Malware Analysis Report

2024-09-22 21:48

Sample ID 240204-a6ws6adfc2
Target 8dcc97027d77b67586b46d6ba571d2b4
SHA256 3bdaeb542939de272d46fa125a9fbfc4a2bb551c3a49c5fbb68d17c45a11446d
Tags
azorult oski raccoon c81fb6015c832710f869f6911e1aec18747e0184 infostealer spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3bdaeb542939de272d46fa125a9fbfc4a2bb551c3a49c5fbb68d17c45a11446d

Threat Level: Known bad

The file 8dcc97027d77b67586b46d6ba571d2b4 was found to be: Known bad.

Malicious Activity Summary

azorult oski raccoon c81fb6015c832710f869f6911e1aec18747e0184 infostealer spyware stealer trojan

Raccoon

Raccoon Stealer V1 payload

Azorult

Oski

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies system certificate store

Suspicious behavior: MapViewOfSection

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-02-04 00:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-04 00:50

Reported

2024-02-04 00:52

Platform

win7-20231215-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe"

Signatures

Azorult

trojan infostealer azorult

Oski

infostealer oski

Raccoon

stealer raccoon

Raccoon Stealer V1 payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\Vdgfgjkhsdwr.exe N/A
N/A N/A C:\ProgramData\Dropakcx.exe N/A
N/A N/A C:\ProgramData\Dropakcx.exe N/A
N/A N/A C:\ProgramData\Vdgfgjkhsdwr.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1340 set thread context of 2800 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe
PID 2524 set thread context of 2700 N/A C:\ProgramData\Dropakcx.exe C:\ProgramData\Dropakcx.exe
PID 3004 set thread context of 2928 N/A C:\ProgramData\Vdgfgjkhsdwr.exe C:\ProgramData\Vdgfgjkhsdwr.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\ProgramData\Dropakcx.exe

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe N/A
N/A N/A C:\ProgramData\Dropakcx.exe N/A
N/A N/A C:\ProgramData\Vdgfgjkhsdwr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe N/A
N/A N/A C:\ProgramData\Dropakcx.exe N/A
N/A N/A C:\ProgramData\Vdgfgjkhsdwr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1340 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 1340 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 1340 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 1340 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 1340 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\ProgramData\Dropakcx.exe
PID 1340 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\ProgramData\Dropakcx.exe
PID 1340 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\ProgramData\Dropakcx.exe
PID 1340 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\ProgramData\Dropakcx.exe
PID 1340 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe
PID 1340 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe
PID 1340 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe
PID 1340 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe
PID 1340 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe
PID 2524 wrote to memory of 2700 N/A C:\ProgramData\Dropakcx.exe C:\ProgramData\Dropakcx.exe
PID 2524 wrote to memory of 2700 N/A C:\ProgramData\Dropakcx.exe C:\ProgramData\Dropakcx.exe
PID 2524 wrote to memory of 2700 N/A C:\ProgramData\Dropakcx.exe C:\ProgramData\Dropakcx.exe
PID 2524 wrote to memory of 2700 N/A C:\ProgramData\Dropakcx.exe C:\ProgramData\Dropakcx.exe
PID 2524 wrote to memory of 2700 N/A C:\ProgramData\Dropakcx.exe C:\ProgramData\Dropakcx.exe
PID 3004 wrote to memory of 2928 N/A C:\ProgramData\Vdgfgjkhsdwr.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 3004 wrote to memory of 2928 N/A C:\ProgramData\Vdgfgjkhsdwr.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 3004 wrote to memory of 2928 N/A C:\ProgramData\Vdgfgjkhsdwr.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 3004 wrote to memory of 2928 N/A C:\ProgramData\Vdgfgjkhsdwr.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 3004 wrote to memory of 2928 N/A C:\ProgramData\Vdgfgjkhsdwr.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 2700 wrote to memory of 2852 N/A C:\ProgramData\Dropakcx.exe C:\Windows\SysWOW64\WerFault.exe
PID 2700 wrote to memory of 2852 N/A C:\ProgramData\Dropakcx.exe C:\Windows\SysWOW64\WerFault.exe
PID 2700 wrote to memory of 2852 N/A C:\ProgramData\Dropakcx.exe C:\Windows\SysWOW64\WerFault.exe
PID 2700 wrote to memory of 2852 N/A C:\ProgramData\Dropakcx.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe

"C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe"

C:\ProgramData\Vdgfgjkhsdwr.exe

"C:\ProgramData\Vdgfgjkhsdwr.exe"

C:\ProgramData\Dropakcx.exe

"C:\ProgramData\Dropakcx.exe"

C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe

"C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe"

C:\ProgramData\Vdgfgjkhsdwr.exe

"C:\ProgramData\Vdgfgjkhsdwr.exe"

C:\ProgramData\Dropakcx.exe

"C:\ProgramData\Dropakcx.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 780

Network

Country Destination Domain Proto
US 8.8.8.8:53 telete.in udp
US 8.8.8.8:53 kullasa.ac.ug udp
DE 185.53.177.54:443 telete.in tcp

Files

memory/1340-2-0x0000000000230000-0x0000000000231000-memory.dmp

\ProgramData\Vdgfgjkhsdwr.exe

MD5 b92b398d4e25a976dc699f2099fa8452
SHA1 900e6fedf9898adbbc5f3dc7185372ffb811c8ad
SHA256 6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177
SHA512 5b854a34d489a94d2b193af192cb0d9f224ef1b7d2d0cd50b119a9cd24693c720482e9ddf910b2e9e0ef44e8ad263aa4a69094b503a01ff9a177d8c2cef5f1ed

memory/1340-22-0x0000000002690000-0x0000000002698000-memory.dmp

C:\ProgramData\Dropakcx.exe

MD5 c8743b5adf8d41b30759e0b3cf90d5e9
SHA1 ebde06255cf726e4eaa6c4568c958cb9c34b92dd
SHA256 a1531f02c5b450aec494f892131135e7a84945f72b9197a5d8c5e604b23b5dc7
SHA512 5aa27e97ef87b21945958485381032e031af7200ffda8a2931c7108d483bfe27e6c890b71774c6bd3b9e7a0f327a5e1477d31e981971f3a8fbc1441077f34cb7

memory/2800-26-0x0000000000400000-0x0000000000497000-memory.dmp

memory/2524-27-0x0000000000310000-0x0000000000311000-memory.dmp

memory/3004-34-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2928-37-0x0000000000400000-0x0000000000425000-memory.dmp

C:\ProgramData\Vdgfgjkhsdwr.exe

MD5 3b44bd97a18196b7960831f0a90baf41
SHA1 3e6b918a2d29a17b9419ea260786db705ba2794a
SHA256 c9c838a115a9c9f662e324f5f34be5f4275e73b64b1061672fa7ec88f3dd0eca
SHA512 cc3807218fe08dc903bebe76656148c1426b938bf09cd8f6fb28ef4ad8f3bf893cb4706790fa82f835fefff3f34d70763ec53eb2142b1a3ebe6c8e42e08778de

C:\ProgramData\Vdgfgjkhsdwr.exe

MD5 e67dabcc0cfd964ada27a2c160ce253e
SHA1 88b4c598a8fe62e2cd38046f26ba9ba7a6d368c5
SHA256 2ab840136702c6336403dbd913f3910135b622accb4c8fb585ca96085e9419a1
SHA512 5f0ac2f2595026da34ff71717f1410efac14a0aa4b38bddb7643c235c9ee3f00673d3f27719eee8d970f403ac55986050bee1355bd6c22b7ff77807d983b8e03

memory/2700-31-0x0000000000400000-0x0000000000439000-memory.dmp

C:\ProgramData\Dropakcx.exe

MD5 e21551a13085e0ba0fad3e733d807559
SHA1 87aeaaf58c1d8cf23755697489267f289e7c5780
SHA256 abf5833a2ffa007792753f5d49fd21f00a2c8d20e623f57d9e3748c41fb1435a
SHA512 21497f7f742b5c2e61bd5b04e10eb71538d6bafd9c00aa793f9798a7035b9c02ac80bce3baa38d6e97a10239df726246a157b8c7db5ceffc31937187659ac189

