Malware Analysis Report

2025-01-22 14:17

Sample ID 240223-2qx5tsbf41
Target a0892d0ee09eb36fba025875b72142fc
SHA256 e792f30b9a672d0542bb3c9983023938066ef1b2c40a3d01a73f15eeae5a87d6
Tags
warzonerat infostealer persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e792f30b9a672d0542bb3c9983023938066ef1b2c40a3d01a73f15eeae5a87d6

Threat Level: Known bad

The file a0892d0ee09eb36fba025875b72142fc was found to be: Known bad.

Malicious Activity Summary

warzonerat infostealer persistence rat trojan

Detects BazaLoader malware

WarzoneRat, AveMaria

Warzone RAT payload

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of UnmapMainImage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-23 22:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-23 22:47

Reported

2024-02-23 22:50

Platform

win7-20240221-en

Max time kernel

150s

Max time network

145s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detects BazaLoader malware

trojan
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

WarzoneRat, AveMaria

rat infostealer warzonerat

Warzone RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Jx0xmvJP73dMynI3 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\07734757\\gscpu.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\07734757\\AMFHDT~1.DNL" C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2684 set thread context of 2440 N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2936 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\a0892d0ee09eb36fba025875b72142fc.exe C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif
PID 2936 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\a0892d0ee09eb36fba025875b72142fc.exe C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif
PID 2936 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\a0892d0ee09eb36fba025875b72142fc.exe C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif
PID 2936 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\a0892d0ee09eb36fba025875b72142fc.exe C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif
PID 2684 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 2684 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 2684 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 2684 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 2684 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 2684 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 2684 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 2684 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 2684 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 2440 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe C:\Windows\Explorer.EXE
PID 2440 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\a0892d0ee09eb36fba025875b72142fc.exe

"C:\Users\Admin\AppData\Local\Temp\a0892d0ee09eb36fba025875b72142fc.exe"

C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif

"C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif" amfhdtooq.dnl

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"

Network

Country Destination Domain Proto
BR 45.162.228.171:26112 tcp
BR 45.162.228.171:26112 tcp
BR 45.162.228.171:26112 tcp
BR 45.162.228.171:26112 tcp
BR 45.162.228.171:26112 tcp

Files

\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif

MD5 9736d137a50072cafb00ea5c03798da2
SHA1 21bd4affbe0a61af9a5bdc5cb7fa19eac92e52c0
SHA256 624690a68085948a842e9f78c37001e9541c3d996d7ce8758f296b4e6b011540
SHA512 cf7dbf2f762c660d9802ac3935b61217c7917e85d1ca247dfd4aa50c16a3f314fcf474cd3cc824c6ee1f4c9ba891f65651d96dfbf44532e340ad105b2eac0c28

\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif

MD5 baca0a94c18340007c100ffa9967f1db
SHA1 08c3a4d4508e9dafa28e2fe3854d6f61cb7fcf41
SHA256 36a0be6f392a6d8daebfa88e22f71a50e857f76d0b2d95cd1a33079035f029b1
SHA512 4743bc4c8c641b2f2b318eb78b1d2a6303187fe46b1f83c364f596aac5e82ae285d16c6d676c3c7ae247598a65b91352a9858a14d23e639a0639df43c8371e58

\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif

MD5 95ccfe5a00941f01efbafaa544b8a5f4
SHA1 eb85244d2d667f036dd376bb4e77ec83c192788a
SHA256 c4f6862ac28608529191c1874af429738ba797922019e912d999179a9a51dc10
SHA512 af145bde6634a2c9c28a6c72e0f7cce3f82febd839955ff3c2fb02ef52db6411ec6276ab178e79cb9f757b89d7005fb6afb037fe493a45c6573c16b8cd7f0808

C:\Users\Admin\AppData\Local\Temp\07734757\amfhdtooq.dnl

MD5 0d0bbda344747dcd268f6d6eb925b752
SHA1 85f444cfacabc6369171d3bcf5522ce9f7192fd4
SHA256 0b18713e7b66431a3ef70f631459581323c18a7bad05ac325a9168a1066d9993
SHA512 bbf37ee93b537960afefe2d2efddd345cd5c1e9cb8b7db75aedb9524d24a98409ca5f9df8f6d6b66dbe04c8b346f4d26c3e40cecd270a0a177c9de7da9ece5ed

C:\Users\Admin\AppData\Local\Temp\07734757\etchnlln.ppt

MD5 702e556a2cba1dbc2825892003608a9d
SHA1 b955ba92aa0a8822294d465b8a0d2327cc92dfc1
SHA256 e109c9b0822aaff93b99e92e0941daafe3a7c8f17d5e5f9c049a15753e4fef6f
SHA512 d9ffb34f31bd32852e4c796f7f50cfb2ab5897ee1a9e36c6e32512bb6376407a66297465f4f9be6416372f6de5425a6f02dea7d25161e78275a418d13274cdb3

