
PID 2016 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Local\Temp\Pop4.exe
PID 2016 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Roaming\notepad .exe
PID 2016 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Roaming\notepad .exe
PID 2016 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Roaming\notepad .exe
PID 2016 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Roaming\notepad .exe
PID 2016 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Roaming\notepad .exe
PID 2016 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Roaming\notepad .exe
PID 2016 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Roaming\notepad .exe
PID 2016 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Roaming\notepad .exe
PID 2016 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Roaming\notepad .exe
PID 1756 wrote to memory of 1100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1756 wrote to memory of 1100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1756 wrote to memory of 1100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1756 wrote to memory of 1100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1100 wrote to memory of 1276 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 1276 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 1276 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 1276 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Windows\SysWOW64\cmd.exe
PID 808 wrote to memory of 1944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 808 wrote to memory of 1944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 808 wrote to memory of 1944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 808 wrote to memory of 1944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe

"C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe"

C:\Users\Admin\AppData\Local\Temp\Pop4.exe

"C:\Users\Admin\AppData\Local\Temp\Pop4.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Roaming\Windows\mata.bat

C:\Users\Admin\AppData\Roaming\notepad .exe

"C:\Users\Admin\AppData\Roaming\notepad .exe"

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Roaming\Windows\invs.vbs" "C:\Users\Admin\AppData\Roaming\Windows\mata2.bat

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\Windows\mata2.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\Windows\notepad.bat" "

C:\Windows\SysWOW64\timeout.exe

timeout /t 300

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 mcsoft.noip.me udp
N/A 8.8.8.8:53 r0c.ddns.net udp

Files

memory/2016-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

memory/1296-56-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\Pop4.exe

MD5 f897f903e4942678ec765a31eda224fb
SHA1 dbd82191f21b95abb8db284950059950d4bb780d
SHA256 8833df32992ef03eb51c3aec5354be775f15ebdfba9016f1156222b3a7145091
SHA512 67a24c55fac905f185658caef3ee2007860546454c624942d85f739612e56ebeb0edd53b91e872693c5adee86b0fa2c35352cf5d57545a7c109791aa60a4c873

memory/2016-58-0x00000000748F0000-0x0000000074E9B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Pop4.exe

MD5 f897f903e4942678ec765a31eda224fb
SHA1 dbd82191f21b95abb8db284950059950d4bb780d
SHA256 8833df32992ef03eb51c3aec5354be775f15ebdfba9016f1156222b3a7145091
SHA512 67a24c55fac905f185658caef3ee2007860546454c624942d85f739612e56ebeb0edd53b91e872693c5adee86b0fa2c35352cf5d57545a7c109791aa60a4c873

C:\Users\Admin\AppData\Local\Temp\Pop4.exe

MD5 f897f903e4942678ec765a31eda224fb
SHA1 dbd82191f21b95abb8db284950059950d4bb780d
SHA256 8833df32992ef03eb51c3aec5354be775f15ebdfba9016f1156222b3a7145091
SHA512 67a24c55fac905f185658caef3ee2007860546454c624942d85f739612e56ebeb0edd53b91e872693c5adee86b0fa2c35352cf5d57545a7c109791aa60a4c873

memory/1756-60-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\notepad .exe

MD5 278edbd499374bf73621f8c1f969d894
SHA1 a81170af14747781c5f5f51bb1215893136f0bc0
SHA256 c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391
SHA512 93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

memory/1472-62-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1472-63-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1472-65-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1472-66-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows\mata.bat

MD5 90f43387dc853e2f6012421794bce803
SHA1 175c394ede22184a3de907018504ca78ad9f8fe9
SHA256 ea9a9a1f2b36eb85a12ac384ceea8eb50aae661164741abaff273d4064b7fadc
SHA512 c1e3a52ef4ec660512bd14ad4afca0597b22992379ffc512e6184bcdc8e8396bc7d684cb68e88769afc471635fb14ada8b7f83de763c238a0ff837290dcd5b0d

memory/1472-70-0x000000000041EDAE-mapping.dmp

memory/1472-69-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Roaming\notepad .exe

MD5 278edbd499374bf73621f8c1f969d894
SHA1 a81170af14747781c5f5f51bb1215893136f0bc0
SHA256 c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391
SHA512 93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

memory/1472-73-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1472-75-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Roaming\notepad .exe

MD5 278edbd499374bf73621f8c1f969d894
SHA1 a81170af14747781c5f5f51bb1215893136f0bc0
SHA256 c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391
SHA512 93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

memory/1100-78-0x0000000000000000-mapping.dmp

memory/1296-79-0x0000000001280000-0x0000000001290000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

