Malware Analysis Report

2024-10-24 17:05

Sample ID 240131-1l3n3sdad8
Target DreddedsMT_V2 (1).exe
SHA256 c56c6f394fe19e834ab6e6c1230f227fee52246d00236951d15f05c278016eed
Tags
crealstealer xworm persistence rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c56c6f394fe19e834ab6e6c1230f227fee52246d00236951d15f05c278016eed

Threat Level: Known bad

The file DreddedsMT_V2 (1).exe was found to be: Known bad.

Malicious Activity Summary

crealstealer xworm persistence rat stealer trojan

An infostealer written in Python and packaged with PyInstaller.

Xworm

crealstealer

Detect Xworm Payload

Checks computer location settings

Executes dropped EXE

Drops startup file

Adds Run key to start application

Looks up external IP address via web service

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Gathers network information

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Delays execution with timeout.exe

Creates scheduled task(s)

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Modifies Internet Explorer Phishing Filter

Modifies Internet Explorer settings

Uses Volume Shadow Copy service COM API

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-31 21:45

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-31 21:45

Reported

2024-01-31 21:50

Platform

win7-20231215-en

Max time kernel

237s

Max time network

175s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe"

Signatures

An infostealer written in Python and packaged with PyInstaller.

Description Indicator Process Target
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

crealstealer

stealer crealstealer

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\epicgameslauncher.lnk C:\Users\Admin\AppData\Roaming\epicgameslauncher N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\epicgameslauncher.lnk C:\Users\Admin\AppData\Roaming\discord.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\epicgameslauncher.lnk C:\Users\Admin\AppData\Roaming\discord.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\epicgameslauncher = "C:\\Users\\Admin\\AppData\\Roaming\\epicgameslauncher" C:\Users\Admin\AppData\Roaming\discord.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\epicgameslauncher = "C:\\Users\\Admin\\AppData\\Roaming\\epicgameslauncher" C:\Users\Admin\AppData\Roaming\epicgameslauncher N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Modifies Internet Explorer Phishing Filter

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PhishingFilter C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = b02f99ef8e54da01 C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412899452" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2CE1C0D1-C082-11EE-A628-46FAA8558A22} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MINIE C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\open\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1" C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\open C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\open\CommandId = "IE.File" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2396 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe C:\Users\Admin\AppData\Roaming\discord.exe
PID 2396 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe C:\Users\Admin\AppData\Roaming\discord.exe
PID 2396 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe C:\Users\Admin\AppData\Roaming\discord.exe
PID 2396 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe C:\Windows\system32\rundll32.exe
PID 2396 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe C:\Windows\system32\rundll32.exe
PID 2396 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe C:\Windows\system32\rundll32.exe
PID 2396 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe C:\Windows\system32\cmd.exe
PID 2396 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe C:\Windows\system32\cmd.exe
PID 2396 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe C:\Windows\system32\cmd.exe
PID 2764 wrote to memory of 2684 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2764 wrote to memory of 2684 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2764 wrote to memory of 2684 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 320 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 320 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 320 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2660 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\schtasks.exe
PID 2660 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\schtasks.exe
PID 2660 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\schtasks.exe
PID 1524 wrote to memory of 2044 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\epicgameslauncher
PID 1524 wrote to memory of 2044 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\epicgameslauncher
PID 1524 wrote to memory of 2044 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\epicgameslauncher
PID 2760 wrote to memory of 856 N/A C:\Windows\system32\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2760 wrote to memory of 856 N/A C:\Windows\system32\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2760 wrote to memory of 856 N/A C:\Windows\system32\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 856 wrote to memory of 1304 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 856 wrote to memory of 1304 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 856 wrote to memory of 1304 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 856 wrote to memory of 1304 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 856 wrote to memory of 1500 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 856 wrote to memory of 1500 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 856 wrote to memory of 1500 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1524 wrote to memory of 1576 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\epicgameslauncher
PID 1524 wrote to memory of 1576 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\epicgameslauncher
PID 1524 wrote to memory of 1576 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\epicgameslauncher
PID 1576 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\schtasks.exe
PID 1576 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\schtasks.exe
PID 1576 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\schtasks.exe
PID 1576 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\schtasks.exe
PID 1576 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\schtasks.exe
PID 1576 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\System32\schtasks.exe
PID 1576 wrote to memory of 568 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\system32\cmd.exe
PID 1576 wrote to memory of 568 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\system32\cmd.exe
PID 1576 wrote to memory of 568 N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher C:\Windows\system32\cmd.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe

"C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe"

C:\Users\Admin\AppData\Roaming\discord.exe

"C:\Users\Admin\AppData\Roaming\discord.exe"

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\microsoft.py

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\Dredded'sMT.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\discord.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'discord.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\epicgameslauncher'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'epicgameslauncher'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "epicgameslauncher" /tr "C:\Users\Admin\AppData\Roaming\epicgameslauncher"

C:\Windows\system32\taskeng.exe

taskeng.exe {CAFAE778-F379-418D-824E-73C80C72861C} S-1-5-21-1603059206-2004189698-4139800220-1000:AILVMYUM\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\epicgameslauncher

C:\Users\Admin\AppData\Roaming\epicgameslauncher

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Roaming\microsoft.py

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:275457 /prefetch:2

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Roaming\microsoft.py

C:\Users\Admin\AppData\Roaming\epicgameslauncher

C:\Users\Admin\AppData\Roaming\epicgameslauncher

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\epicgameslauncher'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'epicgameslauncher'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\epicgameslauncher'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'epicgameslauncher'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "epicgameslauncher" /tr "C:\Users\Admin\AppData\Roaming\epicgameslauncher"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /delete /f /tn "epicgameslauncher"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpED8A.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
DE 193.161.193.99:63168 tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
DE 193.161.193.99:63168 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
DE 193.161.193.99:63168 tcp

Files

memory/2396-0-0x0000000000970000-0x00000000009C6000-memory.dmp

memory/2396-1-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

C:\Users\Admin\AppData\Roaming\discord.exe

MD5 72ef95ae3368f3e40bb087ddaa1fa5c2
SHA1 20d810b3e8623916c7eb09ab3a4d1df45fb1cf62
SHA256 dd0eaf0b079081d4e1b37f79c28ea5503e84517a67200b8f2b20a9b9683f5154
SHA512 5a7d657c375a4d83c56903e3d0f327939a27c032d24fc309c11dfe2d2deddafab6c56eea33a9ca4e9293e208ced9ef20d4312f3f827c00316f9d8d8490540ae9

memory/2660-8-0x0000000000F20000-0x0000000000F30000-memory.dmp

C:\Users\Admin\AppData\Roaming\Dredded'sMT.bat

MD5 ab56972290ddce5aac7fa4bc3436efab
SHA1 3e0a65413a467ac4c4925366766701f016db173c
SHA256 fdb6f0c1731c5ba1ee0598b85620ab83a9e1f6ffe708c1d8ed0055b6eb7d67c1
SHA512 75ade9804e223bc37837513aaaa0a80d8e4ddab25363261b597d4a8bf33ed6def3736a99c0519b1cd20e04cb2761a8c3956ff3b4bff5a87b48d94c47a6c45754

