Malware Analysis Report

2024-11-16 12:20

Sample ID 230714-3v5wxagd85
Target a85fc38903152fcf020fb5ac1d90aa10.exe
SHA256 2f114f5d0e6063b5c3c3276bdbd20766a102b49dd48dce74d142eefa07c7cda5
Tags
lumma phobos rhadamanthys smokeloader systembc summ backdoor collection discovery evasion persistence ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2f114f5d0e6063b5c3c3276bdbd20766a102b49dd48dce74d142eefa07c7cda5

Threat Level: Known bad

The file a85fc38903152fcf020fb5ac1d90aa10.exe was found to be: Known bad.

Malicious Activity Summary

lumma phobos rhadamanthys smokeloader systembc summ backdoor collection discovery evasion persistence ransomware spyware stealer trojan

Lumma Stealer

Detect rhadamanthys stealer shellcode

SmokeLoader

Rhadamanthys

SystemBC

Suspicious use of NtCreateUserProcessOtherParentProcess

Phobos

Modifies boot configuration data using bcdedit

Deletes shadow copies

Modifies Windows Firewall

Downloads MZ/PE file

Deletes backup catalog

Reads user/profile data of local email clients

Executes dropped EXE

Reads user/profile data of web browsers

Drops startup file

Deletes itself

Legitimate hosting services abused for malware hosting/C2

Drops desktop.ini file(s)

Adds Run key to start application

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Program crash

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

outlook_win_path

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Checks processor information in registry

Interacts with shadow copies

outlook_office_path

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-14 23:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-07-14 23:51

Reported

2023-07-14 23:53

Platform

win10v2004-20230703-en

Max time kernel

139s

Max time network

153s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Lumma Stealer

stealer lumma

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3524 created 3160 N/A C:\Users\Admin\AppData\Local\Temp\D472.exe C:\Windows\Explorer.EXE

SystemBC

trojan systembc

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\[email protected] C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Y_K5~@q4 = "C:\\Users\\Admin\\AppData\\Local\\[email protected]" C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Y_K5~@q4 = "C:\\Users\\Admin\\AppData\\Local\\[email protected]" C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A

Checks installed software on the system

discovery

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1498570331-2313266200-788959944-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1498570331-2313266200-788959944-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4252 set thread context of 4236 N/A C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\7-Zip\Lang\vi.txt.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Java\jdk1.8.0_66\db\bin\stopNetworkServer.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Java\jdk1.8.0_66\include\classfile_constants.h.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\7-Zip\Lang\ga.txt C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\7-Zip\Lang\he.txt C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\FindUnblock.vsx.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\7-Zip\Lang\el.txt C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgeCallbacks.h.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\7-Zip\Lang\gu.txt.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\System\ado\msador28.tlb C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Java\jdk1.8.0_66\include\win32\jawt_md.h.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\7-Zip\Lang\an.txt.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\7-Zip\Lang\he.txt.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\7-Zip\Lang\vi.txt C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\bci.dll.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\7-Zip\Lang\ru.txt.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\7-Zip\Lang\tr.txt C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\sqloledb.dll C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\ConvertAssert.jpg.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derby.war C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\7-Zip\7-zip.chm.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\7-Zip\Lang\si.txt C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id[C14A9462-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\CloseDisable.jpg C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\a85fc38903152fcf020fb5ac1d90aa10.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\a85fc38903152fcf020fb5ac1d90aa10.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\a85fc38903152fcf020fb5ac1d90aa10.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a85fc38903152fcf020fb5ac1d90aa10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a85fc38903152fcf020fb5ac1d90aa10.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\[email protected] N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3160 wrote to memory of 3524 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\D472.exe
PID 3160 wrote to memory of 3524 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\D472.exe
PID 3160 wrote to memory of 3524 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\D472.exe
PID 3160 wrote to memory of 212 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\DCB0.exe
PID 3160 wrote to memory of 212 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\DCB0.exe
PID 3160 wrote to memory of 212 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\DCB0.exe
PID 3160 wrote to memory of 872 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 872 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 872 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 872 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 3680 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3160 wrote to memory of 3680 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3160 wrote to memory of 3680 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3160 wrote to memory of 1048 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 1048 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 1048 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 1048 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 1528 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3160 wrote to memory of 1528 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3160 wrote to memory of 1528 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3160 wrote to memory of 1608 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 1608 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 1608 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 1608 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 4208 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 4208 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 4208 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 4208 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 4416 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 4416 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 4416 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 4416 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 4280 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3160 wrote to memory of 4280 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3160 wrote to memory of 4280 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3160 wrote to memory of 2512 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 2512 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 2512 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3160 wrote to memory of 2512 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3524 wrote to memory of 180 N/A C:\Users\Admin\AppData\Local\Temp\D472.exe C:\Windows\system32\certreq.exe
PID 3524 wrote to memory of 180 N/A C:\Users\Admin\AppData\Local\Temp\D472.exe C:\Windows\system32\certreq.exe
PID 3524 wrote to memory of 180 N/A C:\Users\Admin\AppData\Local\Temp\D472.exe C:\Windows\system32\certreq.exe
PID 3524 wrote to memory of 180 N/A C:\Users\Admin\AppData\Local\Temp\D472.exe C:\Windows\system32\certreq.exe
PID 4252 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe
PID 4252 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe
PID 4252 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe
PID 4252 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe
PID 4252 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe
PID 4252 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe
PID 3388 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Microsoft\[email protected] C:\Windows\system32\cmd.exe
PID 3388 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Microsoft\[email protected] C:\Windows\system32\cmd.exe
PID 3388 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Microsoft\[email protected] C:\Windows\system32\cmd.exe
PID 3388 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Microsoft\[email protected] C:\Windows\system32\cmd.exe
PID 3616 wrote to memory of 2372 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3616 wrote to memory of 2372 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4760 wrote to memory of 5088 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4760 wrote to memory of 5088 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3616 wrote to memory of 1112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3616 wrote to memory of 1112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4760 wrote to memory of 3488 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4760 wrote to memory of 3488 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\a85fc38903152fcf020fb5ac1d90aa10.exe

