Malware Analysis Report

2025-01-02 11:11

Sample ID 240307-fmk57sfe7z
Target a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008
SHA256 a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008
Tags
amadey glupteba smokeloader pub1 backdoor dropper evasion loader persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008

Threat Level: Known bad

The file a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008 was found to be: Known bad.

Malicious Activity Summary

amadey glupteba smokeloader pub1 backdoor dropper evasion loader persistence trojan upx

Amadey

Glupteba payload

Pitou

SmokeLoader

Glupteba

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Creates new service(s)

Stops running service(s)

Deletes itself

UPX packed file

Loads dropped DLL

Checks BIOS information in registry

Executes dropped EXE

Identifies Wine through registry keys

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Drops file in Windows directory

Launches sc.exe

Enumerates physical storage devices

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Uses Task Scheduler COM API

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-07 04:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-07 04:59

Reported

2024-03-07 05:04

Platform

win7-20240220-en

Max time kernel

32s

Max time network

301s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe"

Signatures

Amadey

trojan amadey

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Pitou

Description Indicator Process Target
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\5FDC.exe N/A

Creates new service(s)

persistence

Downloads MZ/PE file

Stops running service(s)

evasion

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\5FDC.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\5FDC.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A N/A N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\5FDC.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6588.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6588.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5FDC.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2820 set thread context of 1336 N/A C:\Users\Admin\AppData\Local\Temp\6588.exe C:\Users\Admin\AppData\Local\Temp\6588.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorgu.job C:\Users\Admin\AppData\Local\Temp\5FDC.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5FDC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1200 wrote to memory of 2560 N/A N/A C:\Users\Admin\AppData\Local\Temp\5FDC.exe
PID 1200 wrote to memory of 2560 N/A N/A C:\Users\Admin\AppData\Local\Temp\5FDC.exe
PID 1200 wrote to memory of 2560 N/A N/A C:\Users\Admin\AppData\Local\Temp\5FDC.exe
PID 1200 wrote to memory of 2560 N/A N/A C:\Users\Admin\AppData\Local\Temp\5FDC.exe
PID 1200 wrote to memory of 2820 N/A N/A C:\Users\Admin\AppData\Local\Temp\6588.exe
PID 1200 wrote to memory of 2820 N/A N/A C:\Users\Admin\AppData\Local\Temp\6588.exe
PID 1200 wrote to memory of 2820 N/A N/A C:\Users\Admin\AppData\Local\Temp\6588.exe
PID 1200 wrote to memory of 2820 N/A N/A C:\Users\Admin\AppData\Local\Temp\6588.exe
PID 1200 wrote to memory of 1276 N/A N/A C:\Windows\system32\regsvr32.exe
PID 1200 wrote to memory of 1276 N/A N/A C:\Windows\system32\regsvr32.exe
PID 1200 wrote to memory of 1276 N/A N/A C:\Windows\system32\regsvr32.exe
PID 1200 wrote to memory of 1276 N/A N/A C:\Windows\system32\regsvr32.exe
PID 1200 wrote to memory of 1276 N/A N/A C:\Windows\system32\regsvr32.exe
PID 1276 wrote to memory of 1436 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1276 wrote to memory of 1436 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1276 wrote to memory of 1436 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1276 wrote to memory of 1436 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1276 wrote to memory of 1436 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1276 wrote to memory of 1436 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1276 wrote to memory of 1436 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2820 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\6588.exe C:\Users\Admin\AppData\Local\Temp\6588.exe
PID 2820 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\6588.exe C:\Users\Admin\AppData\Local\Temp\6588.exe
PID 2820 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\6588.exe C:\Users\Admin\AppData\Local\Temp\6588.exe
PID 2820 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\6588.exe C:\Users\Admin\AppData\Local\Temp\6588.exe
PID 2820 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\6588.exe C:\Users\Admin\AppData\Local\Temp\6588.exe
PID 2820 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\6588.exe C:\Users\Admin\AppData\Local\Temp\6588.exe
PID 2820 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\6588.exe C:\Users\Admin\AppData\Local\Temp\6588.exe
PID 2820 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\6588.exe C:\Users\Admin\AppData\Local\Temp\6588.exe
PID 2820 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\6588.exe C:\Users\Admin\AppData\Local\Temp\6588.exe
PID 1200 wrote to memory of 2188 N/A N/A C:\Users\Admin\AppData\Local\Temp\7F50.exe
PID 1200 wrote to memory of 2188 N/A N/A C:\Users\Admin\AppData\Local\Temp\7F50.exe
PID 1200 wrote to memory of 2188 N/A N/A C:\Users\Admin\AppData\Local\Temp\7F50.exe
PID 1200 wrote to memory of 2188 N/A N/A C:\Users\Admin\AppData\Local\Temp\7F50.exe
PID 1200 wrote to memory of 2188 N/A N/A C:\Users\Admin\AppData\Local\Temp\7F50.exe
PID 1200 wrote to memory of 2188 N/A N/A C:\Users\Admin\AppData\Local\Temp\7F50.exe
PID 1200 wrote to memory of 2188 N/A N/A C:\Users\Admin\AppData\Local\Temp\7F50.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe

"C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe"

C:\Users\Admin\AppData\Local\Temp\5FDC.exe

C:\Users\Admin\AppData\Local\Temp\5FDC.exe

C:\Users\Admin\AppData\Local\Temp\6588.exe

C:\Users\Admin\AppData\Local\Temp\6588.exe

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6C9A.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\6C9A.dll

C:\Users\Admin\AppData\Local\Temp\6588.exe

C:\Users\Admin\AppData\Local\Temp\6588.exe

C:\Users\Admin\AppData\Local\Temp\7F50.exe

C:\Users\Admin\AppData\Local\Temp\7F50.exe

C:\Windows\system32\taskeng.exe

taskeng.exe {53D2B6D3-FF82-46CA-A250-31223687E70D} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\8A1B.exe

C:\Users\Admin\AppData\Local\Temp\8A1B.exe

C:\Users\Admin\AppData\Roaming\gjhfsce

C:\Users\Admin\AppData\Roaming\gjhfsce

C:\Users\Admin\AppData\Local\Temp\A182.exe

C:\Users\Admin\AppData\Local\Temp\A182.exe

C:\Users\Admin\AppData\Local\Temp\C7F7.exe

C:\Users\Admin\AppData\Local\Temp\C7F7.exe

C:\Users\Admin\AppData\Local\Temp\CECB.exe

C:\Users\Admin\AppData\Local\Temp\CECB.exe

C:\Users\Admin\AppData\Local\Temp\EFD3.exe

C:\Users\Admin\AppData\Local\Temp\EFD3.exe

C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"

