Malware Analysis Report

2025-01-03 06:38

Sample ID 230813-lvcfxscf6s
Target 69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe
SHA256 69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827
Tags
asyncrat stormkitty default rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827

Threat Level: Known bad

The file 69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat stormkitty default rat spyware stealer

StormKitty payload

AsyncRat

StormKitty

Async RAT payload

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Drops desktop.ini file(s)

Looks up geolocation information via web service

Looks up external IP address via web service

Enumerates physical storage devices

Unsigned PE

Modifies system certificate store

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-08-13 09:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-08-13 09:50

Reported

2023-08-13 09:53

Platform

win10v2004-20230703-en

Max time kernel

152s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe"

Signatures

AsyncRat

rat asyncrat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ngrok.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\6f627568f974c19c11aa9116512e52c0\Admin@MSXGLQPS_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
File created C:\Users\Admin\AppData\Local\6f627568f974c19c11aa9116512e52c0\Admin@MSXGLQPS_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
File created C:\Users\Admin\AppData\Local\6f627568f974c19c11aa9116512e52c0\Admin@MSXGLQPS_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
File created C:\Users\Admin\AppData\Local\6f627568f974c19c11aa9116512e52c0\Admin@MSXGLQPS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
File created C:\Users\Admin\AppData\Local\6f627568f974c19c11aa9116512e52c0\Admin@MSXGLQPS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
File created C:\Users\Admin\AppData\Local\6f627568f974c19c11aa9116512e52c0\Admin@MSXGLQPS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\6f627568f974c19c11aa9116512e52c0\Admin@MSXGLQPS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
File created C:\Users\Admin\AppData\Local\6f627568f974c19c11aa9116512e52c0\Admin@MSXGLQPS_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Looks up geolocation information via web service

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ngrok.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ngrok.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ngrok.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ngrok.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4748 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4748 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4748 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Users\Admin\AppData\Local\Temp\deneme.exe
PID 4748 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Users\Admin\AppData\Local\Temp\deneme.exe
PID 4748 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Users\Admin\AppData\Local\Temp\deneme.exe
PID 4748 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Users\Admin\AppData\Local\Temp\ngrok.exe
PID 4748 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Users\Admin\AppData\Local\Temp\ngrok.exe
PID 2484 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe C:\Windows\SysWOW64\cmd.exe
PID 2484 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe C:\Windows\SysWOW64\cmd.exe
PID 2484 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe C:\Windows\SysWOW64\cmd.exe
PID 3860 wrote to memory of 1860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3860 wrote to memory of 1860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3860 wrote to memory of 1860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3860 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3860 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3860 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3860 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3860 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3860 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2484 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe C:\Windows\SysWOW64\cmd.exe
PID 2484 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe C:\Windows\SysWOW64\cmd.exe
PID 2484 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe C:\Windows\SysWOW64\cmd.exe
PID 3012 wrote to memory of 3316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3012 wrote to memory of 3316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3012 wrote to memory of 3316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3012 wrote to memory of 4056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3012 wrote to memory of 4056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3012 wrote to memory of 4056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe

"C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAYgBmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAdQBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAbgBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBhACMAPgA="

C:\Users\Admin\AppData\Local\Temp\deneme.exe

"C:\Users\Admin\AppData\Local\Temp\deneme.exe"

C:\Users\Admin\AppData\Local\Temp\ngrok.exe

"C:\Users\Admin\AppData\Local\Temp\ngrok.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 icanhazip.com udp
US 104.18.115.97:80 icanhazip.com tcp
US 8.8.8.8:53 api.mylnikov.org udp
US 172.67.196.114:443 api.mylnikov.org tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:7707 tcp
US 8.8.8.8:53 97.115.18.104.in-addr.arpa udp
US 8.8.8.8:53 114.196.67.172.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
US 8.8.8.8:53 210.143.182.52.in-addr.arpa udp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:7707 tcp

