Malware Analysis Report

2024-10-23 15:42

Sample ID 230725-sa124sdh9z
Target 2f28772b3cf7328df4f249e872568c2d.exe
SHA256 f2028b4fb0b43abc5a062bd359622b254dbf0e301f2a8b842d062896ca24692b
Tags
laplas clipper discovery evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f2028b4fb0b43abc5a062bd359622b254dbf0e301f2a8b842d062896ca24692b

Threat Level: Known bad

The file 2f28772b3cf7328df4f249e872568c2d.exe was found to be: Known bad.

Malicious Activity Summary

laplas clipper discovery evasion persistence spyware stealer trojan

Laplas Clipper

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Checks BIOS information in registry

Executes dropped EXE

Adds Run key to start application

Checks whether UAC is enabled

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Enumerates physical storage devices

Modifies system certificate store

GoLang User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-25 14:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-25 14:56

Reported

2023-07-25 14:58

Platform

win7-20230712-en

Max time kernel

132s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe"

Signatures

Laplas Clipper

stealer clipper laplas

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe

"C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe"

C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe

"C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe"

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Network

Country Destination Domain Proto
NL 185.209.161.53:80 185.209.161.53 tcp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
NL 45.159.189.33:80 45.159.189.33 tcp

Files

memory/2064-54-0x0000000002C30000-0x0000000002D30000-memory.dmp

memory/2064-55-0x0000000000400000-0x0000000002B4C000-memory.dmp

memory/2064-56-0x0000000000220000-0x000000000023B000-memory.dmp

memory/2064-57-0x0000000061E00000-0x0000000061EF3000-memory.dmp

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/2064-127-0x0000000000400000-0x0000000002B4C000-memory.dmp

memory/2064-128-0x0000000002C30000-0x0000000002D30000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe

MD5 299a2d8412301a6c84f2da3c446943c2
SHA1 0f4b455e8a8f0fc278a7fe91db90fafaccfe04fc
SHA256 51a7a57fe94c2dce32f7125d2c9827e208e38b8f7b57bd5b0b09f188f656e37f
SHA512 751a7fa958d96c91e49da893fbf33d4d066dd32f95d10106764064154c11dc9ce7b782e83d96118e0599501974890d311d1d35a34f67843242baffdbdeb6df1a

\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe

MD5 299a2d8412301a6c84f2da3c446943c2
SHA1 0f4b455e8a8f0fc278a7fe91db90fafaccfe04fc
SHA256 51a7a57fe94c2dce32f7125d2c9827e208e38b8f7b57bd5b0b09f188f656e37f
SHA512 751a7fa958d96c91e49da893fbf33d4d066dd32f95d10106764064154c11dc9ce7b782e83d96118e0599501974890d311d1d35a34f67843242baffdbdeb6df1a

memory/688-132-0x0000000001E30000-0x00000000025F1000-memory.dmp

memory/640-133-0x0000000001170000-0x0000000001931000-memory.dmp

memory/640-134-0x00000000777D0000-0x0000000077979000-memory.dmp

memory/640-135-0x0000000001170000-0x0000000001931000-memory.dmp

memory/640-136-0x0000000001170000-0x0000000001931000-memory.dmp

memory/640-138-0x0000000001170000-0x0000000001931000-memory.dmp

memory/640-137-0x0000000001170000-0x0000000001931000-memory.dmp

memory/640-139-0x0000000001170000-0x0000000001931000-memory.dmp

memory/640-140-0x0000000001170000-0x0000000001931000-memory.dmp

memory/640-141-0x0000000001170000-0x0000000001931000-memory.dmp

memory/640-142-0x0000000001170000-0x0000000001931000-memory.dmp

memory/640-143-0x0000000001170000-0x0000000001931000-memory.dmp

memory/640-144-0x0000000001170000-0x0000000001931000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe

MD5 299a2d8412301a6c84f2da3c446943c2
SHA1 0f4b455e8a8f0fc278a7fe91db90fafaccfe04fc
SHA256 51a7a57fe94c2dce32f7125d2c9827e208e38b8f7b57bd5b0b09f188f656e37f
SHA512 751a7fa958d96c91e49da893fbf33d4d066dd32f95d10106764064154c11dc9ce7b782e83d96118e0599501974890d311d1d35a34f67843242baffdbdeb6df1a