C:\Users\Admin\AppData\Local\Temp\FourthX.exe

"C:\Users\Admin\AppData\Local\Temp\FourthX.exe"

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"

C:\Users\Admin\AppData\Local\Temp\u10w.0.exe

"C:\Users\Admin\AppData\Local\Temp\u10w.0.exe"

C:\Users\Admin\AppData\Local\Temp\u10w.1.exe

"C:\Users\Admin\AppData\Local\Temp\u10w.1.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 1251

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "UTIXDCVF"

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "UTIXDCVF" binpath= "C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "UTIXDCVF"

C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe

C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\makecab.exe

"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240307050240.log C:\Windows\Logs\CBS\CbsPersist_20240307050240.cab

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 selebration17io.io udp
RU 91.215.85.120:80 selebration17io.io tcp
RU 185.215.113.45:80 185.215.113.45 tcp
US 8.8.8.8:53 trmpc.com udp
PE 190.12.87.61:80 trmpc.com tcp
US 8.8.8.8:53 nixen.bestsup.su udp
US 172.67.171.112:80 nixen.bestsup.su tcp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 kamsmad.com udp
KR 123.213.233.131:80 kamsmad.com tcp
KR 123.213.233.131:80 kamsmad.com tcp
KR 123.213.233.131:80 kamsmad.com tcp
KR 123.213.233.131:80 kamsmad.com tcp
KR 123.213.233.131:80 kamsmad.com tcp
DE 185.172.128.90:80 185.172.128.90 tcp
DE 185.172.128.187:80 185.172.128.187 tcp
KR 123.213.233.131:80 kamsmad.com tcp
DE 185.172.128.187:80 185.172.128.187 tcp
KR 123.213.233.131:80 kamsmad.com tcp
DE 185.172.128.126:80 185.172.128.126 tcp
KR 123.213.233.131:80 kamsmad.com tcp
KR 123.213.233.131:80 kamsmad.com tcp
KR 123.213.233.131:80 kamsmad.com tcp
DE 185.172.128.145:80 185.172.128.145 tcp
CA 198.100.149.77:443 tcp
FR 178.20.55.16:443 tcp
JP 153.126.128.94:9001 tcp
CH 85.195.244.251:28123 tcp
DE 148.251.83.53:8443 tcp
DE 148.251.83.53:8443 tcp
CH 85.195.244.251:28123 tcp
FI 88.114.24.253:110 tcp
US 8.8.8.8:53 tancredsolutions.com udp
US 8.8.8.8:53 geleeroyalemedien.de udp
US 8.8.8.8:53 cintex.net udp
US 8.8.8.8:53 tancredsolutions.com udp
US 8.8.8.8:53 cintex.net udp
US 8.8.8.8:53 tancredsolutions.com udp
US 8.8.8.8:53 geleeroyalemedien.de udp
US 8.8.8.8:53 geleeroyalemedien.de udp
US 8.8.8.8:53 kramercontracting.com udp
US 8.8.8.8:53 localwebpromote.com udp
US 8.8.8.8:53 localwebpromote.com udp
US 8.8.8.8:53 kramercontracting.com udp
US 8.8.8.8:53 carriereantonio.191.es udp
US 8.8.8.8:53 futuretechnology.com.sa udp
US 8.8.8.8:53 happycrafts.com udp
US 8.8.8.8:53 minttransportationltd.com udp
US 8.8.8.8:53 boycemail.com udp
US 8.8.8.8:53 smtp-backup2.portunity.de udp
DE 134.119.20.162:443 geleeroyalemedien.de tcp
US 8.8.8.8:53 carriereantonio.191.es udp
US 8.8.8.8:53 bechtold.net udp
US 8.8.8.8:53 futuretechnology.com.sa udp
US 8.8.8.8:53 blancomail.com udp
US 8.8.8.8:53 localwebpromote-com.mail.protection.outlook.com udp
US 8.8.8.8:53 happycrafts.com udp
US 8.8.8.8:53 minttransportationltd.com udp
US 8.8.8.8:53 boycemail.com udp
US 8.8.8.8:53 happycrafts.com udp
US 8.8.8.8:53 bechtold.net udp
US 8.8.8.8:53 blancomail.com udp
US 8.8.8.8:53 mx1-us1.ppe-hosted.com udp
US 8.8.8.8:53 students.rsd7.net udp
US 8.8.8.8:53 students.rsd7.net udp
US 13.248.169.48:21 cintex.net tcp
DE 37.120.186.72:143 smtp-backup2.portunity.de tcp
US 3.33.130.190:21 boycemail.com tcp
US 199.34.228.65:443 kramercontracting.com tcp
US 107.180.3.58:21 futuretechnology.com.sa tcp
DE 134.119.20.162:80 geleeroyalemedien.de tcp
US 3.130.253.23:21 happycrafts.com tcp
US 13.248.169.48:995 cintex.net tcp
US 54.209.32.212:22 happycrafts.com tcp
US 148.163.129.50:143 mx1-us1.ppe-hosted.com tcp
DE 37.120.186.72:995 smtp-backup2.portunity.de tcp
US 3.33.130.190:80 boycemail.com tcp
US 54.209.32.212:443 happycrafts.com tcp
US 3.33.130.190:22 boycemail.com tcp
US 3.33.130.190:21 boycemail.com tcp
CA 216.40.34.37:22 blancomail.com tcp
US 216.239.38.21:22 bechtold.net tcp
US 199.34.228.65:21 kramercontracting.com tcp
US 3.33.130.190:443 boycemail.com tcp
US 199.34.228.65:22 kramercontracting.com tcp
US 107.180.3.58:22 futuretechnology.com.sa tcp
US 76.223.54.146:21 cintex.net tcp
