Malware Analysis Report

2025-06-16 02:15

Sample ID 240123-n31jtsafd3
Target INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
SHA256 1714faef50d0127645ce3540480623cf619f9b10c0364c67ca22db0f604e2381
Tags
asyncrat default rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1714faef50d0127645ce3540480623cf619f9b10c0364c67ca22db0f604e2381

Threat Level: Known bad

The file INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat default rat

AsyncRat

Async RAT payload

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-23 11:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-23 11:56

Reported

2024-01-23 11:58

Platform

win10v2004-20231222-en

Max time kernel

107s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\vidextra.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\vidextra.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\vidextra.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1864 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 1864 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 1864 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 1864 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 1864 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 1864 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 1864 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 1864 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 2368 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Windows\SysWOW64\cmd.exe
PID 4652 wrote to memory of 2052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4652 wrote to memory of 2052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4652 wrote to memory of 2052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4252 wrote to memory of 4200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4252 wrote to memory of 4200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4252 wrote to memory of 4200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4652 wrote to memory of 452 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 4652 wrote to memory of 452 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 4652 wrote to memory of 452 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 452 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 452 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 452 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 452 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 452 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 452 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 452 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 452 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe

Processes

C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe

"C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe"

C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe

"C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "vidextra" /tr '"C:\Users\Admin\AppData\Roaming\vidextra.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC5C1.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "vidextra" /tr '"C:\Users\Admin\AppData\Roaming\vidextra.exe"'

C:\Users\Admin\AppData\Roaming\vidextra.exe

"C:\Users\Admin\AppData\Roaming\vidextra.exe"

C:\Users\Admin\AppData\Roaming\vidextra.exe

"C:\Users\Admin\AppData\Roaming\vidextra.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 149.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 182.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 72.11.158.94:8808 tcp
US 8.8.8.8:53 94.158.11.72.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 200.178.17.96.in-addr.arpa udp

Files

memory/1864-0-0x0000000000140000-0x00000000001CC000-memory.dmp

memory/1864-1-0x0000000075390000-0x0000000075B40000-memory.dmp

memory/1864-2-0x00000000051B0000-0x0000000005754000-memory.dmp

memory/1864-3-0x0000000004C00000-0x0000000004C92000-memory.dmp

memory/1864-4-0x0000000004B20000-0x0000000004B30000-memory.dmp

memory/1864-5-0x0000000004B90000-0x0000000004B9A000-memory.dmp

memory/1864-6-0x0000000005170000-0x0000000005188000-memory.dmp

memory/1864-7-0x0000000005190000-0x0000000005198000-memory.dmp

memory/1864-8-0x0000000005E80000-0x0000000005E8C000-memory.dmp

memory/1864-9-0x0000000006050000-0x000000000609C000-memory.dmp

memory/1864-10-0x0000000009E80000-0x0000000009F1C000-memory.dmp

memory/1864-11-0x0000000075390000-0x0000000075B40000-memory.dmp

memory/1864-12-0x0000000004B20000-0x0000000004B30000-memory.dmp

memory/2368-13-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe.log

MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

memory/2368-16-0x0000000075390000-0x0000000075B40000-memory.dmp

memory/1864-17-0x0000000075390000-0x0000000075B40000-memory.dmp

memory/2368-18-0x00000000058D0000-0x00000000058E0000-memory.dmp

memory/2368-22-0x0000000075390000-0x0000000075B40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpC5C1.tmp.bat

MD5 ade8be5fd04f6088d9e878ad1f15cc98
SHA1 7311dbcb2df8ac0f4cec901751eda910778ca867
SHA256 e0670d09545c7cb1e57c4dfa3f875375310c8bcd6fc405a08671d973bea23e27
SHA512 83a5903ab7d8e00a782c70e933dc85b37365ad021809180f5b9794eda64c09166dd0505b6190440d92fcf94178a1c2aac88aedc03deb4e0dbd92ee83a2d2c0ed

C:\Users\Admin\AppData\Roaming\vidextra.exe

MD5 0b97309812b9b2941e5512e12095960e
SHA1 8fc625372ccea9b23c3c3585e1a86a06479eb630
SHA256 1714faef50d0127645ce3540480623cf619f9b10c0364c67ca22db0f604e2381
SHA512 8f0568c9cea86cd33c089ec6f9f32581563d03edbc5ab9a82fd83b81c57ecd4556248a58d40dd315732187a213218a5a4e0af458aec0bde4a6b647b906dfa65b

memory/452-27-0x0000000075390000-0x0000000075B40000-memory.dmp

memory/452-28-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

memory/452-29-0x0000000075390000-0x0000000075B40000-memory.dmp

memory/452-30-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

memory/452-36-0x0000000075390000-0x0000000075B40000-memory.dmp

memory/1720-35-0x0000000075390000-0x0000000075B40000-memory.dmp

memory/1720-37-0x00000000057A0000-0x00000000057B0000-memory.dmp

memory/1720-40-0x0000000005D60000-0x0000000005DC6000-memory.dmp

memory/1720-41-0x0000000075390000-0x0000000075B40000-memory.dmp

memory/1720-42-0x00000000057A0000-0x00000000057B0000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-23 11:56

