Malware Analysis Report

2024-11-30 21:51

Sample ID 230205-qs85bsda6t
Target 5e243f79ecb539d0d1f75fce7ddfedeccee70a48
SHA256 471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
Tags
aurora purecrypter downloader loader persistence stealer spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747

Threat Level: Known bad

The file 5e243f79ecb539d0d1f75fce7ddfedeccee70a48 was found to be: Known bad.

Malicious Activity Summary

aurora purecrypter downloader loader persistence stealer spyware

PureCrypter

Aurora

Detect PureCrypter injector

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-02-05 13:32

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-05 13:32

Reported

2023-02-05 13:35

Platform

win7-20221111-en

Max time kernel

103s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"

Signatures

Aurora

stealer aurora

Detect PureCrypter injector

loader
Description Indicator Process Target
N/A N/A N/A N/A

PureCrypter

loader downloader purecrypter

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1996 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
PID 1996 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
PID 1996 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
PID 1996 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
PID 1736 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 1736 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 1736 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 1736 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 624 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 624 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 624 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 624 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 624 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\cmd.exe
PID 624 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\cmd.exe
PID 624 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\cmd.exe
PID 624 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\cmd.exe
PID 1496 wrote to memory of 840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 624 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 624 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 624 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 624 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic os get Caption

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic path win32_VideoController get name"

Network

Country Destination Domain Proto
DE 45.9.74.11:8081 tcp
DE 45.9.74.11:8081 tcp

Files

memory/1736-54-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

MD5 e416b553ccbd7ba263578f234c3902ed
SHA1 b8b28c73d2cbe69944af118b2212709c8112c078
SHA256 15f6358302609a3eec155b38527ff36d08c874da4f0dfe3b75e21cd80bbe3c10
SHA512 3c4abb585d161150aceb0d136d3acae94c2776bd6378544c8d6adbf9c3d98c2298c34444fa97428e7680bca4688e01e61c5de069d6317eb642191fd1ed0dc048

memory/1736-56-0x0000000075D11000-0x0000000075D13000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

MD5 1656d074c5c8c2c9b1a10d4e018f8058
SHA1 cb193bd319b5e1b01cf5272437f4fc654ca93304
SHA256 8a341b9f8a83adc9c2483bbd255008ec4082052ff478a44b583a0f51f7d7d4fd
SHA512 e0005d0bff64cc0e463bd13abf6f7ea63a416eac0df75b77120835de3117a86e6b4877c3e9da65875b2a3b5178543b86ee98b9441389f33fc3ed1bae5b3de535

\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

MD5 9a85025c3f8c9d92198495f6c66af35c
SHA1 f54c5225bc853bf1d4b8613a541f6609a1405325
SHA256 79e4b7a9ca4c95395fe758f736143f208314b6693a932965a2a15aa0da026f95
SHA512 f0f503d84bc4f2fccc077af04bb3cf3028df3208e3276010644cd89653f6d146c19af37344f9384ca6106176ea2d0900e4fa3e4259bc49a0db76f5e589cd8596

\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

MD5 7bff1772af764fca47bac0c018bd1003
SHA1 d5caa88cc0c3583358d4f6db1385be9f7cb42160
SHA256 3cf7e34b6462032a08f8cc50d849034ac713b37caa95c36f5d949c75bf596d18
SHA512 b3f822b2b4c9504c11a4680a8fd612a99e5b540a6379839e7cff25d3c5ffb32f04f6176d51b81203825bdd2264001360d511027285ad41b78f0cb449692a501b

\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

MD5 b53840f25dddead8351a9e1de4c76cfe
SHA1 91e5a3d6c47673f6b12c1330bd9d40d3888b2ca3
SHA256 7383509103fa4c305a627a3140de5537b9ae83203ef90fd2be5a9b5b7c036b69
SHA512 d4a3263a449e89dbd28fa059ff811784e4d2a218488be1ea7d0469244d48ba4d19eb39eebf199919e892f1a7cb0c4e658567a8b8ffcee0d78da540097c6ea92e

