Malware Analysis Report

2025-08-05 14:34

Sample ID 221126-3vedysdg98
Target d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b
SHA256 d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b

Threat Level: Known bad

The file d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-26 23:49

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-26 23:49

Reported

2022-11-27 17:24

Platform

win7-20221111-en

Max time kernel

192s

Max time network

32s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\C:\Users\Admin\W4KGOI~1 = "C:\\Users\\Admin\\W4KGOI~1\\krnagboyghfo.vbs" C:\Users\Admin\w4kgoi6994\iyrf.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\w4kgoi6994\iyrf.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1040 set thread context of 1172 N/A C:\Users\Admin\w4kgoi6994\iyrf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1976 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b.exe C:\Users\Admin\w4kgoi6994\iyrf.exe
PID 1976 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b.exe C:\Users\Admin\w4kgoi6994\iyrf.exe
PID 1976 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b.exe C:\Users\Admin\w4kgoi6994\iyrf.exe
PID 1976 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b.exe C:\Users\Admin\w4kgoi6994\iyrf.exe
PID 1976 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b.exe C:\Users\Admin\w4kgoi6994\iyrf.exe
PID 1976 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b.exe C:\Users\Admin\w4kgoi6994\iyrf.exe
PID 1976 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b.exe C:\Users\Admin\w4kgoi6994\iyrf.exe
PID 1040 wrote to memory of 1172 N/A C:\Users\Admin\w4kgoi6994\iyrf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1040 wrote to memory of 1172 N/A C:\Users\Admin\w4kgoi6994\iyrf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1040 wrote to memory of 1172 N/A C:\Users\Admin\w4kgoi6994\iyrf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1040 wrote to memory of 1172 N/A C:\Users\Admin\w4kgoi6994\iyrf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1040 wrote to memory of 1172 N/A C:\Users\Admin\w4kgoi6994\iyrf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1040 wrote to memory of 1172 N/A C:\Users\Admin\w4kgoi6994\iyrf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1040 wrote to memory of 1172 N/A C:\Users\Admin\w4kgoi6994\iyrf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1040 wrote to memory of 1172 N/A C:\Users\Admin\w4kgoi6994\iyrf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1040 wrote to memory of 1172 N/A C:\Users\Admin\w4kgoi6994\iyrf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b.exe

"C:\Users\Admin\AppData\Local\Temp\d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b.exe"

C:\Users\Admin\w4kgoi6994\iyrf.exe

"C:\Users\Admin\w4kgoi6994\iyrf.exe" xqilbqxcfsa

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

N/A

Files

memory/1976-54-0x00000000760D1000-0x00000000760D3000-memory.dmp

\Users\Admin\w4kgoi6994\iyrf.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

\Users\Admin\w4kgoi6994\iyrf.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

\Users\Admin\w4kgoi6994\iyrf.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

\Users\Admin\w4kgoi6994\iyrf.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

memory/1040-59-0x0000000000000000-mapping.dmp

C:\Users\Admin\w4kgoi6994\iyrf.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

C:\Users\Admin\w4kgoi6994\xqilbqxcfsa

MD5 fc69e314bb5ad845ae2b81d726bd2e19
SHA1 fec0b584913e276a692de2599737e2cf0ac506b2
SHA256 e56b1f8e00007744395262afb4289d054b3a39b1f313e1a9461032492d44f16e
SHA512 d316d7e5f091f4d00b91181c78b3e11e7732ec3442df460749aace73be82eb6d1a2be9207af9668a44f0b7865231e5c1edae827f1ef3f3a2d6d661dabde83b01

C:\Users\Admin\W4KGOI~1\rzzadrap.OWJ

MD5 032a73d538cf904ceb16feb2f316d122
SHA1 94c953f3a69836e95172f851ffde4afd788bf31a
SHA256 01e4a41502a51e5afaa3ca4d262359c73bc04a23a15479fe60b727e105da7cf2
SHA512 9923e2a5a399cd6ad7f969c1515b34ebc9c92203affdcdeff19565abd1b7887ffaf316b6b8097d721239435328f2675f0af02b1ccb61b038b3be65f00aa71d8d

C:\Users\Admin\W4KGOI~1\psjr.FCK

MD5 d0dd7979a608f9f3fe5f659cf5d8d91f
SHA1 d024262f5daddf1aec13b0fbb8443d3576fb3291
SHA256 64fb9b94c9cc1224f232371fd790ac6ff92cc216e8828d5701acf37415c03222
SHA512 0139ec01e90154ea0adef87381677cbe77aeca7d0d5f481862cbfaeface5628a98dd9a497a80038f0056a365857b9a9a781ee4e94e8ca96b0c08ff88dfd8c460

memory/1172-65-0x0000000000090000-0x000000000010C000-memory.dmp

memory/1172-68-0x00000000000AE792-mapping.dmp

memory/1172-70-0x0000000000090000-0x000000000010C000-memory.dmp

memory/1172-67-0x0000000000090000-0x000000000010C000-memory.dmp

memory/1172-72-0x0000000000090000-0x000000000010C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-26 23:49