US 13.248.169.48:143 cintex.net tcp
DE 37.120.186.72:465 smtp-backup2.portunity.de tcp
US 13.248.169.48:80 cintex.net tcp
US 13.248.169.48:465 cintex.net tcp
US 107.180.3.58:443 futuretechnology.com.sa tcp
US 15.197.148.33:21 boycemail.com tcp
US 3.33.130.190:443 boycemail.com tcp
US 216.239.38.21:21 bechtold.net tcp
US 8.8.8.8:53 36jdc.com udp
US 8.8.8.8:53 armadahotel.com udp
US 8.8.8.8:53 futuretechnology-com-sa.mail.protection.outlook.com udp
US 8.8.8.8:53 36jdc.com udp
US 76.223.54.146:143 cintex.net tcp
US 76.223.54.146:465 cintex.net tcp
US 148.163.129.50:465 mx1-us1.ppe-hosted.com tcp
US 52.71.57.184:22 happycrafts.com tcp
US 3.130.204.160:21 happycrafts.com tcp
US 76.223.54.146:995 cintex.net tcp
US 15.197.148.33:22 boycemail.com tcp
US 8.8.8.8:53 harman.fr udp
US 52.71.57.184:443 happycrafts.com tcp
US 15.197.148.33:21 boycemail.com tcp
US 8.8.8.8:53 jcwco.com udp
US 8.8.8.8:53 aspmx.l.google.com udp
US 67.231.154.162:143 mx1-us1.ppe-hosted.com tcp
US 8.8.8.8:53 www.kramercontracting.com udp
US 8.8.8.8:53 armadahotel.com udp
US 216.239.38.21:443 bechtold.net tcp
US 8.8.8.8:53 harman.fr udp
US 8.8.8.8:53 mailstore1.secureserver.net udp
CA 216.40.34.37:443 blancomail.com tcp
US 148.163.129.50:995 mx1-us1.ppe-hosted.com tcp
US 199.34.228.65:80 www.kramercontracting.com tcp
CA 216.40.34.37:21 blancomail.com tcp
US 216.239.36.21:22 bechtold.net tcp
US 107.180.3.58:80 futuretechnology.com.sa tcp
NL 52.101.73.22:143 futuretechnology-com-sa.mail.protection.outlook.com tcp
US 216.239.36.21:21 bechtold.net tcp
US 8.8.8.8:53 mx.netidentity.com.cust.hostedemail.com udp
US 8.8.8.8:53 mx.netidentity.com.cust.hostedemail.com udp
US 198.49.23.144:22 36jdc.com tcp
US 8.8.8.8:53 carsik.com udp
US 8.8.8.8:53 students-rsd7-net.mail.protection.outlook.com udp
US 8.8.8.8:53 jcwco.com udp
IE 52.101.68.18:143 futuretechnology-com-sa.mail.protection.outlook.com tcp
US 67.231.154.162:995 mx1-us1.ppe-hosted.com tcp
US 54.209.32.212:465 happycrafts.com tcp
NL 52.101.73.22:995 futuretechnology-com-sa.mail.protection.outlook.com tcp
NL 52.101.73.22:465 futuretechnology-com-sa.mail.protection.outlook.com tcp
US 54.209.32.212:143 happycrafts.com tcp
US 54.209.32.212:80 happycrafts.com tcp
IE 74.125.193.27:143 aspmx.l.google.com tcp
IE 54.171.136.173:22 armadahotel.com tcp
US 3.33.130.190:443 boycemail.com tcp
US 198.49.23.144:21 36jdc.com tcp
US 198.49.23.144:443 36jdc.com tcp
FR 212.157.149.8:22 harman.fr tcp
US 13.248.169.48:443 cintex.net tcp
CA 216.40.34.37:80 blancomail.com tcp
US 8.8.8.8:53 www.bechtold.net udp
US 8.8.8.8:53 spamtitan.tierneys.ie udp
US 8.8.8.8:53 carsik.com udp
US 8.8.8.8:53 36jdc-com.mail.protection.outlook.com udp
US 52.71.57.184:465 happycrafts.com tcp
IE 54.171.136.173:21 armadahotel.com tcp
DE 134.119.20.162:80 geleeroyalemedien.de tcp
FR 92.204.80.3:143 mailstore1.secureserver.net tcp
US 13.248.169.48:21 cintex.net tcp
US 162.159.135.42:22 jcwco.com tcp
CA 216.40.42.4:995 mx.netidentity.com.cust.hostedemail.com tcp
CA 216.40.34.37:80 blancomail.com tcp
US 8.8.8.8:53 mmod.com udp
US 199.34.228.65:22 www.kramercontracting.com tcp
US 52.101.8.34:143 students-rsd7-net.mail.protection.outlook.com tcp
US 3.33.130.190:80 boycemail.com tcp
US 3.33.130.190:21 boycemail.com tcp
IE 52.215.232.25:143 spamtitan.tierneys.ie tcp
US 162.159.135.42:21 jcwco.com tcp
US 52.101.8.34:995 students-rsd7-net.mail.protection.outlook.com tcp
US 216.239.38.21:80 bechtold.net tcp
IE 74.125.193.27:995 aspmx.l.google.com tcp
US 52.101.8.34:465 students-rsd7-net.mail.protection.outlook.com tcp
US 3.33.130.190:80 boycemail.com tcp
DE 37.120.186.72:143 smtp-backup2.portunity.de tcp
IE 54.171.136.173:443 armadahotel.com tcp
US 104.47.66.10:143 36jdc-com.mail.protection.outlook.com tcp
US 76.223.54.146:21 cintex.net tcp
FR 92.204.80.3:465 mailstore1.secureserver.net tcp
US 3.33.130.190:80 boycemail.com tcp
US 199.34.228.65:21 www.kramercontracting.com tcp
FR 212.157.149.8:21 harman.fr tcp
US 13.248.169.48:143 cintex.net tcp
US 15.197.148.33:21 boycemail.com tcp
US 8.8.8.8:53 rambler.ruinbox.ru udp
US 8.8.8.8:53 aldakika.com udp
US 8.8.8.8:53 ip218-74.baltnet.ru udp
US 8.8.8.8:53 sdsds.es udp
US 8.8.8.8:53 mmod.com udp
US 8.8.8.8:53 rambler.ruinbox.ru udp
