Malware Analysis Report

2025-04-14 08:15

Sample ID 240208-y1gztaad71
Target 337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049
SHA256 337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049
Tags
raccoon 78be1159414ee1206da29b4227579775 stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049

Threat Level: Known bad

The file 337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049 was found to be: Known bad.

Malicious Activity Summary

raccoon 78be1159414ee1206da29b4227579775 stealer

Raccoon Stealer V2 payload

Raccoon

Suspicious use of NtCreateUserProcessOtherParentProcess

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Runs ping.exe

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Enumerates processes with tasklist

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-08 20:14

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-08 20:14

Reported

2024-02-08 20:17

Platform

win7-20231215-en

Max time kernel

120s

Max time network

124s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2808 created 1264 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif C:\Windows\Explorer.EXE

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2808 set thread context of 1228 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1456 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049.exe C:\Windows\SysWOW64\cmd.exe
PID 1456 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049.exe C:\Windows\SysWOW64\cmd.exe
PID 1456 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049.exe C:\Windows\SysWOW64\cmd.exe
PID 1456 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2796 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2796 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2796 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2796 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2796 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2796 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2796 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2796 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2796 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2796 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2796 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2796 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2796 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2796 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2796 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2796 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif
PID 2796 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif
PID 2796 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif
PID 2796 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif
PID 2796 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2796 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2796 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2796 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2808 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif
PID 2808 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif
PID 2808 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif
PID 2808 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif
PID 2808 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif
PID 2808 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049.exe

"C:\Users\Admin\AppData\Local\Temp\337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k move Outdoor Outdoor.bat & Outdoor.bat & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 21543

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Statutes + Cakes + Import + Bacon + Advert + Ends 21543\Chosen.pif

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Attract 21543\t

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif

21543\Chosen.pif 21543\t

C:\Windows\SysWOW64\PING.EXE

ping -n 5 localhost

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif

Network

Country Destination Domain Proto
US 8.8.8.8:53 ZgNzzPCTqAQVgTYXMxk.ZgNzzPCTqAQVgTYXMxk udp
RU 195.2.76.141:80 tcp
RU 195.2.76.141:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Outdoor

MD5 a6576dd8e70ca281dcc4d57003bc96ba
SHA1 6f86590b13c56da8066332d71b427a1ba71e4da8
SHA256 f52360cf001e9c04ccd4df187c5444965b0d84e668e7ba625190e5d946ff472a
SHA512 fe61a1b83320a5be661690b37fec9480a19a540ae805be885a22565b42d06f02f4e91d915a3c4ce79ae01e1933206f0946b6d1a3389c604dca43e9a8f1aff09d

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Statutes

MD5 7a8f5efbf8da41add6b962c9e8777eb2
SHA1 7392b0be882fce276bd2e6d9f11a65bd4b40d20f
SHA256 3623bb53babe3b1bbd05660303bd7461b7f47b41f0c15a52299e68fb9fca1c97
SHA512 23bd095d1d0cc685d8c6e6de4b4fb8198034d11c32d057cc881b92d6bd11644e2ef693e9045db92862dd3bb0765ce37e0c8661c57c38b0c05824ebf85be58cc8

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cakes

MD5 cc2eec188ce5d432b6678ffdd070e339
SHA1 c4e2702921813c8c4bc1d682690cbd69d631c736
SHA256 fa6c15b3a1d3d3b44b057b1e2bcf5e7f6fb38884c7636727f38695256a2ec196
SHA512 24bb4b2d8fdbabb0e8ef51e30903f219c528b202546559ca8fd74340f474f63894a54eb25f98358868b6cc4b493e689b9b8636ead2bceeaaf0797c8125bb8064

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Import

MD5 754aee9a6b0e592a83e490a8281b6140
SHA1 3d48338535749f86d27c1a8cf584641f59a89ffc
SHA256 bb864004908b9798976c8ee33ce38ecaba734e7aca0255bd86cec9fc3b1ae3c0
SHA512 f14ccb1da85179168c5aebe0136f59939115078bd5238534d22e3e0ab6fa691b57e75f028bcfd944244edd1a55175078f1bdbb66269950923daf0dc72825007c

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bacon

MD5 e9fcd9ec49ee6158e78573430684fa83
SHA1 f08a918b30210b8358f4b7b795f4b040d7da6706
SHA256 7a78faaec0de613d4a4a8d3ecf0f6a3fc94d86e056fa9de9827611dde826f51a
SHA512 13117464a4bbad19d4f14c718a7e73a88d4e2d0cd9fceab5fce10690e2b7d4c59ddf02b3d5b71918fdece40a6d75d218a24d52de136ec153d151d77b442607ef