\ProgramData\Dropakcx.exe

MD5 e2b1a6633acfe733f9efdadd2f3ab690
SHA1 dc88d002bd93ff1a3ae48f7815013046931a8230
SHA256 59ba611c8762341a28a470cef09c3fb57862db0b70dc6d6674e6281d74845d18
SHA512 55e0c9cfee285c0e7ba7aa7d6e30a75f65cf812d24463723cf4ac15e34ed6f2e568535913b0a0c38da23ac07e3e1addc3db111c85b6c7dc61a55e06bc47fabb4

memory/2700-40-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2800-41-0x0000000000400000-0x0000000000497000-memory.dmp

memory/2700-44-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2800-45-0x0000000000400000-0x0000000000497000-memory.dmp

memory/2700-47-0x0000000000400000-0x0000000000434000-memory.dmp

memory/2928-48-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2800-46-0x0000000000400000-0x0000000000492000-memory.dmp

memory/2524-49-0x0000000000310000-0x0000000000311000-memory.dmp

memory/2700-57-0x0000000000400000-0x0000000000434000-memory.dmp

memory/2700-59-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2800-60-0x0000000000400000-0x0000000000497000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-04 00:50

Reported

2024-02-04 00:52

Platform

win10v2004-20231215-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe"

Signatures

Azorult

trojan infostealer azorult

Oski

infostealer oski

Raccoon

stealer raccoon

Raccoon Stealer V1 payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\Vdgfgjkhsdwr.exe N/A
N/A N/A C:\ProgramData\Dropakcx.exe N/A
N/A N/A C:\ProgramData\Dropakcx.exe N/A
N/A N/A C:\ProgramData\Vdgfgjkhsdwr.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4488 set thread context of 4300 N/A C:\ProgramData\Dropakcx.exe C:\ProgramData\Dropakcx.exe
PID 4604 set thread context of 4116 N/A C:\ProgramData\Vdgfgjkhsdwr.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 4420 set thread context of 3932 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\ProgramData\Dropakcx.exe

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\ProgramData\Dropakcx.exe N/A
N/A N/A C:\ProgramData\Vdgfgjkhsdwr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe N/A
N/A N/A C:\ProgramData\Dropakcx.exe N/A
N/A N/A C:\ProgramData\Vdgfgjkhsdwr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4420 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 4420 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 4420 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 4420 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\ProgramData\Dropakcx.exe
PID 4420 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\ProgramData\Dropakcx.exe
PID 4420 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\ProgramData\Dropakcx.exe
PID 4488 wrote to memory of 4300 N/A C:\ProgramData\Dropakcx.exe C:\ProgramData\Dropakcx.exe
PID 4488 wrote to memory of 4300 N/A C:\ProgramData\Dropakcx.exe C:\ProgramData\Dropakcx.exe
PID 4488 wrote to memory of 4300 N/A C:\ProgramData\Dropakcx.exe C:\ProgramData\Dropakcx.exe
PID 4488 wrote to memory of 4300 N/A C:\ProgramData\Dropakcx.exe C:\ProgramData\Dropakcx.exe
PID 4604 wrote to memory of 4116 N/A C:\ProgramData\Vdgfgjkhsdwr.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 4604 wrote to memory of 4116 N/A C:\ProgramData\Vdgfgjkhsdwr.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 4604 wrote to memory of 4116 N/A C:\ProgramData\Vdgfgjkhsdwr.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 4604 wrote to memory of 4116 N/A C:\ProgramData\Vdgfgjkhsdwr.exe C:\ProgramData\Vdgfgjkhsdwr.exe
PID 4420 wrote to memory of 3932 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe
PID 4420 wrote to memory of 3932 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe
PID 4420 wrote to memory of 3932 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe
PID 4420 wrote to memory of 3932 N/A C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe

"C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe"

C:\ProgramData\Vdgfgjkhsdwr.exe

"C:\ProgramData\Vdgfgjkhsdwr.exe"

C:\ProgramData\Dropakcx.exe

"C:\ProgramData\Dropakcx.exe"

C:\ProgramData\Dropakcx.exe

"C:\ProgramData\Dropakcx.exe"

C:\ProgramData\Vdgfgjkhsdwr.exe

"C:\ProgramData\Vdgfgjkhsdwr.exe"

C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe

"C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4300 -ip 4300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 1312

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 myproskxa.ac.ug udp
US 8.8.8.8:53 kullasa.ac.ug udp
US 8.8.8.8:53 telete.in udp
DE 185.53.177.54:443 telete.in tcp
US 8.8.8.8:53 myproskxa.ac.ug udp
US 8.8.8.8:53 54.177.53.185.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 204.201.50.20.in-addr.arpa udp

Files

memory/4420-2-0x0000000077232000-0x0000000077233000-memory.dmp

memory/4420-3-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

C:\ProgramData\Vdgfgjkhsdwr.exe

MD5 b92b398d4e25a976dc699f2099fa8452
SHA1 900e6fedf9898adbbc5f3dc7185372ffb811c8ad
SHA256 6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177
SHA512 5b854a34d489a94d2b193af192cb0d9f224ef1b7d2d0cd50b119a9cd24693c720482e9ddf910b2e9e0ef44e8ad263aa4a69094b503a01ff9a177d8c2cef5f1ed

C:\ProgramData\Dropakcx.exe

MD5 e21551a13085e0ba0fad3e733d807559
SHA1 87aeaaf58c1d8cf23755697489267f289e7c5780
SHA256 abf5833a2ffa007792753f5d49fd21f00a2c8d20e623f57d9e3748c41fb1435a
SHA512 21497f7f742b5c2e61bd5b04e10eb71538d6bafd9c00aa793f9798a7035b9c02ac80bce3baa38d6e97a10239df726246a157b8c7db5ceffc31937187659ac189

memory/4488-30-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

memory/4604-31-0x00000000009B0000-0x00000000009B1000-memory.dmp

memory/4300-33-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4488-32-0x0000000002840000-0x0000000002848000-memory.dmp

memory/4300-36-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4116-35-0x0000000000400000-0x0000000000425000-memory.dmp

memory/4300-43-0x0000000002050000-0x0000000002051000-memory.dmp

memory/4116-45-0x0000000000400000-0x0000000000425000-memory.dmp

memory/4300-42-0x0000000077232000-0x0000000077233000-memory.dmp

memory/4116-41-0x0000000000400000-0x0000000000425000-memory.dmp

memory/4300-39-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4116-47-0x0000000002040000-0x0000000002041000-memory.dmp

memory/3932-48-0x0000000000400000-0x0000000000497000-memory.dmp

memory/4116-46-0x0000000077232000-0x0000000077233000-memory.dmp

memory/3932-49-0x0000000000400000-0x0000000000497000-memory.dmp

memory/3932-50-0x0000000000400000-0x0000000000497000-memory.dmp

memory/3932-52-0x0000000077232000-0x0000000077233000-memory.dmp

memory/3932-53-0x0000000000500000-0x0000000000501000-memory.dmp

memory/4116-54-0x0000000000400000-0x0000000000425000-memory.dmp

memory/4116-56-0x0000000000400000-0x0000000000420000-memory.dmp

memory/4300-60-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4300-61-0x0000000000400000-0x0000000000434000-memory.dmp

memory/4300-59-0x0000000000440000-0x0000000000509000-memory.dmp

memory/3932-62-0x0000000000400000-0x0000000000492000-memory.dmp

memory/3932-64-0x0000000000400000-0x0000000000497000-memory.dmp