"C:\Users\Admin\AppData\Local\Temp\a85fc38903152fcf020fb5ac1d90aa10.exe"

C:\Users\Admin\AppData\Local\Temp\D472.exe

C:\Users\Admin\AppData\Local\Temp\D472.exe

C:\Users\Admin\AppData\Local\Temp\DCB0.exe

C:\Users\Admin\AppData\Local\Temp\DCB0.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3524 -ip 3524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 212 -ip 212

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 3400

C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe

"C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe"

C:\Users\Admin\AppData\Local\Microsoft\[email protected]

"C:\Users\Admin\AppData\Local\Microsoft\[email protected]"

C:\Users\Admin\AppData\Local\Microsoft\vjvE57][email protected]

"C:\Users\Admin\AppData\Local\Microsoft\vjvE57][email protected]"

C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe

"C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe"

C:\Users\Admin\AppData\Local\Microsoft\[email protected]

"C:\Users\Admin\AppData\Local\Microsoft\[email protected]"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 stalagmijesarl.com udp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 31.153.50.194.in-addr.arpa udp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 admxlogs25.xyz udp
EE 46.36.218.224:80 admxlogs25.xyz tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 224.218.36.46.in-addr.arpa udp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 github.com udp
US 140.82.114.4:443 github.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 4.114.82.140.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 gstatic-node.io udp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 8.8.8.8:53 0.97.114.188.in-addr.arpa udp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 8.8.8.8:53 admlogs195.xyz udp
EE 46.36.219.3:80 admlogs195.xyz tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 8.8.8.8:53 3.219.36.46.in-addr.arpa udp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
EE 46.36.219.3:80 admlogs195.xyz tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
US 188.114.97.0:80 gstatic-node.io tcp
EE 46.36.219.3:80 admlogs195.xyz tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 9.73.50.20.in-addr.arpa udp

Files

memory/3696-134-0x00000000008B0000-0x00000000009B0000-memory.dmp

memory/3696-135-0x0000000000890000-0x0000000000899000-memory.dmp

memory/3696-136-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3696-137-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3160-138-0x0000000002730000-0x0000000002746000-memory.dmp

memory/3696-139-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3696-142-0x0000000000890000-0x0000000000899000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D472.exe

MD5 aaf3d68aeea347268ede50e621ca21ce
SHA1 0e7c0e38a200a9ea3af663dfd33941cc5e1657c9
SHA256 09c9bc026f600cb19848ba96858b3dbfe13f03358dc0703818d3bfa3d632d416
SHA512 61416225031cbb74114ee61e3f7ce697e73423c75a0f2e96f51557b3d289ad868034e2e07ead926cd12a95b524ed37cf1626dc75dc99c47fac9cb8f843002bd0

C:\Users\Admin\AppData\Local\Temp\D472.exe

MD5 aaf3d68aeea347268ede50e621ca21ce
SHA1 0e7c0e38a200a9ea3af663dfd33941cc5e1657c9
SHA256 09c9bc026f600cb19848ba96858b3dbfe13f03358dc0703818d3bfa3d632d416
SHA512 61416225031cbb74114ee61e3f7ce697e73423c75a0f2e96f51557b3d289ad868034e2e07ead926cd12a95b524ed37cf1626dc75dc99c47fac9cb8f843002bd0

C:\Users\Admin\AppData\Local\Temp\DCB0.exe

MD5 6d35d4cb11e99f8645441b0f1f96da3d
SHA1 3b6e12da0c1c37d38db867ab6330ace34461c56a
SHA256 9066d830ae21197499f19a044054b0ea96f5be17cbb246714e15f36f32312204
SHA512 01b5b75ce608f55f70c6471bb20f0a248116ef902f4bd602b5cf11fed747e0af9b811fbe74d393895672806f2b525900c6cef0ce889229d27032683a5e591aa4

C:\Users\Admin\AppData\Local\Temp\DCB0.exe

MD5 6d35d4cb11e99f8645441b0f1f96da3d
SHA1 3b6e12da0c1c37d38db867ab6330ace34461c56a
SHA256 9066d830ae21197499f19a044054b0ea96f5be17cbb246714e15f36f32312204
SHA512 01b5b75ce608f55f70c6471bb20f0a248116ef902f4bd602b5cf11fed747e0af9b811fbe74d393895672806f2b525900c6cef0ce889229d27032683a5e591aa4

