Malware Analysis Report

2025-01-02 13:51

Sample ID 240107-24wtxshbb8
Target 4a04227af22f5f354a820d9ffe8d6b4f
SHA256 10a56d918b0aa1dab628ff5df97e9bbaed282f01b7b6489fccebb682c503063c
Tags
cybergate remote persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

10a56d918b0aa1dab628ff5df97e9bbaed282f01b7b6489fccebb682c503063c

Threat Level: Known bad

The file 4a04227af22f5f354a820d9ffe8d6b4f was found to be: Known bad.

Malicious Activity Summary

cybergate remote persistence stealer trojan upx

CyberGate, Rebhip

Cybergate family

Adds policy Run key to start application

Modifies Installed Components in the registry

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

UPX packed file

Adds Run key to start application

Drops file in System32 directory

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-07 23:08

Signatures

Cybergate family

cybergate

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-07 23:08

Reported

2024-01-07 23:12

Platform

win10v2004-20231215-en

Max time kernel

178s

Max time network

189s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{4N6N13Q8-HH46-XB7S-7PJ7-OKEUPRM3YHIS} C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4N6N13Q8-HH46-XB7S-7PJ7-OKEUPRM3YHIS}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{4N6N13Q8-HH46-XB7S-7PJ7-OKEUPRM3YHIS} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4N6N13Q8-HH46-XB7S-7PJ7-OKEUPRM3YHIS}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\Svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\WinDir\Svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windowsupdate = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Project = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
File created C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WinDir\Svchost.exe

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 4988 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe

"C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe

"C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe"

C:\Windows\SysWOW64\WinDir\Svchost.exe

"C:\Windows\system32\WinDir\Svchost.exe"

C:\Windows\SysWOW64\WinDir\Svchost.exe

"C:\Windows\system32\WinDir\Svchost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3496 -ip 3496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 560

Network

Country Destination Domain Proto
US 8.8.8.8:53 83.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/4988-3-0x0000000010410000-0x0000000010475000-memory.dmp

memory/3532-7-0x0000000000B20000-0x0000000000B21000-memory.dmp

memory/3532-8-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

memory/4988-13-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4988-64-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/3532-67-0x00000000036D0000-0x00000000036D1000-memory.dmp

memory/3532-69-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Windows\SysWOW64\WinDir\Svchost.exe

MD5 4a04227af22f5f354a820d9ffe8d6b4f
SHA1 58ea3ed585ad4bb09d14337f9ad470f4fecf3c9f
SHA256 10a56d918b0aa1dab628ff5df97e9bbaed282f01b7b6489fccebb682c503063c
SHA512 60ab16360bb0e8aead489b0b8d347448b2867151490dc782c794a670378bb2c8d95c57c5232dd4314f174cdc72513df521cbce5e0dc377b81c9d661e3e063c7e

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 5b5124fcd875a4481cf3d5417f004f8d
SHA1 dd13d1438fa7e2fdd74793c8ade2e16c0b309321
SHA256 4e6c0f2e9f2e78e71d2400a235558d4b70ddc8d8b64a95d8e970038ab4afdd01
SHA512 385423fa6dec35f1dabea46a76a6a3809093e980d1c769857cdca918b1d9826b5a68f281c0e48c095a63d230ef1b25dff33cf212317f8e71d149ee11f2718651

memory/372-139-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/3532-161-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5ae7cfc77d327fb6fb8a9baf971f4382
SHA1 4934adab6a3951874de69419fb5f3006643bd6d4
SHA256 2b8be36357db670fec0a5e954caf8fadfcbf65c06842d252647daf0f7af55826
SHA512 7a5888d89a36ab8043ba9270a183ed7fbac7afc311fb54ffe7b49ad31c6966c4b042c2e7451d162dc4220e677878cba79b402ed50641a85ac224e588b6cde458

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 44beb4dd4a911947cf1bbc097213dffc
SHA1 0f777818f676f346c5e9f8509e498a3afcfbdfea
SHA256 db8a05b9613c958127921a29df63ae4b0217b8757940836ab0f1a0a0ea7e6b75
SHA512 f1095ab6dbd50c4fb8f2f81c3c7aac0fd3583c3164419ccee4ab43e3617791831c8d66c81607e3cb683cbfa3931f75a0c7cbdcd6736e6a23f01ca4b1472c1b2c

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f3fdd92f5ae5017b92a07379aad865de
SHA1 3053c2938cdd819a0e24b2a1b91006685a733385
SHA256 2e4d0ae0e90ded269fd08919bfcd2d4c828cbfacb06b9625a106c3a70baee292
SHA512 35653b8629112babfdf248da05e0f1885eeab79126901429823e38077df9b15e6eb0c82389e1a138f9e514d6eba5a717ef4e5a9bf0d0ef026b04d7417bb8ff27