memory/2660-17-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

memory/2396-19-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

memory/2660-20-0x000000001AC40000-0x000000001ACC0000-memory.dmp

memory/1868-25-0x000000001B3A0000-0x000000001B682000-memory.dmp

memory/1868-26-0x0000000001F40000-0x0000000001F48000-memory.dmp

memory/1868-27-0x000007FEEEB60000-0x000007FEEF4FD000-memory.dmp

memory/1868-28-0x0000000002440000-0x00000000024C0000-memory.dmp

memory/1868-29-0x000007FEEEB60000-0x000007FEEF4FD000-memory.dmp

memory/1868-30-0x0000000002440000-0x00000000024C0000-memory.dmp

memory/1868-31-0x0000000002440000-0x00000000024C0000-memory.dmp

memory/1868-32-0x0000000002440000-0x00000000024C0000-memory.dmp

memory/1868-33-0x000007FEEEB60000-0x000007FEEF4FD000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 a62657e5c66decc910b8ff4c007f26d3
SHA1 dadbe7b9ac7a99fbde7a322859f65e44e484caa2
SHA256 e800b18e679a4c3ea261376b7ab72a7c33d78a22d44767ede79ff4c4c89904de
SHA512 b92855d72c366d7ab0573eb19235d3f0cfa09cff0f961e69f8fc60f2f31626003c8dcca9a9e814bf922480e9e01d612a059ae5caa427130d27490b65e7f7b265

memory/1104-39-0x000000001B230000-0x000000001B512000-memory.dmp

memory/1104-41-0x0000000002610000-0x0000000002618000-memory.dmp

memory/1104-40-0x000007FEEE1C0000-0x000007FEEEB5D000-memory.dmp

memory/1104-42-0x0000000002470000-0x00000000024F0000-memory.dmp

memory/1104-44-0x0000000002470000-0x00000000024F0000-memory.dmp

memory/1104-43-0x000007FEEE1C0000-0x000007FEEEB5D000-memory.dmp

memory/1104-46-0x000000000247B000-0x00000000024E2000-memory.dmp

memory/1104-45-0x0000000002470000-0x00000000024F0000-memory.dmp

memory/1104-47-0x000007FEEE1C0000-0x000007FEEEB5D000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/320-55-0x0000000002910000-0x0000000002990000-memory.dmp

memory/320-54-0x000007FEEEB60000-0x000007FEEF4FD000-memory.dmp

memory/320-58-0x000000000291B000-0x0000000002982000-memory.dmp

memory/320-57-0x0000000002910000-0x0000000002990000-memory.dmp

memory/2660-60-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

memory/320-59-0x000007FEEEB60000-0x000007FEEF4FD000-memory.dmp

memory/320-56-0x000007FEEEB60000-0x000007FEEF4FD000-memory.dmp

memory/2004-66-0x000007FEEE1C0000-0x000007FEEEB5D000-memory.dmp

memory/2004-67-0x0000000002590000-0x0000000002610000-memory.dmp

memory/2004-68-0x000007FEEE1C0000-0x000007FEEEB5D000-memory.dmp

memory/2004-70-0x0000000002590000-0x0000000002610000-memory.dmp

memory/2004-69-0x0000000002590000-0x0000000002610000-memory.dmp

memory/2004-72-0x0000000002590000-0x0000000002610000-memory.dmp

memory/2660-71-0x000000001AC40000-0x000000001ACC0000-memory.dmp

memory/2004-73-0x000007FEEE1C0000-0x000007FEEEB5D000-memory.dmp

memory/2044-80-0x00000000008E0000-0x00000000008F0000-memory.dmp

memory/2044-81-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

memory/2044-82-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

memory/2660-85-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

C:\Users\Admin\AppData\Roaming\microsoft.py

MD5 56858a6f2411a10b07e553dafc76f2cc
SHA1 51fde952fd7ac4a4ad5afe00ee77116120c1f60b
SHA256 ad2c20dc31883ca97884043544fe004cc370270be97ba1bf447b9358c4bd5f92
SHA512 62e529809f42460bd13752fa97c0fc6a19b33e82d8350be10d187e336638d1abf12325ebba79535d22d6666d97698a234d0dcc86c542f97bcf80d34b403676cb