C:\Users\Admin\AppData\Roaming\Windows\mata2.bat

MD5 0b187db0d3d9e528e2a2b1a5cdf5ea00
SHA1 013a7a5a84318d53d2ff73228eb44c512384a007
SHA256 23d53516761e4b167166d781ad41ecd717a76016c8694f2af27dd4b60fc12b21
SHA512 4408effa053b30a56cbd4c27f56fb49c2124192297f216ab72fc6f0a2e8eeea8b00e8312710abac485f4f6adc6e138be224a35fc3d6f6444e2c5c13c5645f8e9

memory/1276-83-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows\rundll11-.txt

MD5 168a2c2ce1f613b4d70619fa695e6b78
SHA1 f10cb10f36c98dac6f41b5012acd976f281e7d90
SHA256 96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322
SHA512 bf8fbc62652dceea06973402178dbd081eedc394cd591874670c60563bb1d8f1d0710101c2784b21aa2a37eb6b6214fe06624e98ad94ce165abdc1bc4888da98

memory/1472-86-0x00000000748F0000-0x0000000074E9B000-memory.dmp

memory/1296-87-0x0000000000875000-0x0000000000886000-memory.dmp

memory/2016-88-0x00000000748F0000-0x0000000074E9B000-memory.dmp

memory/1472-89-0x00000000748F0000-0x0000000074E9B000-memory.dmp

memory/808-90-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows\amptask.exe

MD5 168a2c2ce1f613b4d70619fa695e6b78
SHA1 f10cb10f36c98dac6f41b5012acd976f281e7d90
SHA256 96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322
SHA512 bf8fbc62652dceea06973402178dbd081eedc394cd591874670c60563bb1d8f1d0710101c2784b21aa2a37eb6b6214fe06624e98ad94ce165abdc1bc4888da98

C:\Users\Admin\AppData\Roaming\Windows\notepad.bat

MD5 c2e905cdf49e21a46637203e212217e8
SHA1 a697d162bb1208e6a67214d05cea697ebbbf2732
SHA256 65fa669a0a06900043e32ebca9721abd3dbb60b21c96fbf78d37712b6cc6bc1e
SHA512 20eee69e49286f50eb84c244fc5fdcf8952e5750d467e631d85d516a17b15cfe6626860f78368c142381dad6e6678f60d069efbfc3f8dae01e1a7a9903870f41

memory/1944-93-0x0000000000000000-mapping.dmp

memory/2016-94-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-26 23:45

Reported

2022-11-27 17:43

Platform

win10v2004-20220812-en

Max time kernel

156s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\amptask.exe" C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Pop4.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amptask.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amptask.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pop4.exe C:\Users\Admin\AppData\Local\Temp\Pop4.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pop4.exe C:\Users\Admin\AppData\Local\Temp\Pop4.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pop = "C:\\Users\\Admin\\AppData\\Roaming\\Pop_Ads\\My\\1.0.0.0\\Pop4.exe" C:\Users\Admin\AppData\Local\Temp\Pop4.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe N/A
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4264 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Local\Temp\Pop4.exe
PID 4264 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Local\Temp\Pop4.exe
PID 4264 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Local\Temp\Pop4.exe
PID 4264 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Windows\SysWOW64\cmd.exe
PID 4264 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Windows\SysWOW64\cmd.exe
PID 4264 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Windows\SysWOW64\cmd.exe
PID 4768 wrote to memory of 2356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 4768 wrote to memory of 2356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 4768 wrote to memory of 2356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 4264 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Roaming\notepad .exe
PID 4264 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Roaming\notepad .exe
PID 4264 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Users\Admin\AppData\Roaming\notepad .exe
PID 2356 wrote to memory of 228 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2356 wrote to memory of 228 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2356 wrote to memory of 228 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 4264 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Windows\SysWOW64\cmd.exe
PID 4264 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Windows\SysWOW64\cmd.exe
PID 4264 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe C:\Windows\SysWOW64\cmd.exe
PID 748 wrote to memory of 3588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 748 wrote to memory of 3588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 748 wrote to memory of 3588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe

"C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe"

C:\Users\Admin\AppData\Local\Temp\Pop4.exe

"C:\Users\Admin\AppData\Local\Temp\Pop4.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Windows\mata.bat

C:\Users\Admin\AppData\Roaming\notepad .exe

"C:\Users\Admin\AppData\Roaming\notepad .exe"

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Roaming\Windows\invs.vbs" "C:\Users\Admin\AppData\Roaming\Windows\mata2.bat

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows\mata2.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows\notepad.bat" "