\Users\Admin\AppData\Local\Temp\RegSvcs.exe

MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

memory/2440-61-0x00000000003B0000-0x0000000000992000-memory.dmp

memory/2440-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2440-63-0x00000000003B0000-0x0000000000992000-memory.dmp

memory/2440-66-0x00000000003B0000-0x0000000000992000-memory.dmp

memory/2440-67-0x00000000003B0000-0x0000000000992000-memory.dmp

memory/2440-69-0x00000000003B0000-0x0000000000992000-memory.dmp

memory/1296-70-0x0000000006380000-0x0000000006480000-memory.dmp

memory/1296-71-0x0000000006380000-0x0000000006480000-memory.dmp

memory/1296-72-0x0000000002B60000-0x0000000002B66000-memory.dmp

memory/1296-79-0x0000000077BA1000-0x0000000077BA2000-memory.dmp

memory/1296-78-0x0000000002B60000-0x0000000002B66000-memory.dmp

memory/2440-80-0x00000000003B0000-0x0000000000992000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-23 22:47

Reported

2024-02-23 22:50

Platform

win10v2004-20240221-en

Max time kernel

149s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a0892d0ee09eb36fba025875b72142fc.exe"

Signatures

Detects BazaLoader malware

trojan
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

WarzoneRat, AveMaria

rat infostealer warzonerat

Warzone RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a0892d0ee09eb36fba025875b72142fc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Jx0xmvJP73dMynI3 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\07734757\\gscpu.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\07734757\\AMFHDT~1.DNL" C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3056 set thread context of 5696 N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a0892d0ee09eb36fba025875b72142fc.exe

"C:\Users\Admin\AppData\Local\Temp\a0892d0ee09eb36fba025875b72142fc.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif

"C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif" amfhdtooq.dnl

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 195.233.44.23.in-addr.arpa udp
BR 45.162.228.171:26112 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 105.135.221.88.in-addr.arpa udp
BR 45.162.228.171:26112 tcp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
BR 45.162.228.171:26112 tcp
BR 45.162.228.171:26112 tcp
BR 45.162.228.171:26112 tcp

Files

C:\Users\Admin\AppData\Local\Temp\07734757\gscpu.pif

MD5 9736d137a50072cafb00ea5c03798da2
SHA1 21bd4affbe0a61af9a5bdc5cb7fa19eac92e52c0
SHA256 624690a68085948a842e9f78c37001e9541c3d996d7ce8758f296b4e6b011540
SHA512 cf7dbf2f762c660d9802ac3935b61217c7917e85d1ca247dfd4aa50c16a3f314fcf474cd3cc824c6ee1f4c9ba891f65651d96dfbf44532e340ad105b2eac0c28

C:\Users\Admin\AppData\Local\Temp\07734757\amfhdtooq.dnl

MD5 d382faa34abd5ccb3ccdf0850669cbb6
SHA1 f4552118e174bdaa3d55764e539beec884705496
SHA256 b82a26d0c4a9e0d91eee754d4c59f187265d73fb5927db92e9a935b05d00ea74
SHA512 61e00a6869c3b020955805419438b1c960097fe0d5ee8402438608603a9dff035c61a58f89af37ea7404e881eff3625e9b96d2c995ec14fb2feaefe406a402fe

C:\Users\Admin\AppData\Local\Temp\07734757\etchnlln.ppt

MD5 702e556a2cba1dbc2825892003608a9d
SHA1 b955ba92aa0a8822294d465b8a0d2327cc92dfc1
SHA256 e109c9b0822aaff93b99e92e0941daafe3a7c8f17d5e5f9c049a15753e4fef6f
SHA512 d9ffb34f31bd32852e4c796f7f50cfb2ab5897ee1a9e36c6e32512bb6376407a66297465f4f9be6416372f6de5425a6f02dea7d25161e78275a418d13274cdb3

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

memory/5696-53-0x0000000000A00000-0x0000000001149000-memory.dmp

memory/5696-50-0x0000000000A00000-0x0000000001149000-memory.dmp

memory/5696-54-0x0000000000A00000-0x0000000001149000-memory.dmp

memory/3460-57-0x0000000007910000-0x0000000007A10000-memory.dmp

memory/5696-56-0x0000000000A00000-0x0000000001149000-memory.dmp

memory/3460-65-0x0000000003010000-0x0000000003016000-memory.dmp

memory/3460-59-0x0000000003010000-0x0000000003016000-memory.dmp

memory/3460-68-0x00007FF93A3A0000-0x00007FF93A3B0000-memory.dmp

memory/3460-67-0x0000000003040000-0x0000000003041000-memory.dmp

memory/3460-66-0x00007FF8BA3CD000-0x00007FF8BA3CE000-memory.dmp

memory/3460-58-0x0000000007910000-0x0000000007A10000-memory.dmp

memory/5696-69-0x0000000000A00000-0x0000000001149000-memory.dmp