Reported

2024-01-23 11:58

Platform

win7-20231129-en

Max time kernel

122s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\vidextra.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\vidextra.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\vidextra.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2088 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 2088 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 2088 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 2088 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 2088 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 2088 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 2088 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 2088 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 2088 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 2088 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 2088 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 2088 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 2088 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
PID 2660 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Windows\SysWOW64\cmd.exe
PID 2660 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Windows\SysWOW64\cmd.exe
PID 2660 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Windows\SysWOW64\cmd.exe
PID 2660 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Windows\SysWOW64\cmd.exe
PID 2660 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Windows\SysWOW64\cmd.exe
PID 2660 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Windows\SysWOW64\cmd.exe
PID 2660 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Windows\SysWOW64\cmd.exe
PID 2660 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe C:\Windows\SysWOW64\cmd.exe
PID 2684 wrote to memory of 2532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2684 wrote to memory of 2532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2684 wrote to memory of 2532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2684 wrote to memory of 2532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 2508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2484 wrote to memory of 2508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2484 wrote to memory of 2508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2484 wrote to memory of 2508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2684 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 2684 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 2684 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 2684 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 1904 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 1904 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 1904 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 1904 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 1904 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 1904 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 1904 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 1904 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe
PID 1904 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\vidextra.exe C:\Users\Admin\AppData\Roaming\vidextra.exe

Processes

C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe

"C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe"

C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe

"C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe"

C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe

"C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "vidextra" /tr '"C:\Users\Admin\AppData\Roaming\vidextra.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp787A.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "vidextra" /tr '"C:\Users\Admin\AppData\Roaming\vidextra.exe"'

C:\Users\Admin\AppData\Roaming\vidextra.exe

"C:\Users\Admin\AppData\Roaming\vidextra.exe"

C:\Users\Admin\AppData\Roaming\vidextra.exe

"C:\Users\Admin\AppData\Roaming\vidextra.exe"

Network

Country Destination Domain Proto
US 72.11.158.94:8808 tcp
US 8.8.8.8:53 www.microsoft.com udp

Files

memory/2088-0-0x0000000000B20000-0x0000000000BAC000-memory.dmp

memory/2088-1-0x0000000074520000-0x0000000074C0E000-memory.dmp

memory/2088-2-0x0000000004D70000-0x0000000004DB0000-memory.dmp

memory/2088-3-0x0000000000590000-0x00000000005A8000-memory.dmp

memory/2088-4-0x00000000005C0000-0x00000000005C8000-memory.dmp

memory/2088-5-0x0000000000610000-0x000000000061C000-memory.dmp

memory/2088-6-0x0000000004D10000-0x0000000004D5C000-memory.dmp

memory/2088-7-0x0000000074520000-0x0000000074C0E000-memory.dmp

memory/2088-8-0x0000000004D70000-0x0000000004DB0000-memory.dmp

memory/2660-9-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2660-11-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2660-13-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2660-15-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2660-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2660-19-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2660-23-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2660-21-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2660-25-0x0000000074520000-0x0000000074C0E000-memory.dmp

memory/2088-24-0x0000000074520000-0x0000000074C0E000-memory.dmp

memory/2660-26-0x0000000004D50000-0x0000000004D90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp787A.tmp.bat

MD5 e0d4a149ec0d7b59ca97df8c124a0dc8
SHA1 a381555dfd37ee2d4c7593526e136b46c071a178
SHA256 4cbe4076d02d15459c66a97c8dddd68caa266ce722a63f3cbf19ae65f1692921
SHA512 b03631dc4b3c52ca0d97ec553cfddd405585780fc04a0374a10993240f776a71aa9ffb6014512c6429d4d701f08e2aff97e1b7fee3e44ec4cb00ed063159f3da

memory/2660-36-0x0000000074520000-0x0000000074C0E000-memory.dmp

\Users\Admin\AppData\Roaming\vidextra.exe

MD5 0b97309812b9b2941e5512e12095960e
SHA1 8fc625372ccea9b23c3c3585e1a86a06479eb630
SHA256 1714faef50d0127645ce3540480623cf619f9b10c0364c67ca22db0f604e2381
SHA512 8f0568c9cea86cd33c089ec6f9f32581563d03edbc5ab9a82fd83b81c57ecd4556248a58d40dd315732187a213218a5a4e0af458aec0bde4a6b647b906dfa65b

memory/1904-40-0x00000000001A0000-0x000000000022C000-memory.dmp

memory/1904-41-0x00000000744D0000-0x0000000074BBE000-memory.dmp

memory/1904-42-0x00000000744D0000-0x0000000074BBE000-memory.dmp

memory/1904-43-0x0000000004D50000-0x0000000004D90000-memory.dmp

memory/1300-49-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1300-54-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1904-56-0x00000000744D0000-0x0000000074BBE000-memory.dmp

memory/1300-57-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1300-58-0x0000000074450000-0x0000000074B3E000-memory.dmp

memory/1300-71-0x0000000074450000-0x0000000074B3E000-memory.dmp