\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

MD5 5d6cd8ac333bea4a4ed594e36238074e
SHA1 89db5b5aa3d7e9acbf3806e333484ee831016b84
SHA256 d5685c76ec2d11e7b317fb85afc8b8055a87bb2eb5362c84fd14965418462416
SHA512 7e0b87beb0e56e625ed52666dd56f11034db84cbb0e9cf30ee007d91a58ab3d8a4a8750ebeba074e6603e54fcd7fbfb2a70008e2989e770cf2f364549aa0d04f

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

MD5 02d32bacc7c7954c725accff01ef2059
SHA1 8a75a11b6ae6d8188298b4dffbc9e23cdbe0f2c8
SHA256 35e79c551977fdda23bef3317a532c90c5fff7e663e0180a1ed0a9d6a375b9df
SHA512 5c0226cb1dee344f9bd892546daf4d4fa806de983e6e245d43c481c6f44c4b9616c0058ef171c2d9825ec6ecdd899f8df8bc71e21343ccd36ef98e1732f48d65

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

MD5 b21e77a5ac8143714802fba76a7230ee
SHA1 89dfdbca76dd7386320a7ee770f80a79d650e5db
SHA256 ac66b1bf4b4a32a0c14bb8413c13d10707690d194aeffcf7053b9b2ac6aef69e
SHA512 6da5ba85684b2c3dd143b30202e051013aaf2f7cd61c7fc7379e2b12dbfa64d1b915ff623b93e18f9c0cebb81b25d797c1d1bb327ff15a011bd1598bad33affd

memory/624-62-0x0000000000000000-mapping.dmp

memory/624-65-0x0000000000F70000-0x00000000016E4000-memory.dmp

memory/624-66-0x00000000064F0000-0x0000000006890000-memory.dmp

memory/1676-67-0x0000000000000000-mapping.dmp

memory/1676-69-0x000000006F850000-0x000000006FDFB000-memory.dmp

memory/1676-70-0x000000006F850000-0x000000006FDFB000-memory.dmp

memory/1676-71-0x000000006F850000-0x000000006FDFB000-memory.dmp

memory/1496-72-0x0000000000000000-mapping.dmp

memory/624-73-0x0000000005460000-0x00000000055D2000-memory.dmp

memory/840-74-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 3a9903e3eb074060779c848f83af86e2
SHA1 5c191230200cbc3d00878de5177b20866bed9e0d
SHA256 f58fa956f608f3db3485ac7ba72ff8e501666a6754c34242418ca3adf54f1d2e
SHA512 e0eb55af57c6b023e0de7cc4dc4c4ee926fa8526189e9fa9d0627933d2a933da724061540751213cc01c0e7018abe98e0b863f8fbbfd571e5b0f51366ab9dc48

memory/840-78-0x000000006F5B0000-0x000000006FB5B000-memory.dmp

memory/1068-77-0x0000000000400000-0x0000000000731000-memory.dmp

memory/1068-79-0x0000000000400000-0x0000000000731000-memory.dmp

memory/1068-81-0x0000000000400000-0x0000000000731000-memory.dmp

memory/1068-83-0x0000000000400000-0x0000000000731000-memory.dmp

memory/1068-86-0x0000000000400000-0x0000000000731000-memory.dmp

memory/1068-85-0x0000000000400000-0x0000000000731000-memory.dmp

memory/1068-88-0x0000000000400000-0x0000000000731000-memory.dmp

memory/1068-89-0x0000000000400000-0x0000000000731000-memory.dmp

memory/1068-90-0x0000000000464C20-mapping.dmp

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

MD5 37429e658270788ee4bccba20ba262a0
SHA1 5e432ac72027f0f207a40b87610b27a84f580920
SHA256 bee64ad5386fac0294e564f0efd35891ce8e703a6761cd828e362eb8c9303760
SHA512 60101c0114a4d92bc03cdae4a1a2b0eab0e15270daa28a9ab963910f8edac5a37be0b73a6e13f7eb546d8c72376e1ff828ff0ed545941045265ca19c4f2a59f0

memory/840-93-0x000000006F5B0000-0x000000006FB5B000-memory.dmp

memory/1068-94-0x0000000000400000-0x0000000000731000-memory.dmp

memory/1068-95-0x0000000000400000-0x0000000000731000-memory.dmp

memory/928-97-0x0000000000000000-mapping.dmp

memory/1068-96-0x0000000000400000-0x0000000000731000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-02-05 13:32