US 8.8.8.8:53 mx-02-us-west-2.prod.hydra.sophos.com udp
US 8.8.8.8:53 mmod.com udp
US 8.8.8.8:53 aldakika.com udp
US 8.8.8.8:53 www.hugedomains.com udp
US 8.8.8.8:53 mx.mail-data.net udp
US 8.8.8.8:53 ip218-74.baltnet.ru udp
US 8.8.8.8:53 futuretechnology-com-sa.mail.protection.outlook.com udp
DE 185.172.128.145:80 185.172.128.145 tcp
US 199.34.228.65:80 www.kramercontracting.com tcp
US 8.8.8.8:53 sdsds.es udp
US 8.8.8.8:53 happycrafts.com udp
US 8.8.8.8:53 mail.mmod.com udp
US 198.49.23.144:80 36jdc.com tcp
IE 54.171.136.173:80 armadahotel.com tcp
US 3.33.130.190:80 boycemail.com tcp
US 13.248.169.48:80 cintex.net tcp
US 162.159.135.42:80 jcwco.com tcp
US 172.67.70.191:443 www.hugedomains.com tcp
US 35.215.108.142:21 aldakika.com tcp
US 44.238.117.127:995 mx-02-us-west-2.prod.hydra.sophos.com tcp
US 143.244.202.96:465 mx.mail-data.net tcp
IE 74.125.193.27:143 aspmx.l.google.com tcp
FR 212.157.149.8:465 harman.fr tcp
US 54.209.32.212:465 happycrafts.com tcp
US 35.215.108.142:443 aldakika.com tcp
FR 212.157.149.8:22 harman.fr tcp
IE 54.171.136.173:80 armadahotel.com tcp
US 54.209.32.212:80 happycrafts.com tcp
GB 172.217.169.19:80 www.bechtold.net tcp
FR 212.157.149.8:80 harman.fr tcp
US 8.8.8.8:53 pc.fr udp
US 8.8.8.8:53 mysteo.com udp
US 8.8.8.8:53 thisisgraeme.com udp
US 8.8.8.8:53 puroconjunto.com udp
US 8.8.8.8:53 mysteo.com udp
US 8.8.8.8:53 students-rsd7-net.mail.protection.outlook.com udp
US 8.8.8.8:53 36jdc-com.mail.protection.outlook.com udp
US 8.8.8.8:53 mysteo.com udp
US 8.8.8.8:53 pc.fr udp
US 8.8.8.8:53 mx20.antispam.mailspamprotection.com udp
US 8.8.8.8:53 www.36jdc.com udp
US 8.8.8.8:53 thisisgraeme.com udp
DE 134.119.20.162:80 geleeroyalemedien.de tcp
US 8.8.8.8:53 futuretechnology-com-sa.mail.protection.outlook.com udp
US 8.8.8.8:53 muhomeloans.com udp
US 8.8.8.8:53 rambler.ruinbox.ru udp
US 8.8.8.8:53 ftp.tancredsolutions.com udp
US 8.8.8.8:53 puroconjunto.com udp
US 107.180.3.58:80 futuretechnology.com.sa tcp
IE 52.215.232.25:465 spamtitan.tierneys.ie tcp
US 198.185.159.144:443 thisisgraeme.com tcp
US 198.185.159.145:21 thisisgraeme.com tcp
DE 37.120.186.72:587 smtp-backup2.portunity.de tcp
US 3.33.130.190:990 boycemail.com tcp
US 216.239.38.21:222 bechtold.net tcp
US 52.71.57.184:80 happycrafts.com tcp
US 44.238.117.127:143 mx-02-us-west-2.prod.hydra.sophos.com tcp
CA 216.40.34.37:80 blancomail.com tcp
DE 37.120.186.72:110 smtp-backup2.portunity.de tcp
IE 52.215.232.25:995 spamtitan.tierneys.ie tcp
CA 216.40.34.37:80 blancomail.com tcp
US 8.8.8.8:53 skorpabacken.se udp
US 8.8.8.8:53 muhomeloans.com udp
US 3.33.130.190:443 boycemail.com tcp
CA 216.40.34.37:80 blancomail.com tcp
IE 54.171.136.173:443 armadahotel.com tcp
US 8.8.8.8:53 skorpabacken.se udp
US 199.34.228.65:80 www.kramercontracting.com tcp
US 35.215.108.142:80 aldakika.com tcp
US 3.33.130.190:443 boycemail.com tcp
US 13.248.169.48:443 cintex.net tcp
US 8.8.8.8:53 villa-siena.org udp
US 8.8.8.8:53 thesunshaders.com udp
US 8.8.8.8:53 mail.puroconjunto.com udp
US 8.8.8.8:53 students-rsd7-net.mail.protection.outlook.com udp
US 8.8.8.8:53 thesunshaders.com udp
US 8.8.8.8:53 mail.tancredsolutions.com udp
US 8.8.8.8:53 taylor-green.co.uk udp
US 162.159.135.42:443 jcwco.com tcp
GB 172.217.169.19:443 www.bechtold.net tcp
US 52.71.57.184:80 happycrafts.com tcp
US 8.8.8.8:53 futuretechnology-com-sa.mail.protection.outlook.com udp
US 8.8.8.8:53 36jdc-com.mail.protection.outlook.com udp
US 8.8.8.8:53 villa-siena.org udp
US 8.8.8.8:53 taylor-green.co.uk udp
US 8.8.8.8:53 ftp.minttransportationltd.com udp
US 8.8.8.8:53 www.armadahotel.com udp
US 8.8.8.8:53 ftp.students.rsd7.net udp
US 8.8.8.8:53 ahigherlevel.com udp
US 8.8.8.8:53 us-smtp-inbound-1.mimecast.com udp
US 8.8.8.8:53 us-smtp-inbound-1.mimecast.com udp
US 198.49.23.144:80 thisisgraeme.com tcp
US 8.8.8.8:53 gmail.com424057099ms udp
US 8.8.8.8:53 skorpabacken-se.mail.protection.outlook.com udp
US 8.8.8.8:53 ahigherlevel.com udp
LU 80.92.65.144:80 pc.fr tcp
IE 34.253.152.202:443 www.armadahotel.com tcp
CA 216.40.34.37:80 blancomail.com tcp
IE 54.171.136.173:80 armadahotel.com tcp
US 13.56.33.8:80 mysteo.com tcp
US 149.28.93.138:80 mail.puroconjunto.com tcp
FR 212.157.149.8:80 harman.fr tcp
US 149.28.93.138:80 mail.puroconjunto.com tcp