Files

memory/4748-133-0x0000000000370000-0x0000000001B6C000-memory.dmp

memory/4748-134-0x00007FFE8AFF0000-0x00007FFE8BAB1000-memory.dmp

memory/4748-135-0x0000000003C20000-0x0000000003C30000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\deneme.exe

MD5 958062458cd994df325348bb9f8f9d11
SHA1 6d678d971f4239f9304a3a6ac9941b9d7de1ba27
SHA256 109f96c67f55689c41320f832134501ec02389a813eba1d990d192ab378ad533
SHA512 e73c665f0cd3cc53ea4ca0ef50d196fce4783488759bd9f6b8d9cb842382e88327509a317dd328ddf7b7fc988cde06a46cd82fe2783165f75d5f812e231affff

C:\Users\Admin\AppData\Local\Temp\deneme.exe

MD5 958062458cd994df325348bb9f8f9d11
SHA1 6d678d971f4239f9304a3a6ac9941b9d7de1ba27
SHA256 109f96c67f55689c41320f832134501ec02389a813eba1d990d192ab378ad533
SHA512 e73c665f0cd3cc53ea4ca0ef50d196fce4783488759bd9f6b8d9cb842382e88327509a317dd328ddf7b7fc988cde06a46cd82fe2783165f75d5f812e231affff

C:\Users\Admin\AppData\Local\Temp\deneme.exe

MD5 958062458cd994df325348bb9f8f9d11
SHA1 6d678d971f4239f9304a3a6ac9941b9d7de1ba27
SHA256 109f96c67f55689c41320f832134501ec02389a813eba1d990d192ab378ad533
SHA512 e73c665f0cd3cc53ea4ca0ef50d196fce4783488759bd9f6b8d9cb842382e88327509a317dd328ddf7b7fc988cde06a46cd82fe2783165f75d5f812e231affff

memory/980-147-0x00007FFE8AFF0000-0x00007FFE8BAB1000-memory.dmp

memory/980-148-0x0000028C88650000-0x0000028C88660000-memory.dmp

memory/980-149-0x0000028C88650000-0x0000028C88660000-memory.dmp

memory/980-155-0x0000028CA1550000-0x0000028CA1572000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g3xh3hny.um3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\ngrok.exe

MD5 1c900bf7791f168639d27e19a90a9be7
SHA1 ff6b857b8aaf8d9ed72ae300575aeb4ff21925db
SHA256 b25a372ebb6692fbc2d3697467a7611dbbd521dd61ed995fa82c170c3ef50300
SHA512 c0a96693031c56b4375478e7c15f41ef512b7eec72496e26dcb5dc688b13431852e2c30f98ef25a2d06df421e8c688b17fa603887ef3ae6980c6ee3789fe2988

memory/2484-168-0x0000000000B40000-0x0000000000B70000-memory.dmp

memory/2484-169-0x0000000074FA0000-0x0000000075750000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ngrok.exe

MD5 1c900bf7791f168639d27e19a90a9be7
SHA1 ff6b857b8aaf8d9ed72ae300575aeb4ff21925db
SHA256 b25a372ebb6692fbc2d3697467a7611dbbd521dd61ed995fa82c170c3ef50300
SHA512 c0a96693031c56b4375478e7c15f41ef512b7eec72496e26dcb5dc688b13431852e2c30f98ef25a2d06df421e8c688b17fa603887ef3ae6980c6ee3789fe2988

memory/980-173-0x0000028C88650000-0x0000028C88660000-memory.dmp

memory/4748-174-0x00007FFE8AFF0000-0x00007FFE8BAB1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ngrok.exe