memory/872-160-0x0000000000370000-0x0000000000377000-memory.dmp

memory/872-162-0x0000000000360000-0x000000000036B000-memory.dmp

memory/3680-164-0x00000000004B0000-0x00000000004B9000-memory.dmp

memory/3680-163-0x00000000004A0000-0x00000000004AF000-memory.dmp

memory/3680-165-0x00000000004A0000-0x00000000004AF000-memory.dmp

memory/1048-167-0x00000000009B0000-0x00000000009B5000-memory.dmp

memory/1048-166-0x00000000009A0000-0x00000000009A9000-memory.dmp

memory/1048-168-0x00000000009A0000-0x00000000009A9000-memory.dmp

memory/1528-169-0x0000000001220000-0x000000000122C000-memory.dmp

memory/1528-170-0x0000000001230000-0x0000000001236000-memory.dmp

memory/1528-171-0x0000000001220000-0x000000000122C000-memory.dmp

memory/1608-172-0x00000000008C0000-0x00000000008E7000-memory.dmp

memory/1608-173-0x00000000008F0000-0x0000000000912000-memory.dmp

memory/1608-174-0x00000000008C0000-0x00000000008E7000-memory.dmp

memory/4208-175-0x0000000000490000-0x0000000000499000-memory.dmp

memory/872-176-0x0000000000370000-0x0000000000377000-memory.dmp

memory/4208-177-0x00000000004A0000-0x00000000004A5000-memory.dmp

memory/4208-178-0x0000000000490000-0x0000000000499000-memory.dmp

memory/872-179-0x0000000000360000-0x000000000036B000-memory.dmp

memory/3680-181-0x00000000004B0000-0x00000000004B9000-memory.dmp

memory/4416-180-0x0000000001390000-0x000000000139B000-memory.dmp

memory/4416-182-0x00000000013A0000-0x00000000013A6000-memory.dmp

memory/4416-183-0x0000000001390000-0x000000000139B000-memory.dmp

memory/4280-184-0x0000000000170000-0x000000000017D000-memory.dmp

memory/1048-185-0x00000000009B0000-0x00000000009B5000-memory.dmp

memory/4280-187-0x0000000000170000-0x000000000017D000-memory.dmp

memory/4280-186-0x0000000000180000-0x0000000000187000-memory.dmp

memory/1528-189-0x0000000001230000-0x0000000001236000-memory.dmp

memory/2512-188-0x00000000013D0000-0x00000000013DB000-memory.dmp

memory/2512-190-0x00000000013E0000-0x00000000013E8000-memory.dmp

memory/2512-191-0x00000000013D0000-0x00000000013DB000-memory.dmp

memory/1608-192-0x00000000008F0000-0x0000000000912000-memory.dmp

memory/4416-193-0x00000000013A0000-0x00000000013A6000-memory.dmp

memory/4280-194-0x0000000000180000-0x0000000000187000-memory.dmp

memory/3524-195-0x0000000000640000-0x0000000000740000-memory.dmp

memory/3524-196-0x0000000002120000-0x0000000002191000-memory.dmp

memory/3524-197-0x0000000000400000-0x0000000000517000-memory.dmp

memory/2512-198-0x00000000013E0000-0x00000000013E8000-memory.dmp

memory/212-199-0x00000000007A0000-0x00000000008A0000-memory.dmp

memory/212-200-0x00000000006D0000-0x0000000000725000-memory.dmp

memory/212-201-0x0000000000400000-0x0000000000502000-memory.dmp

memory/3524-202-0x00000000021C0000-0x00000000021C7000-memory.dmp

memory/3524-203-0x0000000002640000-0x0000000002A40000-memory.dmp

memory/3524-204-0x0000000002640000-0x0000000002A40000-memory.dmp

memory/3524-205-0x0000000002640000-0x0000000002A40000-memory.dmp

memory/3524-206-0x0000000000400000-0x0000000000517000-memory.dmp

memory/3524-207-0x0000000002640000-0x0000000002A40000-memory.dmp

memory/212-208-0x0000000000400000-0x0000000000502000-memory.dmp

memory/3524-209-0x0000000002120000-0x0000000002191000-memory.dmp

memory/3524-210-0x0000000000640000-0x0000000000740000-memory.dmp

memory/180-211-0x000001D97EFD0000-0x000001D97EFD3000-memory.dmp

memory/3524-212-0x00000000025E0000-0x0000000002616000-memory.dmp

memory/212-218-0x00000000007A0000-0x00000000008A0000-memory.dmp

memory/3524-219-0x00000000025E0000-0x0000000002616000-memory.dmp

memory/3524-220-0x0000000002640000-0x0000000002A40000-memory.dmp

memory/3524-222-0x0000000000400000-0x0000000000517000-memory.dmp

memory/3524-223-0x0000000002640000-0x0000000002A40000-memory.dmp

memory/180-226-0x000001D97EFD0000-0x000001D97EFD3000-memory.dmp

memory/180-227-0x000001D97F270000-0x000001D97F277000-memory.dmp

memory/180-229-0x00007FF41A580000-0x00007FF41A6AD000-memory.dmp

memory/180-228-0x00007FF41A580000-0x00007FF41A6AD000-memory.dmp

memory/180-230-0x00007FF41A580000-0x00007FF41A6AD000-memory.dmp

memory/180-231-0x00007FF41A580000-0x00007FF41A6AD000-memory.dmp

memory/180-232-0x00007FF41A580000-0x00007FF41A6AD000-memory.dmp

memory/180-234-0x00007FF41A580000-0x00007FF41A6AD000-memory.dmp

memory/180-236-0x00007FF41A580000-0x00007FF41A6AD000-memory.dmp

memory/180-237-0x00007FF41A580000-0x00007FF41A6AD000-memory.dmp

memory/180-238-0x00007FF41A580000-0x00007FF41A6AD000-memory.dmp

memory/180-239-0x00007FFF08AD0000-0x00007FFF08CC5000-memory.dmp

memory/180-240-0x00007FF41A580000-0x00007FF41A6AD000-memory.dmp

memory/180-241-0x00007FF41A580000-0x00007FF41A6AD000-memory.dmp

memory/180-242-0x00007FF41A580000-0x00007FF41A6AD000-memory.dmp

memory/180-243-0x00007FF41A580000-0x00007FF41A6AD000-memory.dmp

memory/212-244-0x0000000000400000-0x0000000000502000-memory.dmp

memory/180-246-0x00007FF41A580000-0x00007FF41A6AD000-memory.dmp

memory/180-247-0x00007FFF08AD0000-0x00007FFF08CC5000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe

MD5 09d7f30d2f8432be6087038562a029dd
SHA1 07fc20446a03a20c191e750ef21737ec948d9544
SHA256 8c7319e9b6bd1ec0fa5658aaf55096a7e549b21a380de406c705969f165cb3f8
SHA512 abc4670991a0a109a292d36f2b5116685374d0c85c157eefac3b44e240050b51c41839b8df4ffdad3ef6460dcd70c2b9457492c7d486fccd7a48e931cebacf7e

C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe

MD5 09d7f30d2f8432be6087038562a029dd
SHA1 07fc20446a03a20c191e750ef21737ec948d9544
SHA256 8c7319e9b6bd1ec0fa5658aaf55096a7e549b21a380de406c705969f165cb3f8
SHA512 abc4670991a0a109a292d36f2b5116685374d0c85c157eefac3b44e240050b51c41839b8df4ffdad3ef6460dcd70c2b9457492c7d486fccd7a48e931cebacf7e

C:\Users\Admin\AppData\Local\Microsoft\[email protected]

MD5 de348ef9eed7ccdaed5a70ae15796a86
SHA1 42914d94e8024ca94e58bb4bd9cfa4d0ae524975
SHA256 a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855
SHA512 605bdb115b9fc95b1c0924f01b3b62b27737d94fe97825e81ebc5f1de107a317bd47fbe88be9d2ac4e6b3c9d0d537a8b38986b24480a54495442c6206e9eb163

C:\Users\Admin\AppData\Local\Microsoft\[email protected]

MD5 de348ef9eed7ccdaed5a70ae15796a86
SHA1 42914d94e8024ca94e58bb4bd9cfa4d0ae524975
SHA256 a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855
SHA512 605bdb115b9fc95b1c0924f01b3b62b27737d94fe97825e81ebc5f1de107a317bd47fbe88be9d2ac4e6b3c9d0d537a8b38986b24480a54495442c6206e9eb163

C:\Users\Admin\AppData\Local\Microsoft\vjvE57][email protected]

MD5 6ac14216327dcfb60b33ebd914f62769
SHA1 d55eba9a523347f5ee65c9e27a3dc73a1eb4cf7b
SHA256 25f77a058ec8aff36602762a75066b3ba52652ce90fc823b51dc81e4b14bbeb9
SHA512 6af659cfee302b0faefd85a87bc0aa3e10c40aeb18c6246cf2b335a34b40c21279f1b76ae420217f2caa3913d66e96116860ce442fad5fe465d2273de79ff3ed

C:\Users\Admin\AppData\Local\Microsoft\vjvE57][email protected]

MD5 6ac14216327dcfb60b33ebd914f62769
SHA1 d55eba9a523347f5ee65c9e27a3dc73a1eb4cf7b
SHA256 25f77a058ec8aff36602762a75066b3ba52652ce90fc823b51dc81e4b14bbeb9
SHA512 6af659cfee302b0faefd85a87bc0aa3e10c40aeb18c6246cf2b335a34b40c21279f1b76ae420217f2caa3913d66e96116860ce442fad5fe465d2273de79ff3ed

memory/180-260-0x000001D97F270000-0x000001D97F275000-memory.dmp

memory/180-261-0x00007FFF08AD0000-0x00007FFF08CC5000-memory.dmp

memory/4252-262-0x0000000000510000-0x0000000000610000-memory.dmp

memory/4252-263-0x0000000001FF0000-0x0000000001FF9000-memory.dmp

memory/4236-264-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\nfCnEcb[.exe

MD5 09d7f30d2f8432be6087038562a029dd
SHA1 07fc20446a03a20c191e750ef21737ec948d9544
SHA256 8c7319e9b6bd1ec0fa5658aaf55096a7e549b21a380de406c705969f165cb3f8
SHA512 abc4670991a0a109a292d36f2b5116685374d0c85c157eefac3b44e240050b51c41839b8df4ffdad3ef6460dcd70c2b9457492c7d486fccd7a48e931cebacf7e

memory/4236-266-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3816-267-0x0000000000750000-0x0000000000850000-memory.dmp

memory/3816-268-0x0000000000600000-0x0000000000605000-memory.dmp

memory/3816-269-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3388-271-0x0000000000850000-0x0000000000950000-memory.dmp

memory/3388-272-0x00000000020F0000-0x00000000020FF000-memory.dmp

memory/3388-273-0x0000000000400000-0x00000000004E3000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\[email protected]

MD5 de348ef9eed7ccdaed5a70ae15796a86
SHA1 42914d94e8024ca94e58bb4bd9cfa4d0ae524975
SHA256 a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855
SHA512 605bdb115b9fc95b1c0924f01b3b62b27737d94fe97825e81ebc5f1de107a317bd47fbe88be9d2ac4e6b3c9d0d537a8b38986b24480a54495442c6206e9eb163

memory/3160-278-0x00000000026C0000-0x00000000026D6000-memory.dmp

memory/4236-279-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id[C14A9462-3483].[[email protected]].8base