US 199.34.228.65:80 www.kramercontracting.com tcp
US 35.215.108.142:80 aldakika.com tcp
US 3.33.130.190:80 boycemail.com tcp
US 8.8.8.8:53 forte.ua udp
US 184.106.55.69:80 muhomeloans.com tcp
US 13.248.169.48:80 cintex.net tcp
US 3.33.130.190:80 boycemail.com tcp
US 8.8.8.8:53 36jdc-com.mail.protection.outlook.com udp
US 8.8.8.8:53 jg-elektrotechnik.de udp
US 8.8.8.8:53 avanteusa.com udp
US 8.8.8.8:53 breck.kyschool udp
US 8.8.8.8:53 students-rsd7-net.mail.protection.outlook.com udp
US 8.8.8.8:53 gmail.com424057099ms udp
US 8.8.8.8:53 gmail.com424057099ms udp
US 8.8.8.8:53 forte.ua udp
US 8.8.8.8:53 mail.thesunshaders.com udp
US 8.8.8.8:53 ftp.kramercontracting.com udp
US 8.8.8.8:53 mail.h-email.net udp
US 8.8.8.8:53 ftp.carriereantonio.191.es udp
US 8.8.8.8:53 ftp.boycemail.com udp
US 8.8.8.8:53 mx2-us1.ppe-hosted.com udp
US 8.8.8.8:53 sv-l-026.fra.bitplex.net udp
US 8.8.8.8:53 ftp.bechtold.net udp
US 8.8.8.8:53 mail.thesunshaders.com udp
US 8.8.8.8:53 mail.carriereantonio.191.es udp
US 8.8.8.8:53 mail.cintex.net udp
US 8.8.8.8:53 jg-elektrotechnik.de udp
US 8.8.8.8:53 breck.kyschool udp
US 8.8.8.8:53 ftp.36jdc.com udp
US 8.8.8.8:53 avanteusa.com udp
US 8.8.8.8:53 villasiena-org01c.mail.protection.outlook.com udp
US 8.8.8.8:53 villasiena-org01c.mail.protection.outlook.com udp
US 8.8.8.8:53 ssh.tancredsolutions.com udp
US 8.8.8.8:53 futuretechnology-com-sa.mail.protection.outlook.com udp
US 8.8.8.8:53 alt1.aspmx.l.google.com udp
US 8.8.8.8:53 ftp.blancomail.com udp
US 8.8.8.8:53 ftp.cintex.net udp
US 8.8.8.8:53 www.pcspecialist.fr udp
US 8.8.8.8:53 ftp.futuretechnology.com.sa udp
US 8.8.8.8:53 mail.minttransportationltd.com udp
US 8.8.8.8:53 www.brandbucket.com udp
US 8.8.8.8:53 ftp.armadahotel.com udp
US 8.8.8.8:53 skorpabacken-se.mail.protection.outlook.com udp
US 162.159.135.42:80 jcwco.com tcp
US 8.8.8.8:53 bulamah.com.br udp
US 8.8.8.8:53 ftp.localwebpromote.com udp
US 8.8.8.8:53 ftp.happycrafts.com udp
US 172.67.70.191:443 www.hugedomains.com tcp
US 216.239.38.21:80 bechtold.net tcp
US 198.185.159.145:80 thisisgraeme.com tcp
US 52.71.57.184:80 ftp.happycrafts.com tcp
US 192.249.119.59:80 villa-siena.org tcp
DE 185.53.178.13:80 taylor-green.co.uk tcp
US 198.49.23.144:80 thisisgraeme.com tcp
IE 54.171.136.173:80 armadahotel.com tcp
US 8.8.8.8:53 incendiary-ps.com udp
US 8.8.8.8:53 bulamah.com.br udp
US 8.8.8.8:53 bulamah.com.br udp
US 8.8.8.8:53 mail.imena.com.ua udp
US 8.8.8.8:53 incendiary-ps.com udp
US 3.33.130.190:443 ftp.localwebpromote.com tcp
US 104.26.13.133:443 www.pcspecialist.fr tcp
US 107.180.3.58:80 futuretechnology.com.sa tcp
CA 216.40.34.37:80 ftp.blancomail.com tcp
DE 134.119.20.162:80 geleeroyalemedien.de tcp
ZA 41.203.18.14:80 mail.thesunshaders.com tcp
US 8.8.8.8:53 tm3solutions.com udp
US 104.26.13.133:443 www.pcspecialist.fr tcp
US 149.28.93.138:80 mail.puroconjunto.com tcp
US 35.215.108.142:80 aldakika.com tcp
US 3.33.130.190:443 ftp.localwebpromote.com tcp
US 15.197.142.173:80 ahigherlevel.com tcp
US 13.248.169.48:443 ftp.cintex.net tcp
US 172.67.4.41:443 www.brandbucket.com tcp
US 199.34.228.65:80 ftp.kramercontracting.com tcp
US 8.8.8.8:53 student.ntu.edu.pk udp
US 8.8.8.8:53 bbrlawpc.com udp
US 8.8.8.8:53 nrgsurveyors.co.uk udp
US 8.8.8.8:53 tm3solutions.com udp
US 8.8.8.8:53 buyerschoices.com udp
US 8.8.8.8:53 ftp.jcwco.com udp
US 8.8.8.8:53 ssh.carriereantonio.191.es udp
US 8.8.8.8:53 alt4.aspmx.l.google.com udp
US 8.8.8.8:53 www.villa-siena.org udp
US 8.8.8.8:53 futuretechnology-com-sa.mail.protection.outlook.com udp
US 8.8.8.8:53 theabbeyclinic.co.uk udp
US 8.8.8.8:53 tm2u.com.my udp
US 8.8.8.8:53 cleverdeckingservices.co.za udp
US 8.8.8.8:53 students-rsd7-net.mail.protection.outlook.com udp
US 8.8.8.8:53 ftp.aldakika.com udp
US 8.8.8.8:53 ssh.students.rsd7.net udp
US 8.8.8.8:53 villasiena-org01c.mail.protection.outlook.com udp
US 8.8.8.8:53 mail.happycrafts.com udp
US 8.8.8.8:53 36jdc-com.mail.protection.outlook.com udp
US 8.8.8.8:53 mx0.jg-elektrotechnik.de udp
US 8.8.8.8:53 www.thisisgraeme.com udp
US 8.8.8.8:53 avanteusa-com.mail.protection.outlook.com udp
US 8.8.8.8:53 student.ntu.edu.pk udp
US 149.28.93.138:80 mail.puroconjunto.com tcp
US 8.8.8.8:53 coginet.fr udp