MD5 1c900bf7791f168639d27e19a90a9be7
SHA1 ff6b857b8aaf8d9ed72ae300575aeb4ff21925db
SHA256 b25a372ebb6692fbc2d3697467a7611dbbd521dd61ed995fa82c170c3ef50300
SHA512 c0a96693031c56b4375478e7c15f41ef512b7eec72496e26dcb5dc688b13431852e2c30f98ef25a2d06df421e8c688b17fa603887ef3ae6980c6ee3789fe2988

memory/2484-176-0x0000000003030000-0x0000000003040000-memory.dmp

memory/980-179-0x00007FFE8AFF0000-0x00007FFE8BAB1000-memory.dmp

memory/2484-180-0x0000000005670000-0x00000000056D6000-memory.dmp

memory/2484-181-0x0000000074FA0000-0x0000000075750000-memory.dmp

memory/2484-182-0x0000000003030000-0x0000000003040000-memory.dmp

C:\Users\Admin\AppData\Local\6f627568f974c19c11aa9116512e52c0\Admin@MSXGLQPS_en-US\Browsers\Firefox\Bookmarks.txt

MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

C:\Users\Admin\AppData\Local\6f627568f974c19c11aa9116512e52c0\Admin@MSXGLQPS_en-US\System\Process.txt

MD5 ab2421d1e0be0b16ce519f2af166c747
SHA1 e0f76610778e24b83eea090cd630b89fd8dc3e77
SHA256 b90027f576cb86cc1374a0ae20bc2c093ab96e3146407e9a01476f41c3fc2ab5
SHA512 bd38084f17badc6fb6056286dfac4a0307e9e5a75d038795ca0c7886322556e43f0e1df1b7cc45bc1ce88fcfe595b98f58a63efc7d2f6a529fcd43b282d299b7

memory/2484-328-0x0000000003030000-0x0000000003040000-memory.dmp

memory/2484-329-0x00000000064A0000-0x0000000006532000-memory.dmp

memory/2484-330-0x0000000006AF0000-0x0000000007094000-memory.dmp

memory/2484-334-0x00000000066B0000-0x00000000066BA000-memory.dmp

C:\Users\Admin\AppData\Local\2a4b6577027e066b4d69a71f8fdeb526\msgid.dat

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

memory/2484-340-0x0000000003030000-0x0000000003040000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2023-08-13 09:50

Reported

2023-08-13 09:53

Platform

win7-20230712-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe"

Signatures

AsyncRat

rat asyncrat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ngrok.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\6a705ff963b832d927acbcde07d8ffcc\Admin@NYBYVYTJ_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\6a705ff963b832d927acbcde07d8ffcc\Admin@NYBYVYTJ_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
File created C:\Users\Admin\AppData\Local\6a705ff963b832d927acbcde07d8ffcc\Admin@NYBYVYTJ_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\6a705ff963b832d927acbcde07d8ffcc\Admin@NYBYVYTJ_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
File created C:\Users\Admin\AppData\Local\6a705ff963b832d927acbcde07d8ffcc\Admin@NYBYVYTJ_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\6a705ff963b832d927acbcde07d8ffcc\Admin@NYBYVYTJ_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
File created C:\Users\Admin\AppData\Local\6a705ff963b832d927acbcde07d8ffcc\Admin@NYBYVYTJ_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\6a705ff963b832d927acbcde07d8ffcc\Admin@NYBYVYTJ_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Looks up geolocation information via web service

Enumerates physical storage devices

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2404 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2404 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2404 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2404 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Users\Admin\AppData\Local\Temp\deneme.exe
PID 2404 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Users\Admin\AppData\Local\Temp\deneme.exe
PID 2404 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Users\Admin\AppData\Local\Temp\deneme.exe
PID 2404 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Users\Admin\AppData\Local\Temp\deneme.exe
PID 2404 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Users\Admin\AppData\Local\Temp\ngrok.exe
PID 2404 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Users\Admin\AppData\Local\Temp\ngrok.exe
PID 2404 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe C:\Users\Admin\AppData\Local\Temp\ngrok.exe
PID 2708 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe C:\Windows\SysWOW64\cmd.exe
PID 896 wrote to memory of 2924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 896 wrote to memory of 2924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 896 wrote to memory of 2924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 896 wrote to memory of 2924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 896 wrote to memory of 2948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 896 wrote to memory of 2948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 896 wrote to memory of 2948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 896 wrote to memory of 2948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 896 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 896 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 896 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 896 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2708 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\deneme.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2964 wrote to memory of 2932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2964 wrote to memory of 2932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2964 wrote to memory of 2932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2964 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2964 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2964 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2964 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe

"C:\Users\Admin\AppData\Local\Temp\69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827_JC.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAYgBmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAdQBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAbgBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBhACMAPgA="

C:\Users\Admin\AppData\Local\Temp\deneme.exe

"C:\Users\Admin\AppData\Local\Temp\deneme.exe"

C:\Users\Admin\AppData\Local\Temp\ngrok.exe

"C:\Users\Admin\AppData\Local\Temp\ngrok.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

Network

Country Destination Domain Proto
US 8.8.8.8:53 icanhazip.com udp
US 104.18.115.97:80 icanhazip.com tcp
US 8.8.8.8:53 api.mylnikov.org udp
US 172.67.196.114:443 api.mylnikov.org tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 88.221.25.169:80 apps.identrust.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp

Files

memory/2404-54-0x000007FEF5A50000-0x000007FEF643C000-memory.dmp

memory/2404-55-0x00000000008C0000-0x00000000020BC000-memory.dmp

memory/2404-56-0x000000001C820000-0x000000001C8A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\deneme.exe

MD5 958062458cd994df325348bb9f8f9d11
SHA1 6d678d971f4239f9304a3a6ac9941b9d7de1ba27
SHA256 109f96c67f55689c41320f832134501ec02389a813eba1d990d192ab378ad533
SHA512 e73c665f0cd3cc53ea4ca0ef50d196fce4783488759bd9f6b8d9cb842382e88327509a317dd328ddf7b7fc988cde06a46cd82fe2783165f75d5f812e231affff

C:\Users\Admin\AppData\Local\Temp\deneme.exe

MD5 958062458cd994df325348bb9f8f9d11
SHA1 6d678d971f4239f9304a3a6ac9941b9d7de1ba27
SHA256 109f96c67f55689c41320f832134501ec02389a813eba1d990d192ab378ad533
SHA512 e73c665f0cd3cc53ea4ca0ef50d196fce4783488759bd9f6b8d9cb842382e88327509a317dd328ddf7b7fc988cde06a46cd82fe2783165f75d5f812e231affff

memory/2588-67-0x000000001B1F0000-0x000000001B4D2000-memory.dmp

memory/2588-68-0x0000000002270000-0x0000000002278000-memory.dmp

\Users\Admin\AppData\Local\Temp\ngrok.exe

MD5 1c900bf7791f168639d27e19a90a9be7
SHA1 ff6b857b8aaf8d9ed72ae300575aeb4ff21925db
SHA256 b25a372ebb6692fbc2d3697467a7611dbbd521dd61ed995fa82c170c3ef50300
SHA512 c0a96693031c56b4375478e7c15f41ef512b7eec72496e26dcb5dc688b13431852e2c30f98ef25a2d06df421e8c688b17fa603887ef3ae6980c6ee3789fe2988

C:\Users\Admin\AppData\Local\Temp\ngrok.exe

MD5 1c900bf7791f168639d27e19a90a9be7
SHA1 ff6b857b8aaf8d9ed72ae300575aeb4ff21925db
SHA256 b25a372ebb6692fbc2d3697467a7611dbbd521dd61ed995fa82c170c3ef50300
SHA512 c0a96693031c56b4375478e7c15f41ef512b7eec72496e26dcb5dc688b13431852e2c30f98ef25a2d06df421e8c688b17fa603887ef3ae6980c6ee3789fe2988

memory/2404-77-0x000007FEF5A50000-0x000007FEF643C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ngrok.exe