Reported

2023-02-05 13:35

Platform

win10v2004-20220901-en

Max time kernel

61s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"

Signatures

Aurora

stealer aurora

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3360 set thread context of 4536 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2300 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
PID 2300 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
PID 2300 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
PID 3472 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3472 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3472 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3360 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3360 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3360 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\cmd.exe
PID 3360 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\cmd.exe
PID 3360 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\cmd.exe
PID 4968 wrote to memory of 4564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4968 wrote to memory of 4564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4968 wrote to memory of 4564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3360 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 3360 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
PID 4536 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4536 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4536 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4536 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\cmd.exe
PID 4536 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\cmd.exe
PID 4536 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\cmd.exe
PID 3356 wrote to memory of 4548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3356 wrote to memory of 4548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3356 wrote to memory of 4548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4536 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\cmd.exe
PID 4536 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\cmd.exe
PID 4536 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 828 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 828 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic os get Caption

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic cpu get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic cpu get name

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 20.42.73.24:443 tcp
DE 45.9.74.11:8081 tcp
NL 104.80.225.205:443 tcp

Files

memory/3472-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

MD5 38e2f0e837ed1073eabb0bb2e4d8522d
SHA1 d3ffecf867abbde6417d8b4fac7c73074262890b
SHA256 bf13a5122130844a8884fdfa13e66201af168fa3c9af2707cb3f859448c725ca
SHA512 fd0e2fff420c138fd83da01d38c5aaf77c4e75c3413e0579c66c1349884235e80843135354fa775e44de0e3209546fc3b23d99953a8707d455ed5a27ef0e3c50

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

MD5 030d25972cdc70c77659e0199250a3bb
SHA1 88933bb0a8eb1c45b19a56df18f045bf9394877f
SHA256 7255ac279dac4048ddab7c2d345369a4d2e140dd14405910d5f5375f0d67ec8a
SHA512 2a3cd7d8f2d63b07e4c81e48e7587ca3273e4890257fe422af57f12fe6ab69b6becb1cbd73d36a27522debf0857450bf2a1f3337fd6cd8d03cd79637e91e1ed6

memory/3360-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

MD5 1e752412ce36efad6d4998ac66cc8757
SHA1 9c3d12ae990d1c7c29ce2ea137730f1ef6e8553d
SHA256 f8d312600b4d741e6b42629bd9e7682e0e9278e36b5d32b642204e9c774dcbd0
SHA512 9a6e6f26937617fb53012c9a201679145f83aac4676e070f78df09b6ff4cbb8496c32de90ac2ba9e7ebcb911c77c9bd99c45dac28a8ba52fdcd85f0effe11b5d

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

MD5 46812ed4b22121d22690a936afc2b268
SHA1 7ba070a3e6c69a289754a8a4dc2ab6eab009ceb7
SHA256 a85a3cbda09d3d485cfb0967d45e3ecd8e575394f274aa10377dde07fdf1f4a4
SHA512 ea0b845071713158561d42dccc9178ebff519049d1c042e2e257958169d13f6f90024e767e8dc4eeab821183949fddedac15951ecf1d6fd603b1f153a076a219