memory/1576-92-0x0000000000A30000-0x0000000000A40000-memory.dmp

memory/1576-93-0x000007FEF4B60000-0x000007FEF554C000-memory.dmp

memory/1576-94-0x000000001AEC0000-0x000000001AF40000-memory.dmp

memory/2812-100-0x000000001B230000-0x000000001B512000-memory.dmp

memory/2812-101-0x000007FEEE2D0000-0x000007FEEEC6D000-memory.dmp

memory/2812-102-0x0000000002660000-0x00000000026E0000-memory.dmp

memory/2812-104-0x0000000002040000-0x0000000002048000-memory.dmp

memory/2812-105-0x0000000002660000-0x00000000026E0000-memory.dmp

memory/2812-103-0x000007FEEE2D0000-0x000007FEEEC6D000-memory.dmp

memory/2812-106-0x0000000002660000-0x00000000026E0000-memory.dmp

memory/2812-107-0x000007FEEE2D0000-0x000007FEEEC6D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 f0466e6a05abe0e802feed769fe87168
SHA1 51ea5c6db32eae746649334319241c59bfb4fbe1
SHA256 b0f0d0ea19dc0b8c1cb507ff1ad4022236fd92b1d6918496e390e68b2c3c7175
SHA512 ccc6809a784ee038409b225b6a93be571e69ebb4975b112df236362871de421c3420c49a7e3765182b50bdab333bf864aad75b48d0756506bde5eb1c1e2319a9

memory/1928-114-0x000007FEED930000-0x000007FEEE2CD000-memory.dmp

memory/1928-115-0x0000000002530000-0x00000000025B0000-memory.dmp

memory/1928-113-0x000000001B310000-0x000000001B5F2000-memory.dmp

memory/1928-117-0x000007FEED930000-0x000007FEEE2CD000-memory.dmp

memory/1928-118-0x0000000002530000-0x00000000025B0000-memory.dmp

memory/1928-119-0x0000000002530000-0x00000000025B0000-memory.dmp

memory/1928-116-0x00000000023F0000-0x00000000023F8000-memory.dmp

memory/1576-120-0x000007FEF4B60000-0x000007FEF554C000-memory.dmp

memory/1928-121-0x0000000002530000-0x00000000025B0000-memory.dmp

memory/1928-122-0x000007FEED930000-0x000007FEEE2CD000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\epicgameslauncher.lnk

MD5 929ce8d4e7870e63f45ff870a566f80a
SHA1 c332b9b68f85ffb355e389383c12aa10690a3e47
SHA256 99dccb4d5d997a02575e5020250174bed50133d825d4af10e0b4dfbad0d027fb
SHA512 f00acaf05d9b07c33702e2fc6de14fc7b6437c44ee259c47c99dc8cbbe679ff33bfd6fb7aeb67f8f09de79b75cfa860fdd9c2c54012b785661b90679e000a6ef

C:\Users\Admin\AppData\Local\Temp\CabF440.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\TarF4C0.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 29e128febb7a1dbbfc3d9983b14b72fb
SHA1 63cfecf3805000c4aede57ed23a458650fde0ca9
SHA256 b32fbfdbf9c821d3e052082dbe34a4ea8aeb8ec27c35726f01c24cdcf809aab1
SHA512 e46f90e17262f8157633a93b47ef28dafb688d79fa1ca55ff03086f2ab5e43d2e8c3182fde54828240c835b6a781d5c4bbe0abdf4d590d021597cce0383c2a27

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 44a82c737f53cfbfa8963f48e2b9c33b
SHA1 b2f4d3714067ec4b014036a452fa3787190a3cf0
SHA256 7f6fe7dcea7cd3fc6fcb219ee18dd483077a22fe7b3ecdfe8ebe58bf9c709e8d
SHA512 8e60aee81850c30fd83abf874864fab4f0e8fbcf88e3ef1ef77755b89cd9b3d537161d8c72fd9a18ceb67c566b6b94b54be3de7c320adeceffba2d9f33323811

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8d2a1b09afb2db87e16259681a8265ab
SHA1 1ebcb91ea3a453e47150f63598c3d54fdfc2fcc1
SHA256 ef76dc27833822f37f338fb596154d66b3b247be3bb1d268db1b5feff90c145a
SHA512 339929caad1005d3c88da513c85dd7869644eb42e65c6b48e8e41ff36e3a70a14e0c8de5ea20ae6dc7d8326dd17a5031507407922250ebb0751ca2826581f901