MD5 1c900bf7791f168639d27e19a90a9be7
SHA1 ff6b857b8aaf8d9ed72ae300575aeb4ff21925db
SHA256 b25a372ebb6692fbc2d3697467a7611dbbd521dd61ed995fa82c170c3ef50300
SHA512 c0a96693031c56b4375478e7c15f41ef512b7eec72496e26dcb5dc688b13431852e2c30f98ef25a2d06df421e8c688b17fa603887ef3ae6980c6ee3789fe2988

memory/2588-78-0x000007FEF2360000-0x000007FEF2CFD000-memory.dmp

\Users\Admin\AppData\Local\Temp\ngrok.exe

MD5 1c900bf7791f168639d27e19a90a9be7
SHA1 ff6b857b8aaf8d9ed72ae300575aeb4ff21925db
SHA256 b25a372ebb6692fbc2d3697467a7611dbbd521dd61ed995fa82c170c3ef50300
SHA512 c0a96693031c56b4375478e7c15f41ef512b7eec72496e26dcb5dc688b13431852e2c30f98ef25a2d06df421e8c688b17fa603887ef3ae6980c6ee3789fe2988

\Users\Admin\AppData\Local\Temp\ngrok.exe

MD5 1c900bf7791f168639d27e19a90a9be7
SHA1 ff6b857b8aaf8d9ed72ae300575aeb4ff21925db
SHA256 b25a372ebb6692fbc2d3697467a7611dbbd521dd61ed995fa82c170c3ef50300
SHA512 c0a96693031c56b4375478e7c15f41ef512b7eec72496e26dcb5dc688b13431852e2c30f98ef25a2d06df421e8c688b17fa603887ef3ae6980c6ee3789fe2988

memory/2588-80-0x0000000002820000-0x00000000028A0000-memory.dmp

memory/2588-81-0x000007FEF2360000-0x000007FEF2CFD000-memory.dmp

memory/2588-82-0x0000000002820000-0x00000000028A0000-memory.dmp

memory/2588-83-0x0000000002820000-0x00000000028A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ngrok.exe

MD5 1c900bf7791f168639d27e19a90a9be7
SHA1 ff6b857b8aaf8d9ed72ae300575aeb4ff21925db
SHA256 b25a372ebb6692fbc2d3697467a7611dbbd521dd61ed995fa82c170c3ef50300
SHA512 c0a96693031c56b4375478e7c15f41ef512b7eec72496e26dcb5dc688b13431852e2c30f98ef25a2d06df421e8c688b17fa603887ef3ae6980c6ee3789fe2988

memory/2708-85-0x0000000000350000-0x0000000000380000-memory.dmp

memory/2588-86-0x000007FEF2360000-0x000007FEF2CFD000-memory.dmp

memory/2708-87-0x0000000074800000-0x0000000074EEE000-memory.dmp

memory/2708-88-0x0000000004210000-0x0000000004250000-memory.dmp

memory/2708-89-0x0000000074800000-0x0000000074EEE000-memory.dmp

memory/2708-111-0x0000000004210000-0x0000000004250000-memory.dmp

memory/2708-159-0x0000000004210000-0x0000000004250000-memory.dmp

memory/2708-163-0x0000000004210000-0x0000000004250000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab9C0A.tmp

MD5 3ac860860707baaf32469fa7cc7c0192
SHA1 c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256 d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512 d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

C:\Users\Admin\AppData\Local\Temp\Tar9E6D.tmp

MD5 4ff65ad929cd9a367680e0e5b1c08166
SHA1 c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256 c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512 f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 110500207a3b309a629c75b6299132ea
SHA1 ac88649cfdac4e88ca7219c466654fb6276204fe
SHA256 6440dfe55c5e60c3c09923fb6734df1b68104ac03dc7a8d30324c88fce64f9ae
SHA512 e74cb4c63241a13abff1b2ce2dc5bfb5863cc3338872ee6e8faeb5e5551ca04df704d8f1ae94acf313c9e3279cc29c8a2ceb8254cf6d9c4e46c075cb6d399f92

C:\Users\Admin\AppData\Local\6a705ff963b832d927acbcde07d8ffcc\msgid.dat

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99