memory/3360-138-0x0000000000C40000-0x00000000013B4000-memory.dmp

memory/3360-139-0x00000000071C0000-0x00000000071E2000-memory.dmp

memory/3768-140-0x0000000000000000-mapping.dmp

memory/3768-141-0x0000000002AF0000-0x0000000002B26000-memory.dmp

memory/3768-142-0x0000000005470000-0x0000000005A98000-memory.dmp

memory/3768-143-0x00000000053C0000-0x0000000005426000-memory.dmp

memory/3768-144-0x0000000005AA0000-0x0000000005B06000-memory.dmp

memory/3768-145-0x00000000060E0000-0x00000000060FE000-memory.dmp

memory/3768-146-0x0000000007930000-0x0000000007FAA000-memory.dmp

memory/3768-147-0x00000000065C0000-0x00000000065DA000-memory.dmp

memory/4968-148-0x0000000000000000-mapping.dmp

memory/4564-149-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

memory/1536-151-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

MD5 214f62d903b883da780b0239563f52aa
SHA1 72e3e558bde95d38a005416581a1ec89db0a34b2
SHA256 63a6ac4e72a5a61623c1ff958dd59f16ec820109bf85ea3910468cb6d8ada129
SHA512 b6190fc2ec65be50279e6e41d52213b0755de5c9365c9915656952243417f8b1c2d39780126b7e14ac35f4edc0102f4aff028f9b25eb9c130b45a6c51df4ccb4

memory/4956-153-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

MD5 010e97d9b79b4bfa6b16e78075afa0e6
SHA1 fe1b97287b237784ab3f0d99f184911dccb04d51
SHA256 7873f856f8f4f94cf4c4bef89be40a76620f0849e1f118d75c80b265c6a11888
SHA512 fb3bdd08962675346e8200344b62ae6ef448c1620e0c4fdcdaaccc2a92b38597f2f4ab8a0f8c6e18c64e6c2bac694db526dcf1abd47c50b6787cab6fffeaee03

memory/4536-155-0x0000000000000000-mapping.dmp

memory/4536-156-0x0000000000400000-0x0000000000731000-memory.dmp

memory/4536-159-0x0000000000400000-0x0000000000731000-memory.dmp

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

MD5 507d75510baf312db93ea3915df2f406
SHA1 7f65a7ebb317a9ce1d555b0ae62ef7fcd256aa2a
SHA256 acb1a9edda48fef2b439240fe9f6200214ea42493bf4013602480a43418eb01d
SHA512 bb7b36d4d53ae97a397ccf8f217afdc1f4742896ee45ce283a30d4518349ab6390efdd8759888760721542b0175f475a879fcf4fefcae3e0eb76882dd33661c8

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e4565a407deeb8eb8ab97fd4bf03b89d
SHA1 9cd8bb9df44052a8c2622f11c62defa201897a4b
SHA256 a233cbcdc9b1ddcbcefb30463fbad7c617b1418b341ffdf50ec8b2ee1307224e
SHA512 6d853b85afda6075b10a1af89dca21eae5e749e0f9c0f85db07e955f3f0ff22583dfa694e0b1174bfddc753c26ee15eda3737f0aaececf0d3356cc907bfdd69c

memory/4536-161-0x0000000000400000-0x0000000000731000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

memory/4564-163-0x0000000006AA0000-0x0000000006AD2000-memory.dmp

memory/4564-164-0x0000000075AD0000-0x0000000075B1C000-memory.dmp

memory/4564-166-0x0000000006060000-0x000000000607E000-memory.dmp

memory/3776-165-0x0000000000000000-mapping.dmp

memory/4564-167-0x0000000006E60000-0x0000000006E6A000-memory.dmp

memory/3356-168-0x0000000000000000-mapping.dmp

memory/4564-169-0x00000000070B0000-0x0000000007146000-memory.dmp

memory/4548-170-0x0000000000000000-mapping.dmp

memory/828-171-0x0000000000000000-mapping.dmp

memory/4884-172-0x0000000000000000-mapping.dmp

memory/4564-173-0x0000000005920000-0x000000000592E000-memory.dmp

memory/4564-174-0x0000000007010000-0x000000000702A000-memory.dmp

memory/4564-175-0x0000000006FF0000-0x0000000006FF8000-memory.dmp

memory/4536-176-0x0000000000400000-0x0000000000731000-memory.dmp