Files

memory/1992-1-0x0000000000290000-0x0000000000390000-memory.dmp

memory/1992-2-0x00000000001B0000-0x00000000001BB000-memory.dmp

memory/1992-3-0x0000000000400000-0x0000000001F00000-memory.dmp

memory/1200-4-0x0000000002560000-0x0000000002576000-memory.dmp

memory/1992-5-0x0000000000400000-0x0000000001F00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5FDC.exe

MD5 dc74694474774b6aed011466d40a59e5
SHA1 b6089ff8b0f6b935c23b78b9f7ddd1a2d28d72bb
SHA256 3be9360ebd570b882c1f9215756b3ed3bf6ccac49e74a357a2d4de260f5f1db0
SHA512 f40d83f5c75197c2deeced12bfe14a652b738eb5bbc6940b2647f29e3bdca9b8919ac0fc3b7d8d101ebbb067e62e99bf8e675a0df33b4106248aca22c7971d0d

memory/2560-17-0x0000000001040000-0x00000000014E4000-memory.dmp

memory/2560-18-0x0000000077000000-0x0000000077002000-memory.dmp

memory/2560-19-0x0000000001040000-0x00000000014E4000-memory.dmp

memory/2560-20-0x0000000000D80000-0x0000000000D81000-memory.dmp

memory/2560-21-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

memory/2560-23-0x0000000001020000-0x0000000001021000-memory.dmp

memory/2560-22-0x0000000000D20000-0x0000000000D21000-memory.dmp

memory/2560-27-0x0000000000D30000-0x0000000000D31000-memory.dmp

memory/2560-31-0x00000000009A0000-0x00000000009A1000-memory.dmp

memory/2560-30-0x0000000000940000-0x0000000000941000-memory.dmp

memory/2560-29-0x0000000000F10000-0x0000000000F11000-memory.dmp

memory/2560-28-0x0000000000C10000-0x0000000000C11000-memory.dmp

memory/2560-25-0x0000000000950000-0x0000000000951000-memory.dmp

memory/2560-26-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

memory/2560-24-0x00000000007D0000-0x00000000007D1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6588.exe

MD5 65ac443eaa4eba05fb6befa6907fe19c
SHA1 b1393809b1153fcbd645a8bad9883948cad3428f
SHA256 392229ad4e3e2ee25eee282cc6375ebb092f82ffff81a52f4e0de05b7903ddd9
SHA512 bc3104a77476e13caec5d7ab98d2d1f5ffd5ec88ba18341da8ac36e389e64fdc6e2fd7b280b65961080d5b54cf0317704d4dc2c7e9392e9e29dd1e746cf0c2a7

memory/2560-38-0x00000000009B0000-0x00000000009B1000-memory.dmp

memory/2560-39-0x00000000028F0000-0x00000000028F1000-memory.dmp

memory/2560-41-0x0000000001030000-0x0000000001031000-memory.dmp

memory/2560-46-0x0000000001040000-0x00000000014E4000-memory.dmp

memory/2560-47-0x00000000008A0000-0x00000000008A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6C9A.dll

MD5 4f8d7e511b02f84dc194286942018d77
SHA1 6bcf96994536f34e59fe276319ad470a20e2b1ee
SHA256 fae6b84db9375e920ded9af2983e0b48861a531f7cfd90ddc5226576668e4384
SHA512 a2b3dec9ec989d372af877cc440de4aba62dd4f3d906d415e2544b98091db2039a5b7905670b63bd25077ffd701d412569e11493ef05dc35d5d6ea6dd2bdc744

memory/1436-52-0x0000000000170000-0x0000000000176000-memory.dmp

memory/1436-51-0x0000000010000000-0x00000000102CA000-memory.dmp

memory/2820-54-0x0000000003C70000-0x0000000003E28000-memory.dmp

memory/2820-57-0x0000000003C70000-0x0000000003E28000-memory.dmp

memory/1336-58-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6588.exe

MD5 7a4efa5a6fdc8dfcfb7150803c41848f
SHA1 deb0cc5c5b5b440fbba9ebef24877466dd8104b7
SHA256 c518798fe82ebe16493a7686591cb1cf560e5ef5d8614ce8c379c966a832242d
SHA512 16d9af378607ea2bed0ad28ccdee0692a9ffe0cea47aa36311cf057e0395beb3c951dfa15f466d391d11054e4dda97afda6c5499751892a884acd838ea78dc30

memory/2820-59-0x0000000003E30000-0x0000000003FE7000-memory.dmp

memory/1336-61-0x0000000000400000-0x0000000000848000-memory.dmp

memory/1336-64-0x0000000000400000-0x0000000000848000-memory.dmp

memory/1336-65-0x0000000000400000-0x0000000000848000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6588.exe

MD5 849c881f4429e6e1c7e34c71aedcbed8
SHA1 b7b559cdc64359a1adbe43bf923364465e0507eb
SHA256 1f9be27efe20169496de6ec1ba1778c38bd59126aba701dc9a12bbfda2d66111
SHA512 67c3642407a6c11598d2d069e358d12e083bc8531470a870fc6a2585cdb6081c8f5ca4d0cd0c1466654129b6395981c246641619d7cfbf2797eb7162e1fff366

memory/1336-66-0x0000000000400000-0x0000000000848000-memory.dmp

memory/1336-67-0x0000000000400000-0x0000000000848000-memory.dmp

\Users\Admin\AppData\Local\Temp\6588.exe

MD5 ce472c7bec2183fcb1e8b318012aa085
SHA1 0da398d780e6cc424d3b68ebd2903a8c849e7701
SHA256 955d0dd8ae390efa84a5823fac5979f8a23f52f86abc5d5499b29bd9860c650c
SHA512 ea4921b08af0977128c47dd91f48698bb7bb8b1dd278fb0b2b04fe2b9b41656f98eeb10c471da3dd627ed11bc5bbd29c9c1d776a67f617591d9319ac495378fa

memory/1336-68-0x0000000000400000-0x0000000000848000-memory.dmp

memory/1336-71-0x0000000000230000-0x0000000000236000-memory.dmp

\Users\Admin\AppData\Local\Temp\6C9A.dll

MD5 24c67dcd644e5b2a60464cb5d29ccad7
SHA1 b619a11cec7cfb1c64e56d4138424b37f1190671
SHA256 0ee21934ead620135771e9cbb97af2dca8121ba20df5072cb287e479bd816bf7
SHA512 ea746f46fff8c2bcaefd7f0c127afc7fcb792f8f8524f6032564fbe6bf1bacaf72e97c13911872a95345c5ddf3df9dd7bfe50067f459757f95c76b1db23b4a56

memory/1436-73-0x00000000025B0000-0x00000000026D0000-memory.dmp

memory/1436-74-0x00000000026D0000-0x00000000027D5000-memory.dmp

memory/1436-77-0x00000000026D0000-0x00000000027D5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7F50.exe