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 383fe9fc9f8cd01df4939c14e6b57ec7
SHA1 164568d48a48e10007ce90a68910dc4a7c3684e3
SHA256 dfca232f8aac961d4ac1e0a4866e626418a2ca616c25928ddd863b3169b2ecd8
SHA512 4a646bee666e45b5e54747ed911a0a318cf70e9599ae8d6eba4c6719d8d742577f340eda02ba9a886b0d30eff439baa7d5b72ffc1a5fcb932214139f0d05b3fa

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 9f448c0aa78b209c0b1b87ad9db92be0
SHA1 8183e390c79c2e392e350bbc0d89d9e2b28ec478
SHA256 4127d1ecdc40fe87a5766dd0c59f529ff91472b04348f105b476f0d86d310bea
SHA512 7a016ca7afd0271bcc7894d7273e0dbc9edf9b6ffe31af40306f41587431a4f7937da9d818974a5211047ef4a915a51866d2e5e42f8c1f86462c1af7cadd3a3b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2a1ff0b2be3f17d54f370c18975ae584
SHA1 b9f26e79e7eb19ab4ae0feec73e62eb4f484cd90
SHA256 c7ec941bdddcb7787d520a005547a82c04335a703c70b3a95395f280851a9bbf
SHA512 3c2d74506eb2a4edc72df1de2896ca82e51d5a095b1cc6a1cb3cdd5d6430cd23f961f9bb53b85eda5827b6d3204e243e4581f3443cfa5e8fe83a7a72c35a958b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0468e9dc076800bc78c555d641c24d61
SHA1 7d2151ecedb39cfdab2610a735560ad8615ac820
SHA256 9bbdaa3e9b298ae16191423a902a4a4f2e6c0d4583886dfc5c65786e1a00df65
SHA512 fcae22af64d05b38b4bf53d6e70b28212d309ff7042419ebf0696eb4f2795b843325885e81b29f633dc6f635f469d48d74f4c464c07ccb6918c504047a8a1dd8

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 42a057a7869fa4f0c6cc7b049422adf6
SHA1 f74577cc2073e3d22cbf7d53219b1a248d29f7bc
SHA256 523c5d4ea8a9763146867ee34709824d893eb7af0fae0cf301f0bc0f1a90bb5c
SHA512 c6ec372f5295f466fa577ffcb44468dbf810fbbaa87736da2d0bedd042bc4df87b8960b5e2a8b409794f8933c6f618f26371be9b30da373bbe3099f25a72cf1f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 519afdaccd7e177417a3323b99a4390b
SHA1 5cc5be1b564fed1f1d8aa5f656b4dfd8e3726c67
SHA256 fddda591e25eae8107240595b8dde990eb98ad2f5c580c88f34214d792b2177a
SHA512 4a396e4b474e9a9d18abd64f8e014fb7faa97ba1ca30f461e50e16563918359f4499a3529b4a99fdb83cd696b8f29df65d877562f2c03c3660b640a44fdcf2d3

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 48527ba73ad1b53ce1b2fcb46fca625c
SHA1 55315a68b16af80e6bee32251c9d751a14103118
SHA256 9932ca05a43caf03e12d41a032168e46c067e0cfa03baccc91586321ecbcbad4
SHA512 307e83ad964e77fbbe4b1fc0e985124d4bfffadc5abb13aed0dd211641cb0768d014a4245adb3e888089417cef53c38efdf80faf3c2f99fdba7159006c3a46f6

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6abdd6e62ee675728eb7ae7a3e3a2a89
SHA1 0ed3bde2c277266142533ae08bf1e84596e94df4
SHA256 cc69421c2df86eb7a56d7133f408570be7230fddf521f28b16cd668127cc7bfe
SHA512 d17584c0a538b430df573ae0896573a56ec21b60a311c564f12730b5200499089d87b13c8152e6d791d1b899f5fa144f68b25e268eb372e6f02d36de4725cf85

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5b6628c71d30692bc95053644ab326e2
SHA1 c50724b57a7beca8133a80f5c0fa24b3426b8a02
SHA256 9f73cc21c53708771831f4c7f0c681f2ed4ae01bfbfadf33d748829cc064f156
SHA512 35908f049c9eb424ead068bb83a1607d25ebc67faedaa6724d666ba85f50ae7c3d05d9a7eff280b169cdab3d0e3cd460054bb39e5d7e161e1d92d19cc32f9227

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 26a79912efc79aba79635727ba9cb7f5
SHA1 3c530c96420b65675feef09ee3e4c613d1161102
SHA256 c0de02ff5fd1a68f8c966942674ddbd43dd157ea3a871c55376d4221ec35e703
SHA512 92dd6af094cd6b3637af3790132b551a19d2667a3fe190f12267a3f024a4b9ecb2efd021c8d64cea98e03d98c992be49fec5b467de5c677802f2c942f03f28e8