MD5 7078f7a0fde81d09c34f36515216069b
SHA1 8dff7f6b04e55e616ffe09ab31e0ea2031d5927d
SHA256 43fee4db44c70aeee45535be0e89844295879a1b6e5e02c0791fc4d58ca8b1a5
SHA512 1ba3793ab4fc696bf5d82add1e4b33170df727983ae8ccdfb8257b751d15f5332cb0d119d0a2867f4267af9bb740b4975628a06f9323302aec751a821d34d4ef

memory/3816-426-0x0000000000600000-0x0000000000605000-memory.dmp

memory/3816-499-0x0000000000750000-0x0000000000850000-memory.dmp

memory/3388-557-0x0000000000850000-0x0000000000950000-memory.dmp

memory/3388-613-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3388-657-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3388-1756-0x0000000000400000-0x00000000004E3000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-14 23:51

Reported

2023-07-14 23:53

Platform

win7-20230712-en

Max time kernel

114s

Max time network

140s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1540 created 1308 N/A C:\Users\Admin\AppData\Local\Temp\2CAC.exe C:\Windows\Explorer.EXE

SystemBC

trojan systembc

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\R4x%wa8d~-.exe C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\R4x%wa8d~- = "C:\\Users\\Admin\\AppData\\Local\\R4x%wa8d~-.exe" C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\R4x%wa8d~- = "C:\\Users\\Admin\\AppData\\Local\\R4x%wa8d~-.exe" C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-722410544-1258951091-1992882075-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-722410544-1258951091-1992882075-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 592 set thread context of 1712 N/A C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\7-zip.chm.id[AD71426D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File opened for modification C:\Program Files\7-Zip\7-zip32.dll C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File created C:\Program Files\7-Zip\7zFM.exe.id[AD71426D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File created C:\Program Files\7-Zip\History.txt.id[AD71426D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.dll.id[AD71426D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File created C:\Program Files\7-Zip\7z.exe.id[AD71426D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx.id[AD71426D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File created C:\Program Files\7-Zip\7zG.exe.id[AD71426D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File opened for modification C:\Program Files\7-Zip\descript.ion C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File opened for modification C:\Program Files\7-Zip\7-zip.chm C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File created C:\Program Files\7-Zip\descript.ion.id[AD71426D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File opened for modification C:\Program Files\7-Zip\History.txt C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File opened for modification C:\Program Files\7-Zip\7-zip.dll C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.id[AD71426D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.sfx C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.id[AD71426D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File opened for modification C:\Program Files\7-Zip\7zCon.sfx C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\af.txt C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.id[AD71426D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\a85fc38903152fcf020fb5ac1d90aa10.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\a85fc38903152fcf020fb5ac1d90aa10.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\a85fc38903152fcf020fb5ac1d90aa10.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a85fc38903152fcf020fb5ac1d90aa10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a85fc38903152fcf020fb5ac1d90aa10.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1308 wrote to memory of 1540 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\2CAC.exe
PID 1308 wrote to memory of 1540 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\2CAC.exe
PID 1308 wrote to memory of 1540 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\2CAC.exe
PID 1308 wrote to memory of 1540 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\2CAC.exe
PID 1308 wrote to memory of 2424 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2424 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2424 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2424 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2424 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 1344 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 1308 wrote to memory of 1344 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 1308 wrote to memory of 1344 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 1308 wrote to memory of 1344 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 1308 wrote to memory of 2408 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2408 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2408 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2408 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2408 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2864 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 1308 wrote to memory of 2864 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 1308 wrote to memory of 2864 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 1308 wrote to memory of 2864 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 1308 wrote to memory of 2924 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2924 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2924 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2924 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2924 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2320 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2320 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2320 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2320 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2320 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 3060 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 3060 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 3060 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 3060 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 3060 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 3064 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 1308 wrote to memory of 3064 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 1308 wrote to memory of 3064 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 1308 wrote to memory of 3064 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 1308 wrote to memory of 2724 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2724 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2724 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2724 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1308 wrote to memory of 2724 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1540 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\2CAC.exe C:\Windows\system32\certreq.exe
PID 1540 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\2CAC.exe C:\Windows\system32\certreq.exe
PID 1540 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\2CAC.exe C:\Windows\system32\certreq.exe
PID 1540 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\2CAC.exe C:\Windows\system32\certreq.exe
PID 1540 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\2CAC.exe C:\Windows\system32\certreq.exe
PID 1540 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\2CAC.exe C:\Windows\system32\certreq.exe
PID 592 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe
PID 592 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe
PID 592 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe
PID 592 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe
PID 592 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe
PID 592 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe
PID 592 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe
PID 2768 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe C:\Windows\system32\cmd.exe
PID 2768 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe C:\Windows\system32\cmd.exe
PID 2768 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe C:\Windows\system32\cmd.exe
PID 2768 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe C:\Windows\system32\cmd.exe
PID 2768 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe C:\Windows\system32\cmd.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\a85fc38903152fcf020fb5ac1d90aa10.exe

"C:\Users\Admin\AppData\Local\Temp\a85fc38903152fcf020fb5ac1d90aa10.exe"

C:\Users\Admin\AppData\Local\Temp\2CAC.exe

C:\Users\Admin\AppData\Local\Temp\2CAC.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe

"C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe"

C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe

"C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe"

C:\Users\Admin\AppData\Local\Microsoft\zlT.exe

"C:\Users\Admin\AppData\Local\Microsoft\zlT.exe"

C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe

"C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe"

C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe

"C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Users\Admin\AppData\Local\Temp\AFEF.exe