MD5 be080a57933f7e32dd3a30c922aeba4c
SHA1 251d6800354a1c4a9b1d79ba10413d197abf4838
SHA256 61356eb29497517c7bf2baa1e7532dc92cf99f3ccf3475dfa11af101b8cc1d3a
SHA512 9412a8d0919bfb0ee875329ab819ac2b07aeaeac63199f4936d02ab48e232cd413de8823e39a5d0d3f412aacc2036d11b302f34bb8bafb86751dc7ef9ba449fe

memory/2188-82-0x0000000000CC0000-0x000000000122B000-memory.dmp

memory/1336-83-0x0000000002B00000-0x0000000002C20000-memory.dmp

memory/1336-84-0x0000000002C20000-0x0000000002D25000-memory.dmp

memory/1336-87-0x0000000002C20000-0x0000000002D25000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8A1B.exe

MD5 80faace0edd9cf4ad1bc34217a608331
SHA1 20f4a78cd0c4299c164b4f24c8975ea85ad505f5
SHA256 3fb0fc4d10121a2d649bf1d0c9eaa5437d48f3df80ff9a9dd87d1ae2482e849f
SHA512 484d0e0930192f891f8a7dd6bf4d3561bbe3a1c935c3189dbd977315415409944197344a969ac88d8bf4843c9c02a08ad9b56a4ddb5bce9d86a94ce07daf2ce1

memory/1768-92-0x0000000000400000-0x00000000008A4000-memory.dmp

C:\Users\Admin\AppData\Roaming\gjhfsce

MD5 beb935e79a4a35da55548d745c312586
SHA1 404f3832c8e13dc1bbcbac9eda9cf8bea9b07d84
SHA256 a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008
SHA512 c514adbff0dfeeaaeca607a3efdefb1e71c76db2ae3293d1e465be5f175051f852c8b8ffd58de11ea2e8128bf1e612c5409616b92f92362f515c806e562027f9

C:\Users\Admin\AppData\Local\Temp\A182.exe

MD5 e31ee23627f42d4934d08aa74bf42fdf
SHA1 595b1552d9d988d4da4ec419e5df99d90afc182c
SHA256 d81c1d9b2f8589db9fceb6b18ebddab8760d8341bed8558ce39a7f8c19aa71ae
SHA512 622598575111221dae1d84aa361bbf09b388e040ae5280816a926acf6de42f2b842c14cfb3fbb1661fcfc8a225598a4f05bdd96d1a32c83a0e3a5c73f6c671fa

memory/1436-102-0x0000000010000000-0x00000000102CA000-memory.dmp

memory/1200-105-0x0000000003DA0000-0x0000000003DB6000-memory.dmp

memory/2016-106-0x0000000000400000-0x0000000001F04000-memory.dmp

memory/2016-110-0x0000000000220000-0x000000000022B000-memory.dmp

memory/2016-109-0x0000000002102000-0x0000000002110000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\C7F7.exe

MD5 952d03d070d28947c2b446ebd8a903af
SHA1 46ec8cd0833c45a6ff435e437d05a75fa6cf3c59
SHA256 98a3eeace5c77f4520adff8baf1c22eec2554e81af30e441459b460ae0b0f2c8
SHA512 0b1831ddc6b3f6000a71dc9eec10434d55f69b1462e0235332b4763eeeed846f93a400f38e467ff5ac46906af09b0515cbf4cbbaedcd1b1eed6f0834a1bedaa2

C:\Users\Admin\AppData\Local\Temp\CECB.exe

MD5 a1b5ee1b9649ab629a7ac257e2392f8d
SHA1 dc1b14b6d57589440fb3021c9e06a3e3191968dc
SHA256 2bfd95260a4c52d4474cd51e74469fc3de94caed28937ff0ce99ded66af97e65
SHA512 50ccbb9fd4ea2da847c6be5988e1e82e28d551b06cc9122b921dbd40eff4b657a81a010cea76f29e88fda06f8c053090b38d04eb89a6d63ec4f42ef68b1cf82b

memory/2208-116-0x0000000001200000-0x0000000001EB1000-memory.dmp

memory/540-124-0x0000000000400000-0x0000000001A77000-memory.dmp

memory/2304-130-0x0000000000C60000-0x0000000001354000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EFD3.exe

MD5 5f97959eece20793d8c290469b25127a
SHA1 69c372c2560f4bbf5fe7440a7b1f5a0c29bdd4fe
SHA256 d82c5820d9434694971bf19df09c9dc0883d51ae5fa0b704aee37ac45af6b93a
SHA512 e6f841d39a96fd4dbad775866558d4d09cb73457e299192135207a597777b6b941eb1a7b6d9d37b80b83730b9ae30f0ffa6a6f77e74a7e83267d7318e406a073

C:\Users\Admin\AppData\Local\Temp\EFD3.exe

MD5 8172bffbd5f62ce97c8942b68109681e
SHA1 55181429273c8dbaa1db9171d553d8b6d3c018b1
SHA256 c441ef223737cf85238bd757e1fd7ff544a64ecb54c31e4ca883a674e5857bdf
SHA512 388453b0fbd62138f958291a698edb9e9a92157b8e3183409b03e877dda0162a22eb6ead003b9764df1433696d1eafecca24288df1253a4ced61dcf99715a6d3

\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe

MD5 bc89eaa4cbdd58b143274d094b699992
SHA1 6489fedc5fb5c9881482652e1699157f1d45585e
SHA256 d74a8575ee7a6da1f7036c89bac0830520c37cee6f8a43c2b334f20f59ee8931
SHA512 87b0967adfe6a183798978ab1472d90ac510a853ab3df94585074733be8f7fe0be03fef5986f340c6b929ee6de70aadf46267fe4807262ada3dfccc3ec67d625

C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe

MD5 b6e8ce1415e787149dcb63b221f576c3
SHA1 2eef8b64873ad86f40bfd14e9ba7bd349f92b9fc
SHA256 90d91e56c78626e68f38272a4badcc98431f1519454f98a35ad3d2a70771a358
SHA512 cf003e5aee29b55fbd7d2efbdffbb33cd58009baaa08e3c964fcf1b174488530a9970efdaafa00bc9d215a08233dd88074f3552f6f691d00233ee15528a27c41

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 a0aa2715c301edf8ae92b4d6bde2aa6c
SHA1 5cbbdd2f1033a2136464a8464b1c8ad8ebe86e2a
SHA256 42929959dbca50a9619581b80f0a2ff0c7096dc8c346d798d2b0f65550deff26
SHA512 385974622a9476399b3f87b8e95dd598b68c05b428461994a76567b786aa2e016e21e83dff557851785f62f5dd7492dd677b60760b46ff31ffbe37da4fda75da

