Malware Analysis Report

2024-11-13 13:55

Sample ID 240228-b72lgagd93
Target e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc
SHA256 e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc
Tags
ducktail
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc

Threat Level: Known bad

The file e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc was found to be: Known bad.

Malicious Activity Summary

ducktail

Detect Ducktail Third Stage Payload

Ducktail family

Loads dropped DLL

Checks computer location settings

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-28 01:48

Signatures

Detect Ducktail Third Stage Payload

Description Indicator Process Target
N/A N/A N/A N/A

Ducktail family

ducktail

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-28 01:47

Reported

2024-02-28 01:51

Platform

win7-20240221-en

Max time kernel

151s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe

"C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe"

Network

Country Destination Domain Proto
US 154.12.235.50:1516 154.12.235.50 tcp
US 154.12.235.50:1517 154.12.235.50 tcp

Files

\Users\Admin\AppData\Local\Temp\.net\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc\sqvgNfBSELMWQALuqeKShgkshhFO5Us=\coreclr.dll

MD5 28eb36702cbb0258f749ec78b37d5d8e
SHA1 420e464b779eb73fe65e4ce77e6a5d95bff894ed
SHA256 6884784e25299747f5c2e2ab52cdd45872058b548fa9d3555bb501336a26530c
SHA512 b62541fe82c1772358686eeebd110ca5387878cfaa876bb07a15dba7e97d2ef1cd8ae663c670cc7d9d0e39bdcd80041e078fb05ea4dc4a893d83b30dd65654b9

memory/1212-12-0x000006448A000000-0x000006448A8F5000-memory.dmp

memory/1212-15-0x000007FEF62D0000-0x000007FEF67DF000-memory.dmp

\Users\Admin\AppData\Local\Temp\.net\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc\sqvgNfBSELMWQALuqeKShgkshhFO5Us=\clrjit.dll

MD5 b2eb7b51bd58201cf498e83846e90110
SHA1 ca439759b5c5162e626d2b84ab55b93adc552e06
SHA256 180557694842854789457a872df849b2130098a9c2bfd70d201f77bec6f9fddb
SHA512 1a92064b3417b287246fadd88fea9138dfcc659283e063aab9305e424feac0d1b2c216be5f65ce7a95f0322ab3849478892ae407399aa6029a504c4c8a5884da

memory/1212-18-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-20-0x00000000003B0000-0x00000000003BA000-memory.dmp

memory/1212-22-0x0000000001D50000-0x0000000001D6B000-memory.dmp

memory/1212-25-0x00000000021F0000-0x0000000002233000-memory.dmp

memory/1212-28-0x00000000003A0000-0x00000000003B0000-memory.dmp

memory/1212-31-0x0000000002770000-0x00000000027B6000-memory.dmp

memory/1212-34-0x00000000003C0000-0x00000000003C8000-memory.dmp

memory/1212-37-0x0000000000680000-0x000000000068C000-memory.dmp

memory/1212-40-0x00000000027C0000-0x00000000027ED000-memory.dmp

memory/1212-43-0x00000000036E0000-0x0000000003795000-memory.dmp

memory/1212-46-0x0000000000660000-0x0000000000679000-memory.dmp

memory/1212-49-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-51-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-50-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-52-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-56-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-57-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-55-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-54-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-53-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-58-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-60-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-59-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-64-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-65-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-66-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-63-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-62-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-61-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-68-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-69-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-70-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-71-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-67-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-73-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-72-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-76-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-77-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-75-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-74-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-78-0x0000000003200000-0x00000000036DE000-memory.dmp

memory/1212-1645-0x000007FEF62D0000-0x000007FEF67DF000-memory.dmp

memory/1212-2822-0x0000000000690000-0x0000000000691000-memory.dmp

\Users\Admin\AppData\Local\Temp\.net\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc\sqvgNfBSELMWQALuqeKShgkshhFO5Us=\clrcompression.dll

