Malware Analysis Report

2025-06-16 01:06

Sample ID 231226-1bgzmachd5
Target 8ffb95d5e237a22a2773b17e34a4c6b0
SHA256 31eb4492dbdb099fae987f89fdb66fcd2a79367d6112a7f4a3ae47fdfa9e62d5
Tags
xtremerat persistence rat spyware upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

31eb4492dbdb099fae987f89fdb66fcd2a79367d6112a7f4a3ae47fdfa9e62d5

Threat Level: Known bad

The file 8ffb95d5e237a22a2773b17e34a4c6b0 was found to be: Known bad.

Malicious Activity Summary

xtremerat persistence rat spyware upx

Detect XtremeRAT payload

XtremeRAT

Modifies Installed Components in the registry

Loads dropped DLL

Executes dropped EXE

UPX packed file

Drops desktop.ini file(s)

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-26 21:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-26 21:28

Reported

2024-01-07 05:15

Platform

win7-20231215-en

Max time kernel

147s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe"

Signatures

Detect XtremeRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XtremeRAT

persistence spyware rat xtremerat

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{PF38VKJN-7V8U-658N-NM1O-1B1M1TAV43R7} C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{PF38VKJN-7V8U-658N-NM1O-1B1M1TAV43R7}\StubPath = "C:\\Windows\\InstallDir\\skypa.exe restart" C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{PF38VKJN-7V8U-658N-NM1O-1B1M1TAV43R7} C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{PF38VKJN-7V8U-658N-NM1O-1B1M1TAV43R7}\StubPath = "C:\\Windows\\InstallDir\\skypa.exe restart" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{PF38VKJN-7V8U-658N-NM1O-1B1M1TAV43R7} C:\Windows\InstallDir\skypa.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{PF38VKJN-7V8U-658N-NM1O-1B1M1TAV43R7}\StubPath = "C:\\Windows\\InstallDir\\skypa.exe restart" C:\Windows\InstallDir\skypa.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{PF38VKJN-7V8U-658N-NM1O-1B1M1TAV43R7} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{PF38VKJN-7V8U-658N-NM1O-1B1M1TAV43R7}\StubPath = "C:\\Windows\\InstallDir\\skypa.exe restart" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\InstallDir\skypa.exe N/A
N/A N/A C:\Windows\InstallDir\skypa.exe N/A
N/A N/A C:\Windows\InstallDir\skypa.exe N/A
N/A N/A C:\Windows\InstallDir\skypa.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVG = "C:\\Windows\\InstallDir\\skypa.exe" C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVG = "C:\\Windows\\InstallDir\\skypa.exe" C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVG = "C:\\Windows\\InstallDir\\skypa.exe" C:\Windows\InstallDir\skypa.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVG = "C:\\Windows\\InstallDir\\skypa.exe" C:\Windows\InstallDir\skypa.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVG = "C:\\Windows\\InstallDir\\skypa.exe" C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVG = "C:\\Windows\\InstallDir\\skypa.exe" C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVG = "C:\\Windows\\InstallDir\\skypa.exe" C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVG = "C:\\Windows\\InstallDir\\skypa.exe" C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Windows\SysWOW64\explorer.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\InstallDir\ C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe N/A
File opened for modification C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe N/A
File opened for modification C:\Windows\InstallDir\ C:\Windows\InstallDir\skypa.exe N/A
File opened for modification C:\Windows\InstallDir\skypa.exe C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe N/A
File created C:\Windows\InstallDir\skypa.exe C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3068 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe
PID 3068 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe
PID 3068 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe
PID 3068 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe
PID 3068 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe
PID 3068 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe
PID 3068 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe
PID 3068 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe
PID 3068 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe
PID 3068 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe
PID 3068 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe
PID 3068 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe
PID 2004 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Windows\SysWOW64\svchost.exe
PID 2004 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Windows\SysWOW64\svchost.exe
PID 2004 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Windows\SysWOW64\svchost.exe
PID 2004 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Windows\SysWOW64\svchost.exe
PID 2004 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Windows\SysWOW64\svchost.exe
PID 2004 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Windows\SysWOW64\explorer.exe
PID 2004 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Windows\SysWOW64\explorer.exe
PID 2004 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Windows\SysWOW64\explorer.exe
PID 2004 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Windows\SysWOW64\explorer.exe
PID 2004 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe C:\Windows\SysWOW64\explorer.exe
PID 2856 wrote to memory of 2640 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\InstallDir\skypa.exe
PID 2856 wrote to memory of 2640 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\InstallDir\skypa.exe
PID 2856 wrote to memory of 2640 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\InstallDir\skypa.exe
PID 2856 wrote to memory of 2640 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\InstallDir\skypa.exe
PID 2672 wrote to memory of 1968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\InstallDir\skypa.exe
PID 2672 wrote to memory of 1968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\InstallDir\skypa.exe
PID 2672 wrote to memory of 1968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\InstallDir\skypa.exe
PID 2672 wrote to memory of 1968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\InstallDir\skypa.exe
PID 2640 wrote to memory of 2860 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 2640 wrote to memory of 2860 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 2640 wrote to memory of 2860 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 2640 wrote to memory of 2860 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 2640 wrote to memory of 2860 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 2640 wrote to memory of 2860 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 2640 wrote to memory of 2860 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 2640 wrote to memory of 2860 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 2640 wrote to memory of 2860 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 2640 wrote to memory of 2860 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 2640 wrote to memory of 2860 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 2640 wrote to memory of 2860 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 2860 wrote to memory of 544 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\SysWOW64\explorer.exe
PID 2860 wrote to memory of 544 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\SysWOW64\explorer.exe
PID 2860 wrote to memory of 544 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\SysWOW64\explorer.exe
PID 2860 wrote to memory of 544 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\SysWOW64\explorer.exe
PID 2860 wrote to memory of 544 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\SysWOW64\explorer.exe
PID 2860 wrote to memory of 544 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\SysWOW64\explorer.exe
PID 2860 wrote to memory of 544 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\SysWOW64\explorer.exe
PID 2860 wrote to memory of 544 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\SysWOW64\explorer.exe
PID 1968 wrote to memory of 1684 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 1968 wrote to memory of 1684 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 1968 wrote to memory of 1684 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 1968 wrote to memory of 1684 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 1968 wrote to memory of 1684 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 1968 wrote to memory of 1684 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 1968 wrote to memory of 1684 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 1968 wrote to memory of 1684 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 1968 wrote to memory of 1684 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 1968 wrote to memory of 1684 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 1968 wrote to memory of 1684 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe
PID 1968 wrote to memory of 1684 N/A C:\Windows\InstallDir\skypa.exe C:\Windows\InstallDir\skypa.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe

"C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe"

C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe

C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\InstallDir\skypa.exe

"C:\Windows\InstallDir\skypa.exe"

C:\Windows\InstallDir\skypa.exe

"C:\Windows\InstallDir\skypa.exe"

C:\Windows\InstallDir\skypa.exe

C:\Windows\InstallDir\skypa.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\InstallDir\skypa.exe

C:\Windows\InstallDir\skypa.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 sweetma198.no-ip.info udp

Files

memory/2004-2-0x0000000000C80000-0x0000000000CE9000-memory.dmp

memory/2004-1-0x0000000000C80000-0x0000000000CE9000-memory.dmp

memory/2004-0-0x0000000000C80000-0x0000000000CE9000-memory.dmp

memory/2004-4-0x0000000000C80000-0x0000000000CE9000-memory.dmp

memory/2004-7-0x0000000000C80000-0x0000000000CE9000-memory.dmp

memory/2004-10-0x0000000000C80000-0x0000000000CE9000-memory.dmp

memory/2004-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2004-18-0x0000000000C80000-0x0000000000CE9000-memory.dmp

memory/3068-19-0x0000000023240000-0x000000002326A000-memory.dmp

memory/2004-14-0x0000000000C80000-0x0000000000CE9000-memory.dmp

memory/2004-12-0x0000000000C80000-0x0000000000CE9000-memory.dmp

C:\Windows\InstallDir\skypa.exe

MD5 391211f48801d386ad55f2327543c4c0
SHA1 5d77cd181341594311ce384b451ab9bdf4bb607b
SHA256 53fbae69f1cda07a6cc91fe4833c6f2a73178bcd5da3216514fc854c0ca5c2ef
SHA512 b2dd1358f353192aab5a5aa2bbc762f1f28a1aacca21543a9a2c44d887bfcf8de36d5a524bd3b4f05a758ea12ec70784087fbb063d1d782410b5fe73169dbe89

memory/2672-28-0x0000000000C80000-0x0000000000CE9000-memory.dmp

memory/2856-32-0x0000000000C80000-0x0000000000CE9000-memory.dmp

memory/2856-40-0x0000000000C80000-0x0000000000CE9000-memory.dmp

memory/2856-34-0x0000000000C80000-0x0000000000CE9000-memory.dmp

\Windows\InstallDir\skypa.exe

MD5 8ffb95d5e237a22a2773b17e34a4c6b0
SHA1 7e74c23a6d66fc6ad4d6a5397642476af48735ad
SHA256 31eb4492dbdb099fae987f89fdb66fcd2a79367d6112a7f4a3ae47fdfa9e62d5
SHA512 e8a3c594e6d0009ad6cfe1f7d3341dcadac3fb536c001e0490c6b5f702abf904a30efc3964f797894c1aabbe03eb310d79ebf3e436b2a80c51dcc29de7f2aca8