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5e47c51be214190c850c7dc00c3b4d77
SHA1 6ae5857c391df3da880c12ac236f4ece541c1c92
SHA256 9972c1a89c39b679d46b2a441806c46189b7e95da83d5f137733b6b2b92b248f
SHA512 31343c5c607d13805e42f9c27560474db99e8dd8498ee5353d169a889b575bdf54dbd00ec5d6f42ef0f44e14e513721c90bc119b5459c1ec4b58214ba4047603

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f1de7c90df0892c9e994189e0524b2cb
SHA1 808155b521cad62eee271e4901b677c15ba0941c
SHA256 341b2a0fe9878ae42c8911e47c66aa04ce12192cfb6b49b9abeecfe339a0287a
SHA512 79bac58feede6bb1154d2a4856be357aa921efaae1c018ccf1ecd0db1975c3b33ea9484ef1ac87a85af05e85008420cb91ef6ec6f132e0116b26fe594b9e4fd1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1eb4697d6afbb641c7411ee2fbb9efee
SHA1 2d286d7576503841090a8e667cfdf9bcc2046269
SHA256 fc7817fd244eb7f4d774274ca05f2fd501dc4e1d51d6cbb16d6f57834737506f
SHA512 ed53e86549e57d6105b33095c65a3d4729e41a5936f378fd40716a773802ada4e55e80d09746d35435b2fcd0c997a3274cad61919aaae8d98f78e6c4eccc1adb

C:\Users\Admin\AppData\Local\Temp\tmpED8A.tmp.bat

MD5 a10c02d19df86a8bc71ed6766d1bdd06
SHA1 6d2e8525c752176d32ecc86b2456ef76ac8b5a56
SHA256 d852425dfda79bc3ce7b896bca023b27d7cc168d36b0a797784db24d78c66bf7
SHA512 25cca614b032217701e966b2286f4716422ab35b0f727a2b4e652cbfa2a4c9bfbfa4b7add780d6a500ba364c7878c3c971029a8018f4019a28b19dc26f9ee03f

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-31 21:45

Reported

2024-01-31 21:50

Platform

win10v2004-20231215-en

Max time kernel

275s

Max time network

295s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe"

Signatures

An infostealer written in Python and packaged with PyInstaller.

Description Indicator Process Target
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

crealstealer

stealer crealstealer

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\discord.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\epicgameslauncher.lnk C:\Users\Admin\AppData\Roaming\discord.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\epicgameslauncher.lnk C:\Users\Admin\AppData\Roaming\discord.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\epicgameslauncher = "C:\\Users\\Admin\\AppData\\Roaming\\epicgameslauncher" C:\Users\Admin\AppData\Roaming\discord.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A

Modifies Internet Explorer Phishing Filter

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\PhishingFilter C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 0deb0d6e8a2fda01 C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31085711" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "735142863" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31085711" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413502628" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{57213E2D-C082-11EE-BD28-72AC86130FB1} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "731861626" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\MINIE C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "731861626" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31085711" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\py_auto_file\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}" C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\py_auto_file C:\Windows\system32\OpenWith.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\ﳸだ᠀耀Ɔ\ = "py_auto_file" C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\py_auto_file\shell\open C:\Windows\system32\OpenWith.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\py_auto_file\shell\open\CommandId = "IE.File" C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\.py C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\py_auto_file\shell\open\command C:\Windows\system32\OpenWith.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\py_auto_file\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1" C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\py_auto_file\shell C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\.py\ = "py_auto_file" C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\ﳸだ᠀耀Ɔ C:\Windows\system32\OpenWith.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\discord.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\epicgameslauncher N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3300 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe C:\Users\Admin\AppData\Roaming\discord.exe
PID 3300 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe C:\Users\Admin\AppData\Roaming\discord.exe
PID 3300 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe C:\Windows\system32\cmd.exe
PID 3300 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe C:\Windows\system32\cmd.exe
PID 2568 wrote to memory of 4700 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2568 wrote to memory of 4700 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2824 wrote to memory of 224 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2824 wrote to memory of 224 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2824 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2824 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2824 wrote to memory of 556 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2824 wrote to memory of 556 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2824 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2824 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2824 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\schtasks.exe
PID 2824 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\discord.exe C:\Windows\System32\schtasks.exe
PID 2924 wrote to memory of 1100 N/A C:\Windows\system32\OpenWith.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2924 wrote to memory of 1100 N/A C:\Windows\system32\OpenWith.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1100 wrote to memory of 1896 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1100 wrote to memory of 1896 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1100 wrote to memory of 1896 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2568 wrote to memory of 3228 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 2568 wrote to memory of 3228 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\ipconfig.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe

"C:\Users\Admin\AppData\Local\Temp\DreddedsMT_V2 (1).exe"

C:\Users\Admin\AppData\Roaming\discord.exe

"C:\Users\Admin\AppData\Roaming\discord.exe"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Dredded'sMT.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\discord.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'discord.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\epicgameslauncher'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'epicgameslauncher'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "epicgameslauncher" /tr "C:\Users\Admin\AppData\Roaming\epicgameslauncher"

C:\Users\Admin\AppData\Roaming\epicgameslauncher

C:\Users\Admin\AppData\Roaming\epicgameslauncher

C:\Users\Admin\AppData\Roaming\epicgameslauncher

C:\Users\Admin\AppData\Roaming\epicgameslauncher

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Roaming\microsoft.py

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1100 CREDAT:17410 /prefetch:2

C:\Users\Admin\AppData\Roaming\epicgameslauncher

C:\Users\Admin\AppData\Roaming\epicgameslauncher

C:\Windows\system32\ipconfig.exe

ipconfig

C:\Users\Admin\AppData\Roaming\epicgameslauncher

C:\Users\Admin\AppData\Roaming\epicgameslauncher

C:\Users\Admin\AppData\Roaming\epicgameslauncher

C:\Users\Admin\AppData\Roaming\epicgameslauncher

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 138.91.171.81:80 tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
DE 193.161.193.99:63168 tcp
US 8.8.8.8:53 99.193.161.193.in-addr.arpa udp
DE 193.161.193.99:63168 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 28.160.77.104.in-addr.arpa udp
DE 193.161.193.99:63168 tcp
DE 193.161.193.99:63168 tcp
US 8.8.8.8:53 150.1.37.23.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
DE 193.161.193.99:63168 tcp
DE 193.161.193.99:63168 tcp
DE 193.161.193.99:63168 tcp
DE 193.161.193.99:63168 tcp

Files

memory/3300-0-0x0000000000B40000-0x0000000000B96000-memory.dmp

memory/3300-2-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

C:\Users\Admin\AppData\Roaming\discord.exe

MD5 72ef95ae3368f3e40bb087ddaa1fa5c2
SHA1 20d810b3e8623916c7eb09ab3a4d1df45fb1cf62
SHA256 dd0eaf0b079081d4e1b37f79c28ea5503e84517a67200b8f2b20a9b9683f5154
SHA512 5a7d657c375a4d83c56903e3d0f327939a27c032d24fc309c11dfe2d2deddafab6c56eea33a9ca4e9293e208ced9ef20d4312f3f827c00316f9d8d8490540ae9

memory/2824-15-0x00000000007D0000-0x00000000007E0000-memory.dmp

memory/2824-16-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

memory/3300-21-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

C:\Users\Admin\AppData\Roaming\Dredded'sMT.bat

MD5 ab56972290ddce5aac7fa4bc3436efab
SHA1 3e0a65413a467ac4c4925366766701f016db173c
SHA256 fdb6f0c1731c5ba1ee0598b85620ab83a9e1f6ffe708c1d8ed0055b6eb7d67c1
SHA512 75ade9804e223bc37837513aaaa0a80d8e4ddab25363261b597d4a8bf33ed6def3736a99c0519b1cd20e04cb2761a8c3956ff3b4bff5a87b48d94c47a6c45754