C:\Users\Admin\AppData\Local\Temp\AFEF.exe

C:\Users\Admin\AppData\Local\Temp\B1E3.exe

C:\Users\Admin\AppData\Local\Temp\B1E3.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 stalagmijesarl.com udp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 admxlogs25.xyz udp
EE 46.36.218.224:80 admxlogs25.xyz tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 github.com udp
US 140.82.114.4:443 github.com tcp
US 140.82.114.4:443 github.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 admlogs195.xyz udp
EE 46.36.219.3:80 admlogs195.xyz tcp
EE 46.36.219.3:80 admlogs195.xyz tcp
EE 46.36.219.3:80 admlogs195.xyz tcp
US 8.8.8.8:53 serverxlogs21.xyz udp
DE 45.131.66.120:80 serverxlogs21.xyz tcp
US 8.8.8.8:53 cexsad917.xyz udp
EE 46.36.218.224:80 cexsad917.xyz tcp

Files

memory/2000-55-0x00000000005E0000-0x00000000006E0000-memory.dmp

memory/2000-56-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2000-57-0x0000000000220000-0x0000000000229000-memory.dmp

memory/2000-59-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/1308-58-0x0000000002590000-0x00000000025A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2CAC.exe

MD5 aaf3d68aeea347268ede50e621ca21ce
SHA1 0e7c0e38a200a9ea3af663dfd33941cc5e1657c9
SHA256 09c9bc026f600cb19848ba96858b3dbfe13f03358dc0703818d3bfa3d632d416
SHA512 61416225031cbb74114ee61e3f7ce697e73423c75a0f2e96f51557b3d289ad868034e2e07ead926cd12a95b524ed37cf1626dc75dc99c47fac9cb8f843002bd0

C:\Users\Admin\AppData\Local\Temp\2CAC.exe

MD5 aaf3d68aeea347268ede50e621ca21ce
SHA1 0e7c0e38a200a9ea3af663dfd33941cc5e1657c9
SHA256 09c9bc026f600cb19848ba96858b3dbfe13f03358dc0703818d3bfa3d632d416
SHA512 61416225031cbb74114ee61e3f7ce697e73423c75a0f2e96f51557b3d289ad868034e2e07ead926cd12a95b524ed37cf1626dc75dc99c47fac9cb8f843002bd0