MD5 2796467ae763a705b2ef39ea66647716
SHA1 d83c3b872d5834e8c8bb2b7b5ed7f7858efc7d7d
SHA256 b0ee0e2f69a772001e65830ef106db8563943e69a5684fddd4a9135b3fec0760
SHA512 06302947e2681018a0e66efcaa73052ea24c488e228d2775273f6c32efbcb8758c0ada3e60afcce3dcb2e5cd0e3b817d878b91150dca44d644611624dfb4001a

memory/1212-2912-0x0000000005A60000-0x0000000005AE0000-memory.dmp

memory/1212-2978-0x0000000005A60000-0x0000000005AE0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-28 01:47

Reported

2024-02-28 01:51

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe

"C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 154.12.235.50:1516 154.12.235.50 tcp
US 154.12.235.50:1517 154.12.235.50 tcp
US 8.8.8.8:53 50.235.12.154.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 91.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\.net\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc\sqvgNfBSELMWQALuqeKShgkshhFO5Us=\coreclr.dll

MD5 1c434dc8cb09095640c776385ba69691
SHA1 97fe8e25bebfb7d790768175a4625d07f3d4abfd
SHA256 3b3558c408c57be332c9595624f6d49413fe0dd43d3d5fa4626041851f77216a
SHA512 4bdb7c0e8571422927fbc8eec6d05959915748acce035fef336b32381922a0a54f029f959fb66cb96a89a024c11e2b94ee6948f618dd04d9ae87cc83f3f83ec8

memory/4724-12-0x000006448A000000-0x000006448A8F5000-memory.dmp

memory/4724-17-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-18-0x00007FF9FAEF0000-0x00007FF9FB3FF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\.net\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc\sqvgNfBSELMWQALuqeKShgkshhFO5Us=\clrjit.dll

MD5 b2eb7b51bd58201cf498e83846e90110
SHA1 ca439759b5c5162e626d2b84ab55b93adc552e06
SHA256 180557694842854789457a872df849b2130098a9c2bfd70d201f77bec6f9fddb
SHA512 1a92064b3417b287246fadd88fea9138dfcc659283e063aab9305e424feac0d1b2c216be5f65ce7a95f0322ab3849478892ae407399aa6029a504c4c8a5884da

memory/4724-20-0x000001AA317F0000-0x000001AA317FA000-memory.dmp

memory/4724-22-0x000001AA31830000-0x000001AA3184B000-memory.dmp

memory/4724-25-0x000001AA51D90000-0x000001AA51DD3000-memory.dmp

memory/4724-28-0x000001AA317E0000-0x000001AA317F0000-memory.dmp

memory/4724-31-0x000001AA51D40000-0x000001AA51D86000-memory.dmp

memory/4724-34-0x000001AA31820000-0x000001AA31828000-memory.dmp

memory/4724-37-0x000001AA31860000-0x000001AA3186C000-memory.dmp

memory/4724-40-0x000001AA53BF0000-0x000001AA53C1D000-memory.dmp

memory/4724-43-0x000001AA53CE0000-0x000001AA53D95000-memory.dmp

memory/4724-46-0x000001AA31800000-0x000001AA31819000-memory.dmp

memory/4724-50-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-51-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-52-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-53-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-54-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-49-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-55-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-56-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-57-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-58-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-59-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-60-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-62-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-61-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-63-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-64-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-65-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-67-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-66-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-69-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-68-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-70-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-72-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-71-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-73-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-74-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-75-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-76-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-78-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-77-0x0000000000400000-0x00000000008DE000-memory.dmp

memory/4724-2005-0x00007FF9FAEF0000-0x00007FF9FB3FF000-memory.dmp

memory/4724-2830-0x000001AA315B0000-0x000001AA315B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\.net\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc\sqvgNfBSELMWQALuqeKShgkshhFO5Us=\clrcompression.dll

MD5 2796467ae763a705b2ef39ea66647716
SHA1 d83c3b872d5834e8c8bb2b7b5ed7f7858efc7d7d
SHA256 b0ee0e2f69a772001e65830ef106db8563943e69a5684fddd4a9135b3fec0760
SHA512 06302947e2681018a0e66efcaa73052ea24c488e228d2775273f6c32efbcb8758c0ada3e60afcce3dcb2e5cd0e3b817d878b91150dca44d644611624dfb4001a

memory/4724-2912-0x000001AA55E20000-0x000001AA55E30000-memory.dmp

memory/4724-2975-0x000001AA55E20000-0x000001AA55E30000-memory.dmp