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c4441dcb08263f49dfc9342979578e83
SHA1 431c4e89917ace24f120e9e63f4bec59a3469c4c
SHA256 7dd2ce68c0e825ed24ce26e039ec8678af7af383bde44b0abd39b0d2f2efcd49
SHA512 2297198c1e7dcb2040a4e7e5cbb1aa5053218cd39de8ade9f64fe5afc19d03225252edceb440e834360133f9b38cf3b274338f3813880a9bb2306292890815a5

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 98b6062e44dc25657f038f5e95e56af8
SHA1 93b6e7c7d54caf48d08e28c4a6d528d367f9340b
SHA256 5c20a52464351dbacadf6c04c58d919a001d781fd60f5eed6359d5c76e97de73
SHA512 32471fb3edc0f28d54e6a30bd80d8bd5a54baa7afffc3cc70673ccb54b267c4c16afc2796d03749b18113923940692dd1b342252f57ccf2758e80b878ab24731

memory/372-1487-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f533603b1a6dfbcfba771a8d8ee48422
SHA1 f03036f78c6ebaa832c0fa56ad473f41530cb086
SHA256 07f8ae2147b240643f25de6aeb8823040290be00a30deab487d5817c03c85618
SHA512 9be8a75816bbc823a26944b56b72689dfdcebace1017769a87dee86915c7073b702101f73faec6f4eb93b10db6d61aec8a8fccd19032354502a83cf8ce8034a9

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3df1f3b7e10025e67a181a2a4cf2dac9
SHA1 967eceed43149e6b0c391b8cd4b5b3505072097f
SHA256 b77ce8b9c5d660dcc2699806e50425c708d0824e11004dc7ad156d59d06f6cc8
SHA512 d9da8b1596e6bfd729f0ab63545107f9a13167985c5bc9d7757440dd6e543a26baea2080b936ee1d40ae315f599c3c74a0e100266a8c02951077410c9a86bb17

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2c090d084dda0927a2eca791ae2ee3ef
SHA1 78a771f34a063e1f7234b92b206dc48e6e44a8f3
SHA256 9d1f42e79128818d447f027720b345fc9e2332a2eb1f108491e45c1d816ed487
SHA512 d09efc960c7ddd3a480cf0a560b8681340d0575a0aef79e3a732ad8b6088eec11c9311cfa02243623b65d256a294c013388b46a3937bcbcc6d0cd8d528f57005

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c7fbc4e20f38e134ae64754b873d66fa
SHA1 208c6651d815c91547cf744e8bf474ef8904c86d
SHA256 fc02978a51b00f88c63557c320495d0d99f97a900253fd10133a9e67109adaa9
SHA512 7decc6452f601e9a9b216cafdb5f1b8fb6db48e19acb9936b42fa7730170a2ab4f107b4960f9f7d30710853a7af3aa72adbbc0366da06acb2381a02fda81ee91

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3336021d5000449b715907fd074e6105
SHA1 bb6927836c884e6785a18206d5e4a3a6875c3d11
SHA256 72bc94917aab3fb8b51b5a0e5c07d6f3cc4211613563c4f1081326732bcf404e
SHA512 82fafafcd4aea212e0976d221bb970f321585c1e07a29000b56c5f511517c22b42238369288f4c349c7f41112e0165c1e3f930ca1c53dc908fc24b4f2036dfdf

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-07 23:08

Reported

2024-01-07 23:11

Platform

win7-20231215-en

Max time kernel

138s

Max time network

147s

Command Line

C:\Windows\Explorer.EXE

Signatures

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4N6N13Q8-HH46-XB7S-7PJ7-OKEUPRM3YHIS} C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4N6N13Q8-HH46-XB7S-7PJ7-OKEUPRM3YHIS}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4N6N13Q8-HH46-XB7S-7PJ7-OKEUPRM3YHIS} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4N6N13Q8-HH46-XB7S-7PJ7-OKEUPRM3YHIS}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\Svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windowsupdate = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\Project = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE
PID 2204 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe

"C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe

"C:\Users\Admin\AppData\Local\Temp\4a04227af22f5f354a820d9ffe8d6b4f.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\SysWOW64\WinDir\Svchost.exe

"C:\Windows\system32\WinDir\Svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/1252-3-0x0000000002D60000-0x0000000002D61000-memory.dmp

memory/2996-248-0x00000000000A0000-0x00000000000A1000-memory.dmp

memory/2996-251-0x00000000000C0000-0x00000000000C1000-memory.dmp

memory/2996-530-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/2920-830-0x0000000010560000-0x00000000105C5000-memory.dmp

memory/2996-852-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/2920-2093-0x0000000010560000-0x00000000105C5000-memory.dmp