memory/640-146-0x0000000001170000-0x0000000001931000-memory.dmp

memory/688-147-0x0000000001E30000-0x00000000025F1000-memory.dmp

memory/640-148-0x00000000777D0000-0x0000000077979000-memory.dmp

memory/640-149-0x0000000001170000-0x0000000001931000-memory.dmp

memory/640-150-0x0000000001170000-0x0000000001931000-memory.dmp

\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 85169d9da1ebba9ec9f1d5e612379986
SHA1 67b7d39da2d93ffd74a54cb959e43a65422a7a1d
SHA256 fe8ac3636c9a5fd26df9193fef403117504e75d8cfb2b4b8c6a4bcf71f5b6f51
SHA512 dddd0535dc6f10ee0f248fa5dc02807aadf69a30c057a07b073deaf5e519f022fbf3ff11d09373aab3aae08a7e80c4589a465ad38cc752863a3ead5c2cf653da

memory/640-153-0x0000000028220000-0x00000000289E1000-memory.dmp

memory/2496-156-0x0000000000060000-0x0000000000821000-memory.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 6fa58669058eddc1e4446aeedf1bd927
SHA1 512df0cfc045cc01cfd6859c104061e9757f5a6d
SHA256 1304f988ddc3b0a0473cd8b1fcb30af162670b5508ad1a32b9bd3a044b62c36c
SHA512 65f4fd68394a975ed6dbf9492f86cc696c7c52d57fe7e93875f7ecf70a6104d098bd0584f2a9e6e821663bf5fd3a85ec66748d0330639b630c162940ed016bba

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 470fc014b05e517087e5ed0a89823257
SHA1 b704bc4a43eda12856f047d16ac2c625c59f0584
SHA256 de2f62aaf434d443601bf0137feac89a5c6fffd211dde73ae039a6e7241955ca
SHA512 3b7ae5380bd9057fa2fe77f961a9417d6c2c97df7ad9852605123c115e4184f7c1a2f208acc4c0e679216d25436fa54e624f6d7dd9e520e856444720f0c81b5c

memory/640-157-0x0000000001170000-0x0000000001931000-memory.dmp

memory/640-158-0x00000000777D0000-0x0000000077979000-memory.dmp

memory/2496-159-0x00000000777D0000-0x0000000077979000-memory.dmp

memory/2496-160-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-161-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-162-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-163-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-164-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-166-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-165-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-168-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-167-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-169-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-170-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-171-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-172-0x00000000777D0000-0x0000000077979000-memory.dmp

memory/2496-173-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-174-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-175-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-176-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-177-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-178-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-181-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-182-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-183-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-184-0x0000000000060000-0x0000000000821000-memory.dmp

memory/2496-185-0x0000000000060000-0x0000000000821000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-07-25 14:56

Reported

2023-07-25 14:58

Platform

win10v2004-20230703-en

Max time kernel

147s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe"

Signatures

Laplas Clipper

stealer clipper laplas

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\JEBKJDAFHJ.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\JEBKJDAFHJ.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\JEBKJDAFHJ.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JEBKJDAFHJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\JEBKJDAFHJ.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\JEBKJDAFHJ.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JEBKJDAFHJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe

"C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JEBKJDAFHJ.exe"

C:\Users\Admin\AppData\Local\Temp\JEBKJDAFHJ.exe

"C:\Users\Admin\AppData\Local\Temp\JEBKJDAFHJ.exe"

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
NL 185.209.161.53:80 185.209.161.53 tcp
US 8.8.8.8:53 53.161.209.185.in-addr.arpa udp
US 8.8.8.8:53 54.120.234.20.in-addr.arpa udp
US 8.8.8.8:53 76.214.17.2.in-addr.arpa udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 126.151.241.8.in-addr.arpa udp
NL 45.159.189.33:80 45.159.189.33 tcp
US 8.8.8.8:53 33.189.159.45.in-addr.arpa udp
US 52.109.13.63:443 tcp
US 8.8.8.8:53 121.208.253.8.in-addr.arpa udp

Files

memory/3708-134-0x0000000002E70000-0x0000000002F70000-memory.dmp

memory/3708-135-0x0000000002CA0000-0x0000000002CBB000-memory.dmp

memory/3708-136-0x0000000000400000-0x0000000002B4C000-memory.dmp

memory/3708-137-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/3708-211-0x0000000002E70000-0x0000000002F70000-memory.dmp

memory/3708-214-0x0000000000400000-0x0000000002B4C000-memory.dmp

memory/3708-215-0x0000000002CA0000-0x0000000002CBB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\JEBKJDAFHJ.exe