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Advert

MD5 bc04b8e72559e0478c5668c86d646521
SHA1 17395e2079ecf4043b4b365aa04aa2ff9ce8b9c5
SHA256 e0db448cb9135aaa34289fa8c69c6eedad6cbd7bcf68f3aa749c3746f1009a4a
SHA512 2e90bfe7c9c536d947fc3c7b2c3a25772f8afc55febf701ce65ac5a415a93f5b569ff1551d3900a89b5f8a065dd3b356469e1386ca7f8f1679d57c67c35d8377

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ends

MD5 42c2fa801d3bebb90a2385128440876a
SHA1 58a6c2983762f51cceeff6825d924f6791d59935
SHA256 329380e1c6dec8cdfb58c7023f445d459308048e018042c873073edc6fbde3ed
SHA512 d6dd37f32a8ece5952a3030f3230cc8f684fa116d12ccb153aafae84fa511eabfa4f71e0ad32c4b6f1fa1473f3fc2cb7bb799c3b1c6f615cfe658ac6c71d024e

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Attract

MD5 414b78e87783354a41fdf1fd734aaf2b
SHA1 29b83f974e87625a7398b926e20235cd4760b116
SHA256 f3325a308d60e992f4a69b27644b3994e1b1149bfe3c04ca97a05cb3b23edf72
SHA512 129e56bfdc3dd4e30dbf369b3b323cfc17c91181848ebd00a221dcb76544ad4161c1bab546a35da4f827d63c2da570b85138ed68d30b475959d496043971eda0

\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21543\Chosen.pif

MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

memory/2808-31-0x00000000772A0000-0x0000000077376000-memory.dmp

memory/2808-33-0x0000000000120000-0x0000000000121000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-08 20:14

Reported

2024-02-08 20:17

Platform

win10v2004-20231215-en

Max time kernel

138s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

Raccoon

stealer raccoon

Raccoon Stealer V2 payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4396 created 3488 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif C:\Windows\Explorer.EXE

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4396 set thread context of 4852 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2244 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049.exe C:\Windows\SysWOW64\cmd.exe
PID 3344 wrote to memory of 4868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3344 wrote to memory of 4868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3344 wrote to memory of 4868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3344 wrote to memory of 4956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3344 wrote to memory of 4956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3344 wrote to memory of 4956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3344 wrote to memory of 3432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3344 wrote to memory of 3432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3344 wrote to memory of 3432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3344 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3344 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3344 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3344 wrote to memory of 4936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3344 wrote to memory of 4936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3344 wrote to memory of 4936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3344 wrote to memory of 4472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3344 wrote to memory of 4472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3344 wrote to memory of 4472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3344 wrote to memory of 2948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3344 wrote to memory of 2948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3344 wrote to memory of 2948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3344 wrote to memory of 4396 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif
PID 3344 wrote to memory of 4396 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif
PID 3344 wrote to memory of 4396 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif
PID 3344 wrote to memory of 4372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3344 wrote to memory of 4372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3344 wrote to memory of 4372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4396 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif
PID 4396 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif
PID 4396 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif
PID 4396 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif
PID 4396 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049.exe

"C:\Users\Admin\AppData\Local\Temp\337969e7693e81dd0b076a0aa9e05eb569ac947bb44d02a78d7f16c7693a2049.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k move Outdoor Outdoor.bat & Outdoor.bat & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 21566

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Statutes + Cakes + Import + Bacon + Advert + Ends 21566\Chosen.pif

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Attract 21566\t

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif

21566\Chosen.pif 21566\t

C:\Windows\SysWOW64\PING.EXE

ping -n 5 localhost

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 18.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 ZgNzzPCTqAQVgTYXMxk.ZgNzzPCTqAQVgTYXMxk udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 28.160.77.104.in-addr.arpa udp
RU 195.2.76.141:80 tcp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 201.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Outdoor

MD5 a6576dd8e70ca281dcc4d57003bc96ba
SHA1 6f86590b13c56da8066332d71b427a1ba71e4da8
SHA256 f52360cf001e9c04ccd4df187c5444965b0d84e668e7ba625190e5d946ff472a
SHA512 fe61a1b83320a5be661690b37fec9480a19a540ae805be885a22565b42d06f02f4e91d915a3c4ce79ae01e1933206f0946b6d1a3389c604dca43e9a8f1aff09d

