Malware Analysis Report

2025-01-02 09:20

Sample ID 230210-hfrerafa7y
Target c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004
SHA256 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004
Tags
persistence lgoogloader downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004

Threat Level: Known bad

The file c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004 was found to be: Known bad.

Malicious Activity Summary

persistence lgoogloader downloader

Detects LgoogLoader payload

LgoogLoader

Sets service image path in registry

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

Program crash

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-02-10 06:41

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-10 06:41

Reported

2023-02-10 06:43

Platform

win7-20220812-en

Max time kernel

117s

Max time network

42s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe"

Signatures

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys" C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A

Uses the VBS compiler for execution

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1704 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
PID 1704 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
PID 1704 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
PID 1704 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
PID 1704 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
PID 1704 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
PID 1704 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
PID 1704 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
PID 1704 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
PID 1704 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
PID 1704 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
PID 1704 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
PID 1704 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
PID 1704 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
PID 1704 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
PID 1704 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
PID 1704 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
PID 1704 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
PID 1704 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 1704 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 1704 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 1704 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
PID 1704 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
PID 1704 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
PID 1704 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 1704 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 1704 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 1704 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1704 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1704 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1704 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
PID 1704 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
PID 1704 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
PID 1704 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
PID 1704 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
PID 1704 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
PID 1704 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
PID 1704 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
PID 1704 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
PID 1704 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 1704 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 1704 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 1704 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 1704 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 1704 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 1704 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 1704 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 1704 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 1704 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 1704 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
PID 1704 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
PID 1704 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
PID 1704 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
PID 1704 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
PID 1704 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
PID 1704 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 1704 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 1704 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 1704 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1704 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1704 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1704 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 1704 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 1704 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe

"C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 304

Network

N/A

Files

memory/1704-54-0x0000000000FF0000-0x00000000010A0000-memory.dmp

memory/1704-55-0x0000000000DB0000-0x0000000000E2C000-memory.dmp

memory/112-57-0x00000000004046C6-mapping.dmp

memory/112-56-0x0000000000400000-0x000000000043C000-memory.dmp

memory/112-58-0x00000000762B1000-0x00000000762B3000-memory.dmp

memory/112-59-0x00000000000E0000-0x00000000000E9000-memory.dmp

memory/1520-60-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-02-10 06:41

Reported

2023-02-10 06:44

Platform

win10v2004-20220812-en

Max time kernel

77s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe"

Signatures

Detects LgoogLoader payload

Description Indicator Process Target
N/A N/A N/A N/A

LgoogLoader

downloader lgoogloader

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys" C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4728 set thread context of 4496 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4728 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 4728 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 4728 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
PID 4728 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
PID 4728 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
PID 4728 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
PID 4728 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
PID 4728 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
PID 4728 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
PID 4728 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
PID 4728 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
PID 4728 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
PID 4728 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
PID 4728 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
PID 4728 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 4728 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 4728 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
PID 4728 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
PID 4728 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 4728 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
PID 4728 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
PID 4728 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
PID 4728 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4728 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4728 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
PID 4728 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
PID 4728 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
PID 4728 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
PID 4728 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
PID 4728 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
PID 4728 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
PID 4728 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
PID 4728 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
PID 4728 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
PID 4728 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 4728 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 4728 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 4728 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 4728 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 4728 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 4728 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 4728 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 4728 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 4728 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 4728 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 4728 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 4728 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe

"C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"

Network

Country Destination Domain Proto
FR 2.20.8.110:443 tcp
BE 8.238.111.126:80 tcp
BE 8.238.111.126:80 tcp
US 93.184.220.29:80 tcp

Files

memory/4728-132-0x0000025C38DB0000-0x0000025C38E60000-memory.dmp

memory/4728-133-0x0000025C3AB50000-0x0000025C3ABC6000-memory.dmp

memory/4728-134-0x0000025C392E0000-0x0000025C392FE000-memory.dmp

memory/4728-135-0x00007FFA67CB0000-0x00007FFA68771000-memory.dmp

memory/4728-136-0x00007FFA67CB0000-0x00007FFA68771000-memory.dmp

memory/4496-137-0x0000000000400000-0x000000000043C000-memory.dmp

memory/4496-138-0x00000000004046C6-mapping.dmp

memory/4728-139-0x00007FFA67CB0000-0x00007FFA68771000-memory.dmp

memory/4496-140-0x0000000000400000-0x000000000043C000-memory.dmp

memory/4496-141-0x0000000000400000-0x000000000043C000-memory.dmp

memory/4496-142-0x0000000002CE0000-0x0000000002CE9000-memory.dmp

memory/4496-143-0x0000000002D00000-0x0000000002D0D000-memory.dmp