Reported

2022-11-27 17:22

Platform

win10v2004-20220812-en

Max time kernel

156s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\C:\Users\Admin\W4KGOI~1 = "C:\\Users\\Admin\\W4KGOI~1\\krnagboyghfo.vbs" C:\Users\Admin\w4kgoi6994\iyrf.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\w4kgoi6994\iyrf.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4892 set thread context of 2508 N/A C:\Users\Admin\w4kgoi6994\iyrf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A
N/A N/A C:\Users\Admin\w4kgoi6994\iyrf.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b.exe

"C:\Users\Admin\AppData\Local\Temp\d7cb77d326fe4234083d91674f2cfae0aacee10c93554d4ca2565ecbe4e39c4b.exe"

C:\Users\Admin\w4kgoi6994\iyrf.exe

"C:\Users\Admin\w4kgoi6994\iyrf.exe" xqilbqxcfsa

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
N/A 52.168.117.170:443 tcp
N/A 178.79.208.1:80 tcp
N/A 178.79.208.1:80 tcp
N/A 178.79.208.1:80 tcp
N/A 8.8.8.8:53 apananco.no-ip.biz udp
N/A 8.8.4.4:53 apananco.no-ip.biz udp
N/A 8.8.8.8:53 apananco.no-ip.biz udp
N/A 8.8.8.8:53 apananco.no-ip.biz udp
N/A 8.8.4.4:53 apananco.no-ip.biz udp
N/A 8.8.8.8:53 apananco.no-ip.biz udp
N/A 8.8.8.8:53 apananco.no-ip.biz udp
N/A 8.8.4.4:53 apananco.no-ip.biz udp
N/A 5.254.112.21:1177 tcp
N/A 5.254.112.21:1177 tcp
N/A 5.254.112.21:1177 tcp
N/A 8.8.8.8:53 apananco.no-ip.biz udp
N/A 8.8.4.4:53 apananco.no-ip.biz udp
N/A 8.8.8.8:53 apananco.no-ip.biz udp
N/A 8.8.8.8:53 apananco.no-ip.biz udp
N/A 8.8.4.4:53 apananco.no-ip.biz udp
N/A 8.8.8.8:53 apananco.no-ip.biz udp
N/A 8.8.4.4:53 apananco.no-ip.biz udp
N/A 8.8.8.8:53 apananco.no-ip.biz udp
N/A 5.254.112.21:1177 tcp

Files

memory/4892-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\w4kgoi6994\iyrf.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

C:\Users\Admin\w4kgoi6994\iyrf.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

C:\Users\Admin\w4kgoi6994\xqilbqxcfsa

MD5 fc69e314bb5ad845ae2b81d726bd2e19
SHA1 fec0b584913e276a692de2599737e2cf0ac506b2
SHA256 e56b1f8e00007744395262afb4289d054b3a39b1f313e1a9461032492d44f16e
SHA512 d316d7e5f091f4d00b91181c78b3e11e7732ec3442df460749aace73be82eb6d1a2be9207af9668a44f0b7865231e5c1edae827f1ef3f3a2d6d661dabde83b01

C:\Users\Admin\W4KGOI~1\rzzadrap.OWJ

MD5 032a73d538cf904ceb16feb2f316d122
SHA1 94c953f3a69836e95172f851ffde4afd788bf31a
SHA256 01e4a41502a51e5afaa3ca4d262359c73bc04a23a15479fe60b727e105da7cf2
SHA512 9923e2a5a399cd6ad7f969c1515b34ebc9c92203affdcdeff19565abd1b7887ffaf316b6b8097d721239435328f2675f0af02b1ccb61b038b3be65f00aa71d8d

C:\Users\Admin\W4KGOI~1\psjr.FCK

MD5 d0dd7979a608f9f3fe5f659cf5d8d91f
SHA1 d024262f5daddf1aec13b0fbb8443d3576fb3291
SHA256 64fb9b94c9cc1224f232371fd790ac6ff92cc216e8828d5701acf37415c03222
SHA512 0139ec01e90154ea0adef87381677cbe77aeca7d0d5f481862cbfaeface5628a98dd9a497a80038f0056a365857b9a9a781ee4e94e8ca96b0c08ff88dfd8c460

memory/2508-138-0x0000000000000000-mapping.dmp

memory/2508-139-0x0000000001030000-0x00000000010AC000-memory.dmp

memory/2508-140-0x0000000005A70000-0x0000000006014000-memory.dmp

memory/2508-141-0x0000000005560000-0x00000000055F2000-memory.dmp

memory/2508-142-0x00000000056A0000-0x000000000573C000-memory.dmp

memory/2508-143-0x0000000005610000-0x000000000561A000-memory.dmp