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Statutes

MD5 7a8f5efbf8da41add6b962c9e8777eb2
SHA1 7392b0be882fce276bd2e6d9f11a65bd4b40d20f
SHA256 3623bb53babe3b1bbd05660303bd7461b7f47b41f0c15a52299e68fb9fca1c97
SHA512 23bd095d1d0cc685d8c6e6de4b4fb8198034d11c32d057cc881b92d6bd11644e2ef693e9045db92862dd3bb0765ce37e0c8661c57c38b0c05824ebf85be58cc8

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cakes

MD5 cc2eec188ce5d432b6678ffdd070e339
SHA1 c4e2702921813c8c4bc1d682690cbd69d631c736
SHA256 fa6c15b3a1d3d3b44b057b1e2bcf5e7f6fb38884c7636727f38695256a2ec196
SHA512 24bb4b2d8fdbabb0e8ef51e30903f219c528b202546559ca8fd74340f474f63894a54eb25f98358868b6cc4b493e689b9b8636ead2bceeaaf0797c8125bb8064

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Import

MD5 754aee9a6b0e592a83e490a8281b6140
SHA1 3d48338535749f86d27c1a8cf584641f59a89ffc
SHA256 bb864004908b9798976c8ee33ce38ecaba734e7aca0255bd86cec9fc3b1ae3c0
SHA512 f14ccb1da85179168c5aebe0136f59939115078bd5238534d22e3e0ab6fa691b57e75f028bcfd944244edd1a55175078f1bdbb66269950923daf0dc72825007c

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bacon

MD5 e9fcd9ec49ee6158e78573430684fa83
SHA1 f08a918b30210b8358f4b7b795f4b040d7da6706
SHA256 7a78faaec0de613d4a4a8d3ecf0f6a3fc94d86e056fa9de9827611dde826f51a
SHA512 13117464a4bbad19d4f14c718a7e73a88d4e2d0cd9fceab5fce10690e2b7d4c59ddf02b3d5b71918fdece40a6d75d218a24d52de136ec153d151d77b442607ef

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Advert

MD5 bc04b8e72559e0478c5668c86d646521
SHA1 17395e2079ecf4043b4b365aa04aa2ff9ce8b9c5
SHA256 e0db448cb9135aaa34289fa8c69c6eedad6cbd7bcf68f3aa749c3746f1009a4a
SHA512 2e90bfe7c9c536d947fc3c7b2c3a25772f8afc55febf701ce65ac5a415a93f5b569ff1551d3900a89b5f8a065dd3b356469e1386ca7f8f1679d57c67c35d8377

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ends

MD5 42c2fa801d3bebb90a2385128440876a
SHA1 58a6c2983762f51cceeff6825d924f6791d59935
SHA256 329380e1c6dec8cdfb58c7023f445d459308048e018042c873073edc6fbde3ed
SHA512 d6dd37f32a8ece5952a3030f3230cc8f684fa116d12ccb153aafae84fa511eabfa4f71e0ad32c4b6f1fa1473f3fc2cb7bb799c3b1c6f615cfe658ac6c71d024e

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Attract

MD5 414b78e87783354a41fdf1fd734aaf2b
SHA1 29b83f974e87625a7398b926e20235cd4760b116
SHA256 f3325a308d60e992f4a69b27644b3994e1b1149bfe3c04ca97a05cb3b23edf72
SHA512 129e56bfdc3dd4e30dbf369b3b323cfc17c91181848ebd00a221dcb76544ad4161c1bab546a35da4f827d63c2da570b85138ed68d30b475959d496043971eda0

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif

MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

memory/4396-30-0x0000000077D41000-0x0000000077E61000-memory.dmp

memory/4396-32-0x0000000003D10000-0x0000000003D11000-memory.dmp

memory/4852-33-0x0000000000400000-0x0000000000416000-memory.dmp

memory/4852-34-0x0000000000400000-0x0000000000416000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21566\Chosen.pif

MD5 b198399fc01256586dc2994d4d3f7368
SHA1 7b8f30d0dbcf29af9013809660f7511d3a7c7077
SHA256 4e7397ea278284c700a290542ec0a6d84418ce28acf3e85abe4e04b00bb9741d
SHA512 18621283cf2a5e17d4f243249e8bda005a1c98f3f92e9a123f2216855f3e805c291c9d61cc205acc36a9840ef60e1117b00649d00a8655ff8ad0704e22acc685

memory/4852-36-0x0000000000400000-0x0000000000416000-memory.dmp