memory/2856-46-0x0000000000C80000-0x0000000000CE9000-memory.dmp

C:\Windows\InstallDir\skypa.exe

MD5 77602e679bc6f083bc49aae4f658adb5
SHA1 21cf0e86ad3febf0da71444bb879399e0754032f
SHA256 4c35b58be0d9a61037790b82b7b9d5b08bf695af7e3a0c75ea2a3e5efb1cd359
SHA512 ee5b8a18f03673a53023a2f2d2d6178457c4111ab7a154e4fab6bdef23d1be2599a79271da5c7523f7ade151077eb86c070bb0f41d7a3f2cf42f6f4f025f31fa

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\Windows\InstallDir\skypa.exe

MD5 1ad8c36c519b748fbe1aa79b574573fa
SHA1 d783363eeb161fbd096b5657c2a27480b3e1f79a
SHA256 44ca58e48755b2148b09dce0fcc79a4a87495110cb3c9a4b9fbfb1530c29ceaf
SHA512 8bc7fa99e860b07e478f4d1357c98f484ad649a2e2223deabfffe62350f68d0948669fdd503257bb891aa2c32b1d7d7c44fe6dfd4402e71ca3331b47d4b1b684

C:\Windows\InstallDir\skypa.exe

MD5 37ae693d4a9a755b9c620bf5473bd3d1
SHA1 54af2c11b8aae8d6cfe855b250f53a5051728215
SHA256 bbb5b65c4320858bbc4016265cfc49baf1bcff7b9495e4ec29c5576f5f638421
SHA512 96c6eb3dad16b5c7e6e4300983501e390d38415b50515e6412c70b6af7046933aaa7b15edf12676f5ea530273bd83d5e3ed37ed926382f51c682e4570324607d

memory/2640-51-0x0000000023240000-0x000000002326A000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\a24hcUtl1.cfg

MD5 3c4d3cd283491acb2b8be880e6515e34
SHA1 24a402254b7b16a007a334655e811fee25bfac61
SHA256 077c026e8eaa149a9a0b3b2f361f1d5d90852bd082d40d5366f70a3b783100e5
SHA512 ec420ca447b53ec38b1ac879d8e03ad7f89babf8ce0f81d91d0befae0402f594e6a7f229763d6a3a1483a4d8658cdd5e581a7bf35d496c98402460d608a970c1

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\a24hcUtl1.xtr

MD5 6426d400c96fb9ffef4eaa54f6647f4c
SHA1 70a37871aff432790b6adf7d3fc4eb929476e082
SHA256 98bba0cf4c57ecd35b227f45e4aa6dd50ef7cfb1160235cc14687c96eb09fa3c
SHA512 2c8b4d3ab066cbfca6cf0c8d89d5044152b5e3d7100249cbedd1c816e3a4a94efc8bc6b79c1dab4bdf96e3ce476d6caccf625cfbe0aff3bf5e7a29dfcfa948c5

memory/544-76-0x0000000001610000-0x0000000001712000-memory.dmp

memory/544-77-0x0000000001610000-0x0000000001712000-memory.dmp

memory/544-79-0x0000000001610000-0x0000000001712000-memory.dmp

memory/544-81-0x0000000001610000-0x0000000001712000-memory.dmp

memory/544-82-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/544-85-0x0000000001610000-0x0000000001712000-memory.dmp

memory/544-87-0x0000000001610000-0x0000000001712000-memory.dmp

memory/544-86-0x0000000001610000-0x0000000001712000-memory.dmp

memory/544-88-0x0000000000130000-0x0000000000131000-memory.dmp

memory/544-89-0x0000000001610000-0x0000000001712000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\a24hcUtl1.dat

MD5 84cad01fdb44ae58dbe6c3973dcd87f5
SHA1 4700b42849fb35be323774820bf1bc8019d26c80
SHA256 8b1f194be530240c18bf0b1ee0d038e750fab8b24c6bd25c864297e5ebb41fa6
SHA512 6e10d3ec4724c1aca9ff3f6a26292ba80065d18e8e9395f1474c0a298008f25e312e2f7024e7d10aab3264764e69a25553cc20afd23090f83921d20e42b989ab

memory/544-90-0x0000000001610000-0x0000000001712000-memory.dmp

memory/544-121-0x0000000000130000-0x0000000000131000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-26 21:28

Reported

2024-01-07 05:14

Platform

win10v2004-20231215-en

Max time network

7s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 148.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
NL 52.142.223.178:80 tcp

Files

N/A