memory/2424-77-0x0000000000080000-0x000000000008B000-memory.dmp

memory/2424-78-0x0000000000080000-0x000000000008B000-memory.dmp

memory/2424-76-0x0000000000090000-0x0000000000097000-memory.dmp

memory/1344-79-0x00000000000E0000-0x00000000000EF000-memory.dmp

memory/1344-80-0x00000000000F0000-0x00000000000F9000-memory.dmp

memory/1344-81-0x00000000000E0000-0x00000000000EF000-memory.dmp

memory/2408-82-0x0000000000080000-0x0000000000089000-memory.dmp

memory/2408-83-0x0000000000090000-0x0000000000095000-memory.dmp

memory/2864-85-0x0000000000070000-0x0000000000076000-memory.dmp

memory/2864-86-0x0000000000060000-0x000000000006C000-memory.dmp

memory/2864-84-0x0000000000060000-0x000000000006C000-memory.dmp

memory/2924-90-0x0000000000080000-0x00000000000A7000-memory.dmp

memory/2424-89-0x0000000000090000-0x0000000000097000-memory.dmp

memory/2924-88-0x0000000000080000-0x00000000000A7000-memory.dmp

memory/2924-87-0x00000000000B0000-0x00000000000D2000-memory.dmp

memory/2320-91-0x00000000000C0000-0x00000000000C9000-memory.dmp

memory/2320-92-0x00000000000D0000-0x00000000000D5000-memory.dmp

memory/3060-93-0x0000000000080000-0x000000000008B000-memory.dmp

memory/1344-94-0x00000000000F0000-0x00000000000F9000-memory.dmp

memory/3060-95-0x0000000000080000-0x000000000008B000-memory.dmp

memory/2408-97-0x0000000000080000-0x0000000000089000-memory.dmp

memory/3064-96-0x0000000000060000-0x000000000006D000-memory.dmp

memory/3064-98-0x0000000000080000-0x000000000008B000-memory.dmp

memory/3064-99-0x0000000000060000-0x000000000006D000-memory.dmp

memory/2924-104-0x00000000000B0000-0x00000000000D2000-memory.dmp

memory/2724-103-0x0000000000080000-0x000000000008B000-memory.dmp

memory/2724-102-0x0000000000090000-0x0000000000098000-memory.dmp

memory/2864-101-0x0000000000070000-0x0000000000076000-memory.dmp

memory/2724-100-0x0000000000080000-0x000000000008B000-memory.dmp

memory/1540-105-0x00000000006F0000-0x00000000007F0000-memory.dmp

memory/1540-106-0x0000000000400000-0x0000000000517000-memory.dmp

memory/1540-107-0x0000000000250000-0x00000000002C1000-memory.dmp

memory/2320-108-0x00000000000C0000-0x00000000000C9000-memory.dmp

memory/1540-109-0x00000000002E0000-0x00000000002E7000-memory.dmp

memory/1540-110-0x0000000001D80000-0x0000000002180000-memory.dmp

memory/1540-111-0x0000000001D80000-0x0000000002180000-memory.dmp

memory/1540-112-0x0000000001D80000-0x0000000002180000-memory.dmp

memory/1540-113-0x0000000001D80000-0x0000000002180000-memory.dmp

memory/2724-114-0x0000000000090000-0x0000000000098000-memory.dmp

memory/2840-115-0x0000000000060000-0x0000000000063000-memory.dmp

memory/1540-116-0x00000000006F0000-0x00000000007F0000-memory.dmp

memory/1540-117-0x0000000000400000-0x0000000000517000-memory.dmp

memory/1540-118-0x0000000002870000-0x00000000028A6000-memory.dmp

memory/1540-126-0x0000000001D80000-0x0000000002180000-memory.dmp

memory/1540-125-0x0000000002870000-0x00000000028A6000-memory.dmp

memory/1540-129-0x0000000001D80000-0x0000000002180000-memory.dmp

memory/1540-128-0x0000000000400000-0x0000000000517000-memory.dmp

memory/2840-130-0x0000000000060000-0x0000000000063000-memory.dmp

memory/2840-131-0x00000000001A0000-0x00000000001A7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2CAC.exe

MD5 aaf3d68aeea347268ede50e621ca21ce
SHA1 0e7c0e38a200a9ea3af663dfd33941cc5e1657c9
SHA256 09c9bc026f600cb19848ba96858b3dbfe13f03358dc0703818d3bfa3d632d416
SHA512 61416225031cbb74114ee61e3f7ce697e73423c75a0f2e96f51557b3d289ad868034e2e07ead926cd12a95b524ed37cf1626dc75dc99c47fac9cb8f843002bd0

memory/2840-133-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

memory/2840-134-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

memory/2840-135-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

memory/2840-136-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

memory/2840-138-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

memory/2840-140-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

memory/2840-141-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

memory/2840-142-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

memory/2840-143-0x00000000775F0000-0x0000000077799000-memory.dmp

memory/2840-144-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

memory/2840-145-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

memory/2840-146-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

memory/2840-147-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

memory/2840-148-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe

MD5 09d7f30d2f8432be6087038562a029dd
SHA1 07fc20446a03a20c191e750ef21737ec948d9544
SHA256 8c7319e9b6bd1ec0fa5658aaf55096a7e549b21a380de406c705969f165cb3f8
SHA512 abc4670991a0a109a292d36f2b5116685374d0c85c157eefac3b44e240050b51c41839b8df4ffdad3ef6460dcd70c2b9457492c7d486fccd7a48e931cebacf7e

C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe

MD5 de348ef9eed7ccdaed5a70ae15796a86
SHA1 42914d94e8024ca94e58bb4bd9cfa4d0ae524975
SHA256 a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855
SHA512 605bdb115b9fc95b1c0924f01b3b62b27737d94fe97825e81ebc5f1de107a317bd47fbe88be9d2ac4e6b3c9d0d537a8b38986b24480a54495442c6206e9eb163

memory/2840-156-0x00000000775F0000-0x0000000077799000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\zlT.exe

MD5 6ac14216327dcfb60b33ebd914f62769
SHA1 d55eba9a523347f5ee65c9e27a3dc73a1eb4cf7b
SHA256 25f77a058ec8aff36602762a75066b3ba52652ce90fc823b51dc81e4b14bbeb9
SHA512 6af659cfee302b0faefd85a87bc0aa3e10c40aeb18c6246cf2b335a34b40c21279f1b76ae420217f2caa3913d66e96116860ce442fad5fe465d2273de79ff3ed

memory/2840-159-0x00000000001A0000-0x00000000001A2000-memory.dmp

memory/2840-160-0x00000000775F0000-0x0000000077799000-memory.dmp

memory/2768-161-0x0000000000600000-0x0000000000700000-memory.dmp

memory/2768-162-0x0000000000220000-0x000000000022F000-memory.dmp

memory/2768-164-0x0000000000400000-0x00000000004E3000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe

MD5 de348ef9eed7ccdaed5a70ae15796a86
SHA1 42914d94e8024ca94e58bb4bd9cfa4d0ae524975
SHA256 a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855
SHA512 605bdb115b9fc95b1c0924f01b3b62b27737d94fe97825e81ebc5f1de107a317bd47fbe88be9d2ac4e6b3c9d0d537a8b38986b24480a54495442c6206e9eb163

C:\Users\Admin\AppData\Local\Microsoft\R4x%wa8d~-.exe

MD5 de348ef9eed7ccdaed5a70ae15796a86
SHA1 42914d94e8024ca94e58bb4bd9cfa4d0ae524975
SHA256 a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855
SHA512 605bdb115b9fc95b1c0924f01b3b62b27737d94fe97825e81ebc5f1de107a317bd47fbe88be9d2ac4e6b3c9d0d537a8b38986b24480a54495442c6206e9eb163

memory/592-167-0x00000000005D0000-0x00000000006D0000-memory.dmp

memory/592-168-0x0000000000220000-0x0000000000229000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe

MD5 09d7f30d2f8432be6087038562a029dd
SHA1 07fc20446a03a20c191e750ef21737ec948d9544
SHA256 8c7319e9b6bd1ec0fa5658aaf55096a7e549b21a380de406c705969f165cb3f8
SHA512 abc4670991a0a109a292d36f2b5116685374d0c85c157eefac3b44e240050b51c41839b8df4ffdad3ef6460dcd70c2b9457492c7d486fccd7a48e931cebacf7e

memory/1712-170-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1712-172-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\(%pbQt_y3J.exe