C:\Windows\SysWOW64\timeout.exe

timeout /t 300

Network

Country Destination Domain Proto
N/A 52.178.17.2:443 tcp
N/A 52.109.13.62:443 tcp
N/A 104.80.225.205:443 tcp
N/A 67.24.27.254:80 tcp
N/A 67.24.27.254:80 tcp
N/A 67.24.27.254:80 tcp
N/A 52.109.12.20:443 tcp

Files

memory/4264-132-0x0000000075140000-0x00000000756F1000-memory.dmp

memory/4264-133-0x0000000075140000-0x00000000756F1000-memory.dmp

memory/4652-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Pop4.exe

MD5 f897f903e4942678ec765a31eda224fb
SHA1 dbd82191f21b95abb8db284950059950d4bb780d
SHA256 8833df32992ef03eb51c3aec5354be775f15ebdfba9016f1156222b3a7145091
SHA512 67a24c55fac905f185658caef3ee2007860546454c624942d85f739612e56ebeb0edd53b91e872693c5adee86b0fa2c35352cf5d57545a7c109791aa60a4c873

C:\Users\Admin\AppData\Local\Temp\Pop4.exe

MD5 f897f903e4942678ec765a31eda224fb
SHA1 dbd82191f21b95abb8db284950059950d4bb780d
SHA256 8833df32992ef03eb51c3aec5354be775f15ebdfba9016f1156222b3a7145091
SHA512 67a24c55fac905f185658caef3ee2007860546454c624942d85f739612e56ebeb0edd53b91e872693c5adee86b0fa2c35352cf5d57545a7c109791aa60a4c873

memory/4768-137-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows\mata.bat

MD5 90f43387dc853e2f6012421794bce803
SHA1 175c394ede22184a3de907018504ca78ad9f8fe9
SHA256 ea9a9a1f2b36eb85a12ac384ceea8eb50aae661164741abaff273d4064b7fadc
SHA512 c1e3a52ef4ec660512bd14ad4afca0597b22992379ffc512e6184bcdc8e8396bc7d684cb68e88769afc471635fb14ada8b7f83de763c238a0ff837290dcd5b0d

memory/2356-139-0x0000000000000000-mapping.dmp

memory/1416-140-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

C:\Users\Admin\AppData\Roaming\Windows\mata2.bat

MD5 0b187db0d3d9e528e2a2b1a5cdf5ea00
SHA1 013a7a5a84318d53d2ff73228eb44c512384a007
SHA256 23d53516761e4b167166d781ad41ecd717a76016c8694f2af27dd4b60fc12b21
SHA512 4408effa053b30a56cbd4c27f56fb49c2124192297f216ab72fc6f0a2e8eeea8b00e8312710abac485f4f6adc6e138be224a35fc3d6f6444e2c5c13c5645f8e9

memory/228-143-0x0000000000000000-mapping.dmp

memory/4652-144-0x0000000000E90000-0x0000000000EA0000-memory.dmp

memory/4652-145-0x0000000005860000-0x00000000058FC000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows\rundll11-.txt

MD5 168a2c2ce1f613b4d70619fa695e6b78
SHA1 f10cb10f36c98dac6f41b5012acd976f281e7d90
SHA256 96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322
SHA512 bf8fbc62652dceea06973402178dbd081eedc394cd591874670c60563bb1d8f1d0710101c2784b21aa2a37eb6b6214fe06624e98ad94ce165abdc1bc4888da98

memory/4652-147-0x0000000005EE0000-0x0000000006484000-memory.dmp

memory/4652-148-0x0000000005930000-0x00000000059C2000-memory.dmp

memory/4652-149-0x0000000005830000-0x000000000583A000-memory.dmp

memory/4652-150-0x0000000005B30000-0x0000000005B86000-memory.dmp

memory/4652-151-0x0000000009B20000-0x0000000009CA6000-memory.dmp

memory/748-152-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows\notepad.bat

MD5 c2e905cdf49e21a46637203e212217e8
SHA1 a697d162bb1208e6a67214d05cea697ebbbf2732
SHA256 65fa669a0a06900043e32ebca9721abd3dbb60b21c96fbf78d37712b6cc6bc1e
SHA512 20eee69e49286f50eb84c244fc5fdcf8952e5750d467e631d85d516a17b15cfe6626860f78368c142381dad6e6678f60d069efbfc3f8dae01e1a7a9903870f41

memory/3588-154-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows\amptask.exe

MD5 168a2c2ce1f613b4d70619fa695e6b78
SHA1 f10cb10f36c98dac6f41b5012acd976f281e7d90
SHA256 96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322
SHA512 bf8fbc62652dceea06973402178dbd081eedc394cd591874670c60563bb1d8f1d0710101c2784b21aa2a37eb6b6214fe06624e98ad94ce165abdc1bc4888da98

memory/4264-156-0x0000000075140000-0x00000000756F1000-memory.dmp