Malware Analysis Report

2025-01-03 06:30

Sample ID 230901-wk75ysgg64
Target instagram 0day.exe
SHA256 163b9785fdeb5b8e317e5d651e2e3bccf244f864921574dc4c73281389cbce82
Tags
asyncrat stormkitty default rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

163b9785fdeb5b8e317e5d651e2e3bccf244f864921574dc4c73281389cbce82

Threat Level: Known bad

The file instagram 0day.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat stormkitty default rat spyware stealer

Asyncrat family

Async RAT payload

AsyncRat

Stormkitty family

StormKitty

StormKitty payload

Async RAT payload

Reads user/profile data of web browsers

Looks up geolocation information via web service

Drops desktop.ini file(s)

Looks up external IP address via web service

Unsigned PE

Modifies system certificate store

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-09-01 17:59

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Stormkitty family

stormkitty

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-09-01 17:59

Reported

2023-09-01 18:00

Platform

win10v2004-20230831-en

Max time kernel

34s

Max time network

37s

Command Line

"C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe"

Signatures

AsyncRat

rat asyncrat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\9f5fe481cdc5273791d9990601bca11c\Admin@NVYNMMTR_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
File created C:\Users\Admin\AppData\Local\9f5fe481cdc5273791d9990601bca11c\Admin@NVYNMMTR_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
File created C:\Users\Admin\AppData\Local\9f5fe481cdc5273791d9990601bca11c\Admin@NVYNMMTR_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\9f5fe481cdc5273791d9990601bca11c\Admin@NVYNMMTR_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\9f5fe481cdc5273791d9990601bca11c\Admin@NVYNMMTR_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
File created C:\Users\Admin\AppData\Local\9f5fe481cdc5273791d9990601bca11c\Admin@NVYNMMTR_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
File created C:\Users\Admin\AppData\Local\9f5fe481cdc5273791d9990601bca11c\Admin@NVYNMMTR_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
File created C:\Users\Admin\AppData\Local\9f5fe481cdc5273791d9990601bca11c\Admin@NVYNMMTR_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Looks up geolocation information via web service

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4168 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe C:\Windows\SysWOW64\cmd.exe
PID 4168 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe C:\Windows\SysWOW64\cmd.exe
PID 4168 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe C:\Windows\SysWOW64\cmd.exe
PID 1476 wrote to memory of 3960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1476 wrote to memory of 3960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1476 wrote to memory of 3960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1476 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1476 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1476 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1476 wrote to memory of 4892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1476 wrote to memory of 4892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1476 wrote to memory of 4892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4168 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe C:\Windows\SysWOW64\cmd.exe
PID 4168 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe C:\Windows\SysWOW64\cmd.exe
PID 4168 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe C:\Windows\SysWOW64\cmd.exe
PID 4416 wrote to memory of 1676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4416 wrote to memory of 1676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4416 wrote to memory of 1676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4416 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 4416 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 4416 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe

"C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

Network

Country Destination Domain Proto
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 icanhazip.com udp
US 104.18.114.97:80 icanhazip.com tcp
US 8.8.8.8:53 api.mylnikov.org udp
US 104.21.44.66:443 api.mylnikov.org tcp
US 8.8.8.8:53 97.114.18.104.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 66.44.21.104.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 254.211.247.8.in-addr.arpa udp
N/A 127.0.0.1:7707 tcp

Files

memory/4168-0-0x00000000005C0000-0x00000000005F0000-memory.dmp

memory/4168-1-0x0000000074CA0000-0x0000000075450000-memory.dmp

memory/4168-2-0x0000000004F60000-0x0000000004F70000-memory.dmp

memory/4168-3-0x00000000050E0000-0x0000000005146000-memory.dmp

memory/4168-4-0x0000000074CA0000-0x0000000075450000-memory.dmp

C:\Users\Admin\AppData\Local\9f5fe481cdc5273791d9990601bca11c\Admin@NVYNMMTR_en-US\Browsers\Firefox\Bookmarks.txt

MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

memory/4168-72-0x0000000004F60000-0x0000000004F70000-memory.dmp

C:\Users\Admin\AppData\Local\9f5fe481cdc5273791d9990601bca11c\Admin@NVYNMMTR_en-US\System\Process.txt