MD5 09d7f30d2f8432be6087038562a029dd
SHA1 07fc20446a03a20c191e750ef21737ec948d9544
SHA256 8c7319e9b6bd1ec0fa5658aaf55096a7e549b21a380de406c705969f165cb3f8
SHA512 abc4670991a0a109a292d36f2b5116685374d0c85c157eefac3b44e240050b51c41839b8df4ffdad3ef6460dcd70c2b9457492c7d486fccd7a48e931cebacf7e

memory/1712-174-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2768-175-0x0000000000600000-0x0000000000700000-memory.dmp

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[AD71426D-3483].[[email protected]].8base

MD5 ae65977c672aa0868f3a2314f560d8e1
SHA1 5e0e770560ba9c78f9413bfa6d90a27cbe1be209
SHA256 5f17c6dc9f3d06f60d6334ca23ef5ca168e2313d722ff52e624cdd929b5ce5ac
SHA512 c081d4aef47c386ca5f5f93a636a83fbe68e11087d6beaad9fd9f7b8252b2a9a62bcd004838ac62f3589cab8bad322907199aa0491882db8c54c95c73b3043ae

memory/2768-375-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2768-377-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/1308-417-0x0000000002CB0000-0x0000000002CC6000-memory.dmp

memory/1712-418-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3020-439-0x0000000000560000-0x0000000000660000-memory.dmp

memory/3020-440-0x00000000002B0000-0x00000000002B5000-memory.dmp

memory/3020-460-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2768-1378-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3020-1963-0x0000000000560000-0x0000000000660000-memory.dmp

memory/3020-1964-0x00000000002B0000-0x00000000002B5000-memory.dmp

memory/2768-3031-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/944-3034-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/944-3035-0x0000000000610000-0x0000000000710000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AFEF.exe

MD5 de348ef9eed7ccdaed5a70ae15796a86
SHA1 42914d94e8024ca94e58bb4bd9cfa4d0ae524975
SHA256 a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855
SHA512 605bdb115b9fc95b1c0924f01b3b62b27737d94fe97825e81ebc5f1de107a317bd47fbe88be9d2ac4e6b3c9d0d537a8b38986b24480a54495442c6206e9eb163

C:\Users\Admin\AppData\Local\Temp\AFEF.exe

MD5 de348ef9eed7ccdaed5a70ae15796a86
SHA1 42914d94e8024ca94e58bb4bd9cfa4d0ae524975
SHA256 a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855
SHA512 605bdb115b9fc95b1c0924f01b3b62b27737d94fe97825e81ebc5f1de107a317bd47fbe88be9d2ac4e6b3c9d0d537a8b38986b24480a54495442c6206e9eb163

C:\Users\Admin\AppData\Local\Temp\B1E3.exe

MD5 6ac14216327dcfb60b33ebd914f62769
SHA1 d55eba9a523347f5ee65c9e27a3dc73a1eb4cf7b
SHA256 25f77a058ec8aff36602762a75066b3ba52652ce90fc823b51dc81e4b14bbeb9
SHA512 6af659cfee302b0faefd85a87bc0aa3e10c40aeb18c6246cf2b335a34b40c21279f1b76ae420217f2caa3913d66e96116860ce442fad5fe465d2273de79ff3ed

C:\Users\Admin\AppData\Local\Temp\B1E3.exe

MD5 6ac14216327dcfb60b33ebd914f62769
SHA1 d55eba9a523347f5ee65c9e27a3dc73a1eb4cf7b
SHA256 25f77a058ec8aff36602762a75066b3ba52652ce90fc823b51dc81e4b14bbeb9
SHA512 6af659cfee302b0faefd85a87bc0aa3e10c40aeb18c6246cf2b335a34b40c21279f1b76ae420217f2caa3913d66e96116860ce442fad5fe465d2273de79ff3ed

memory/776-3257-0x0000000000080000-0x00000000000EB000-memory.dmp

memory/776-3258-0x00000000001D0000-0x0000000000245000-memory.dmp

memory/776-3264-0x0000000000080000-0x00000000000EB000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g1epp91b.default-release\cookies.sqlite.id[AD71426D-3483].[[email protected]].8base

MD5 a7f33ff4cc6ee1a5780f4f331f225425
SHA1 a017f8557467b81cbfb0912e0cdd4c5f48a93dd9
SHA256 7ccbe0db1203efb774481ce02128d81098a5b147fb27ac77f6c020b42c72cedf
SHA512 9c4553dff6c917c73d833c314800bed2b140052faef4fe3a3dfd1cbb18294332de5f84a6d5135fc0d5c4117b23de250a346175f1caedc5e4171e82f8954e5970

memory/776-3292-0x0000000000080000-0x00000000000EB000-memory.dmp

memory/1076-3307-0x0000000000070000-0x0000000000077000-memory.dmp

memory/1076-3323-0x0000000000060000-0x000000000006C000-memory.dmp

memory/1076-3302-0x0000000000060000-0x000000000006C000-memory.dmp

memory/2256-3440-0x0000000000090000-0x0000000000094000-memory.dmp

memory/2256-3415-0x0000000000080000-0x0000000000089000-memory.dmp

memory/2256-3445-0x0000000000080000-0x0000000000089000-memory.dmp

memory/2992-3486-0x0000000000080000-0x000000000008B000-memory.dmp

memory/2992-3488-0x0000000000080000-0x000000000008B000-memory.dmp

memory/2992-3487-0x0000000000090000-0x000000000009A000-memory.dmp

memory/2788-3545-0x0000000000090000-0x0000000000097000-memory.dmp

memory/2472-3673-0x0000000000060000-0x000000000006F000-memory.dmp

memory/2768-3890-0x0000000000400000-0x00000000004E3000-memory.dmp