memory/2824-23-0x000000001B410000-0x000000001B420000-memory.dmp

memory/224-29-0x000001D168900000-0x000001D168922000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kzzcxhps.yio.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/224-34-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

memory/224-35-0x000001D1687C0000-0x000001D1687D0000-memory.dmp

memory/224-36-0x000001D1687C0000-0x000001D1687D0000-memory.dmp

memory/224-39-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

memory/1572-41-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

memory/1572-51-0x000001E7BC840000-0x000001E7BC850000-memory.dmp

memory/1572-52-0x000001E7BC840000-0x000001E7BC850000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

memory/1572-55-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

memory/556-61-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e3161f4edbc9b963debe22e29658050b
SHA1 45dbf88dadafe5dd1cfee1e987c8a219d3208cdb
SHA256 1359d6daeaed2f254b162914203c891b23139cc236a3bf75c2dfcbe26265c84a
SHA512 006ffb8f37d1f77f8ee79b22ffa413819f565d62773c632b70985759572121c6ab4743139d16d885f8c0ff9d0e0b136686741728b3e142ee54aea3bb733dffb2

memory/556-68-0x000001D87D3E0000-0x000001D87D3F0000-memory.dmp

memory/556-67-0x000001D87D3E0000-0x000001D87D3F0000-memory.dmp

memory/556-70-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

memory/4352-83-0x0000019466180000-0x0000019466190000-memory.dmp

memory/4352-82-0x0000019466180000-0x0000019466190000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ba169f4dcbbf147fe78ef0061a95e83b
SHA1 92a571a6eef49fff666e0f62a3545bcd1cdcda67
SHA256 5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1
SHA512 8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

memory/4352-80-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

memory/4352-85-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

memory/2824-89-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

memory/3920-92-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

memory/3920-94-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

memory/2824-95-0x000000001B490000-0x000000001B49C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\epicgameslauncher.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

memory/1804-99-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

memory/1804-100-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

C:\Users\Admin\AppData\Roaming\microsoft.py

MD5 56858a6f2411a10b07e553dafc76f2cc
SHA1 51fde952fd7ac4a4ad5afe00ee77116120c1f60b
SHA256 ad2c20dc31883ca97884043544fe004cc370270be97ba1bf447b9358c4bd5f92
SHA512 62e529809f42460bd13752fa97c0fc6a19b33e82d8350be10d187e336638d1abf12325ebba79535d22d6666d97698a234d0dcc86c542f97bcf80d34b403676cb

memory/3244-107-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

memory/3244-108-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5 bcace81d477f3c718f9b8caa06bbbdcc
SHA1 966f9283be355a4397633243c28a26ace4f8f5db
SHA256 536e164c1bcbbe417f805d4d9722d6e8d934ee957fb54bb0a1faeb65336f6294
SHA512 99e5175ccc544a20ce6a1d944002ceee21022eee15c9815ec61fa51785480ff43071c239c0fc9ccbeb0a036fe1b7cd62a4f45b1d9e30da7889410e26f747b679

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5 5d844b20d8c94bbdfa2704f8af92a58b
SHA1 50b079ef6fe4169b12f8c6d18e6dbe5cff792ba8
SHA256 d61162507d40e38425cf71172e6757a5e9b8f3e04a988410a69f096d86c23f46
SHA512 4d329f43c960433fd0bf93852b0446d0434de50d7198ca9dbbc75fdc396e822d842faa1d30694a6cc4ca15df51f2a278eb89c172d3a0e02ffa858bd7d343be32

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UG0DPB4T\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

memory/3660-136-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

memory/3660-137-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

memory/2972-139-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp

memory/2972-140-0x00007FFF92DA0000-0x00007FFF93861000-memory.dmp