MD5 95b5d51322c037b60b5f335d52cf2c48
SHA1 8e45858ed9b7961570a3d8dbb8a7e92efee3c89b
SHA256 af5abd1aa34714478b43e991755ac132ce7bd351889b848d7e16953c260d86f1
SHA512 8717bdde10affa1500c23a56656bcb615237f8d34be8f1f07356568331656d3157831818c0988e9a57e67ee5e1aff0a882b0baa671f197857a882835faf60ea1

memory/4168-148-0x0000000004F60000-0x0000000004F70000-memory.dmp

memory/4168-150-0x0000000005F00000-0x0000000005F92000-memory.dmp

memory/4168-151-0x0000000006550000-0x0000000006AF4000-memory.dmp

memory/4168-155-0x0000000006120000-0x000000000612A000-memory.dmp

C:\Users\Admin\AppData\Local\b39ec3fec1fe1e959fbf3186130860c9\msgid.dat

MD5 d41e2a728f38a9616dab93f5c99a3940
SHA1 a6ec8811406f50384cff7890f126a425ca465072
SHA256 3770cb5540de45f78a1e3c0e9191016382a719b71521140434f73cd3a5b6a0da
SHA512 9b82f10e787ec2b0e5b83adbdbe41d8e0036814153231cdf39704ba6011b2104d324387ce3791240ddb72f125f044517a4c7bd770bbefa35bfb8c96f3fa18340

memory/4168-161-0x00000000062C0000-0x00000000062D2000-memory.dmp

memory/4168-184-0x0000000004F60000-0x0000000004F70000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-01 17:59

Reported

2023-09-01 18:00

Platform

win7-20230831-en

Max time kernel

48s

Max time network

32s

Command Line

"C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe"

Signatures

AsyncRat

rat asyncrat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\a28d0a0c25d223ba676d1e3ef190b269\Admin@XEBBURHY_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
File created C:\Users\Admin\AppData\Local\a28d0a0c25d223ba676d1e3ef190b269\Admin@XEBBURHY_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\a28d0a0c25d223ba676d1e3ef190b269\Admin@XEBBURHY_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
File created C:\Users\Admin\AppData\Local\a28d0a0c25d223ba676d1e3ef190b269\Admin@XEBBURHY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\a28d0a0c25d223ba676d1e3ef190b269\Admin@XEBBURHY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
File created C:\Users\Admin\AppData\Local\a28d0a0c25d223ba676d1e3ef190b269\Admin@XEBBURHY_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
File created C:\Users\Admin\AppData\Local\a28d0a0c25d223ba676d1e3ef190b269\Admin@XEBBURHY_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Looks up geolocation information via web service

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3032 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe C:\Windows\SysWOW64\cmd.exe
PID 3032 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe C:\Windows\SysWOW64\cmd.exe
PID 3032 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe C:\Windows\SysWOW64\cmd.exe
PID 3032 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe C:\Windows\SysWOW64\cmd.exe
PID 1408 wrote to memory of 1004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1408 wrote to memory of 1004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1408 wrote to memory of 1004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1408 wrote to memory of 1004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1408 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1408 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1408 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1408 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1408 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1408 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1408 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1408 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3032 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe C:\Windows\SysWOW64\cmd.exe
PID 3032 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe C:\Windows\SysWOW64\cmd.exe
PID 3032 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe C:\Windows\SysWOW64\cmd.exe
PID 3032 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe C:\Windows\SysWOW64\cmd.exe
PID 1840 wrote to memory of 2892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1840 wrote to memory of 2892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1840 wrote to memory of 2892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1840 wrote to memory of 2892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1840 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1840 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1840 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1840 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe

"C:\Users\Admin\AppData\Local\Temp\instagram 0day.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

Network

Country Destination Domain Proto
US 8.8.8.8:53 icanhazip.com udp
US 104.18.114.97:80 icanhazip.com tcp
US 8.8.8.8:53 api.mylnikov.org udp
US 104.21.44.66:443 api.mylnikov.org tcp
US 8.8.8.8:53 apps.identrust.com udp
US 2.18.121.80:80 apps.identrust.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp

Files

memory/3032-0-0x00000000003D0000-0x0000000000400000-memory.dmp

memory/3032-1-0x00000000742E0000-0x00000000749CE000-memory.dmp

memory/3032-2-0x0000000004C50000-0x0000000004C90000-memory.dmp

memory/3032-69-0x00000000742E0000-0x00000000749CE000-memory.dmp

memory/3032-70-0x0000000004C50000-0x0000000004C90000-memory.dmp

memory/3032-72-0x0000000004C50000-0x0000000004C90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab7661.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\Tar7710.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 446c3b29406bb2330cabb28819949924
SHA1 6eee9b2877bdc659bb9c92a5d659625190f25278
SHA256 af533ac1b124949faa6471cf3bb7cffb9b781f128ece38c78ea3655a430aa227
SHA512 01df4391cbc50c058fd0622733e18b95b14f644914c52f2daa19734df128f10ed4ab0d39c4a0254add16e4950fc7068eade93c3032f9f7dfd4daed8c7ee41a59

C:\Users\Admin\AppData\Local\366f8d3f216cdf23eeb7dff0ec1079b0\msgid.dat

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

memory/3032-151-0x0000000004C50000-0x0000000004C90000-memory.dmp