MD5 299a2d8412301a6c84f2da3c446943c2
SHA1 0f4b455e8a8f0fc278a7fe91db90fafaccfe04fc
SHA256 51a7a57fe94c2dce32f7125d2c9827e208e38b8f7b57bd5b0b09f188f656e37f
SHA512 751a7fa958d96c91e49da893fbf33d4d066dd32f95d10106764064154c11dc9ce7b782e83d96118e0599501974890d311d1d35a34f67843242baffdbdeb6df1a

C:\Users\Admin\AppData\Local\Temp\JEBKJDAFHJ.exe

MD5 299a2d8412301a6c84f2da3c446943c2
SHA1 0f4b455e8a8f0fc278a7fe91db90fafaccfe04fc
SHA256 51a7a57fe94c2dce32f7125d2c9827e208e38b8f7b57bd5b0b09f188f656e37f
SHA512 751a7fa958d96c91e49da893fbf33d4d066dd32f95d10106764064154c11dc9ce7b782e83d96118e0599501974890d311d1d35a34f67843242baffdbdeb6df1a

memory/3356-220-0x0000000000880000-0x0000000001041000-memory.dmp

memory/3356-221-0x00007FFB5ED50000-0x00007FFB5EF45000-memory.dmp

memory/3356-222-0x0000000000880000-0x0000000001041000-memory.dmp

memory/3356-223-0x0000000000880000-0x0000000001041000-memory.dmp

memory/3356-224-0x0000000000880000-0x0000000001041000-memory.dmp

memory/3356-225-0x0000000000880000-0x0000000001041000-memory.dmp

memory/3356-226-0x0000000000880000-0x0000000001041000-memory.dmp

memory/3356-227-0x0000000000880000-0x0000000001041000-memory.dmp

memory/3356-228-0x0000000000880000-0x0000000001041000-memory.dmp

memory/3356-229-0x0000000000880000-0x0000000001041000-memory.dmp

memory/3356-230-0x0000000000880000-0x0000000001041000-memory.dmp

memory/3356-231-0x0000000000880000-0x0000000001041000-memory.dmp

memory/3356-232-0x0000000000880000-0x0000000001041000-memory.dmp

memory/3356-233-0x0000000000880000-0x0000000001041000-memory.dmp

memory/3356-235-0x00007FFB5ED50000-0x00007FFB5EF45000-memory.dmp

memory/3356-236-0x0000000000880000-0x0000000001041000-memory.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 1b976ee18f4b2e96f6f4aceb1ca7f2a2
SHA1 2ae263ea9595f2ce5f3b53aa781e45b8d30e946d
SHA256 1f9733adc482f53436d6daac028480766ee2d6d9a4d3212b700bbb34923580fa
SHA512 55e33040ca37f23f319428b71aa461eb64910068b31782b0628fbaa8dde370036b9e634668af25dd8f8be39c7984710b8dd6daa9b3fc013d93d75d9e2ea07fef

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 1d690531095636a41379a0b46c2b5805
SHA1 cda3809cc0ff876c348503f85e48fa5cfe632768
SHA256 422110d6571cb2bb6fe97d8f5e7b5cf931be756573aebf4a28e824ebf254cd40
SHA512 6eb420679ba29307801e7eb5e9a740a5ce535dd4e81ea6fcbfb2e2d1e4b88e918d599b6013f93001c0792a61855cde695f056c38d357621a80914399c43bb2ea

memory/3356-240-0x0000000000880000-0x0000000001041000-memory.dmp

memory/384-242-0x0000000000770000-0x0000000000F31000-memory.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 e43f4bdba85f5917cf24596f4c054ece
SHA1 63d66c1f5f4fb696c78b354bf7e0739fa2d00eb1
SHA256 09263f4bec7256cfe934d3c9b13f852701930bc4d1e7409b0417944f47ea82f1
SHA512 79757e1473a2d59af96598db1ad1c8975f66fdf31747e06ff753a2ae13878f36860feb833f63ae040cdc08802cb9e9ca7b722e8e005c84397b7b707261ba9dd4

memory/3356-243-0x00007FFB5ED50000-0x00007FFB5EF45000-memory.dmp

memory/384-244-0x00007FFB5ED50000-0x00007FFB5EF45000-memory.dmp

memory/384-245-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-246-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-247-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-248-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-249-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-250-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-251-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-252-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-253-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-254-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-255-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-256-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-257-0x00007FFB5ED50000-0x00007FFB5EF45000-memory.dmp

memory/384-258-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-259-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-260-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-262-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-263-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-264-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-265-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-266-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-267-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-268-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-269-0x0000000000770000-0x0000000000F31000-memory.dmp

memory/384-270-0x0000000000770000-0x0000000000F31000-memory.dmp