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 6582cee7c234b617d87d4a288441a7a6
SHA1 5ee8d5404a2721d42249e44ebbd460c3c901482b
SHA256 223e40baeed1a0e14a160344bf20a384d9704aac189ac15f6eeb9b9a645c7d05
SHA512 388ad8ba907cb03fde3ab7667f8808264b1bcdc9caf9fa327f5d7a2c62c9eba65d3e1b6400e7a2870ae7a629343035e8a6774e96c321a2f50c4afb8f8953742a

\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 c406a119553b3a9d035d4f3fcedbd95b
SHA1 bc700c57cb60052344f6cae0ff3fc6dd4af9248c
SHA256 3f74465970f5d061ccd456f8e2cfb74333b02733c1e5cf616499d2be67510ff8
SHA512 9c1d4e56de221b16f6aa53e2aaf7effb4fdd16915b0f3bbeab984e3e0a4ff4b4ef563084ba18543bd0c7429739ba1660f1b8a3b2126606dc26182f18d4edb2d8

\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 3a7004b48c56459a42c07cebe52034f9
SHA1 b6a43e35081b8c478a7849494d34a789971aee22
SHA256 32554bed4085b2bf1ae062f956a26a9ee7f6214a89f13e49af2ed95a02af700d
SHA512 4274133958fccd6c50816d4e6b65ec03d64b02b43cac5074793d9ebd6e3fa73e5c5a4824602d1596052730297403b9f6d0fee6fa5b4e2d563198e63689a20caa

C:\Users\Admin\AppData\Local\Temp\FourthX.exe

MD5 0b5ed34f6d958857a8aed0c090358ff4
SHA1 5954283ec26e51f322593e53b6b32e3f70d43ac3
SHA256 4301f0bd33640a1b767e4d605bbbaf78567091e51019f132fb06558127f4acb3
SHA512 2bec28c4eeba2f75b9a5280c457fb1220d13d829905b6f0bac8fcd64bee791557cc38e38610f5e9a3478ad0a76d9d9a3bd36f3496ad1e3785376df7140ef8c9c

C:\Users\Admin\AppData\Local\Temp\FourthX.exe

MD5 dc301e7b410b4824b071332b3fbfe2f1
SHA1 a9deda9c23931439801ee28e848d5be2582046fa
SHA256 74c128080dda13dc7847c4d1e9681dbac8ed2754c6178d2d66312b72431cf429
SHA512 a394de8c9414d89ae9b48cb491d6c07a9bde679665581d81a66e49897d30f38f149f9e1d8c2e542c2e356b3e6a002b81f757875e6c8be24f3651c11b90365fd3

memory/2304-158-0x00000000738A0000-0x0000000073F8E000-memory.dmp

memory/1628-161-0x0000000002640000-0x0000000002A38000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 110b7134cb795ca3f271770571c14f88
SHA1 84b9144045ef25f48bb986662602eb6082e6384a
SHA256 645d0152c390fa5f98703afe9db1d29b7390d9dbf9e64e0cf8843554035802ae
SHA512 3a982fb6a9d14f51262f275135387a855089ac567aecc4861c31a8796a33bb11aad8cf31ce8d04b8c85069ed9bf173ed9c4fcfed84be11950c328d9c89e0522f

\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 a450fe42fa960682c3c00e177c5d661a
SHA1 ddeeed6220af83435c73b63544090640084e3f33
SHA256 60373514fc35ad274dd023dd5ecd932577b9868440ae0c1effb0505ef3afa1fa
SHA512 eaba0244b11637d0c5cba59459c386445ac9532d2ea772b788b494d880c23e7cdf226bb368e13aa6bc823361c7d617194bfb3c4b205a8d17349bd154d5a6f6dd

memory/2084-166-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1628-169-0x0000000002640000-0x0000000002A38000-memory.dmp

memory/2084-170-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1628-171-0x0000000002A40000-0x000000000332C000-memory.dmp

memory/2084-172-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 d0e9b189d6e673e0cbb75aa609fe432b
SHA1 87e60338e66e6ee24fbfef55522eb9943a34743a
SHA256 26626ac367c3b4404099e3730a35a9b060d172bdc852832144d1e65232a4a01c
SHA512 336216526179bf50d5a30d04fe18842a6a4b63f1ae80dc0e2475a90e777dd3bf7088192fbe24aabcc30e1845aba8763d0f2fc16fdcdae9c02534325ba3e8c392

memory/2084-173-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2084-175-0x0000000000400000-0x0000000000D1C000-memory.dmp

\Users\Admin\AppData\Local\Temp\u10w.0.exe

MD5 37e845a8f29bac520e704228e98b8df3
SHA1 750da5df3ded93423a860336f93a7f31a6be7284
SHA256 de5ed9b34dfbfa80b352f214c7beb6f31cd08aca9262f121d293175a4fcce704
SHA512 2c5a8eaa58e63759c5c522d11ae59234557e59ccfc44fc59773c7fa43bdb2d0f0070a6d59a0e3eb732e439f78bed897b4d5dd2675c5eda81976d2955da607eac

memory/2084-190-0x0000000000400000-0x0000000000D1C000-memory.dmp

\Users\Admin\AppData\Local\Temp\u10w.1.exe

MD5 6a5b6c7c3b3e4c90dcfa552bb2dc97cc
SHA1 b182599620423dc1cde0d248cf06e92691cd3343
SHA256 0f9a553035de3059c9f0571b638df4fd9881fd0007ec455a1abd5ac796dcd91f
SHA512 62fbf9d3d5ff607cc7134ec3050a3b77366ff496fdb540b95faac1966290f6ccecee4a4ddfbb2f8b96e31b8cc9b40d05d3cab4d8ec8787cb32d1762e953f197c

C:\Users\Admin\AppData\Local\Temp\u10w.1.exe

MD5 8aed89e9f7adb27ce03afca946ef438d
SHA1 ae680bcca15d75d35564897766953adbbceb6f8d
SHA256 81380769a7a89a2205003a03ae3365eda5734508abb45bbfb21b84c7d081d439
SHA512 f64a61f8bc0ff44d3cd929ca8b2c074776776c620e7ab7fe6dce2dc286502d5fdf675bf69832f714d65d4e51341df1555c06de2c8c531b9e6c35bc2c3952d7df

memory/1328-204-0x0000000000400000-0x0000000001F27000-memory.dmp

memory/1328-206-0x00000000020E2000-0x0000000002118000-memory.dmp

memory/1328-207-0x0000000000240000-0x00000000002A7000-memory.dmp

\Users\Admin\AppData\Local\Temp\u10w.1.exe

MD5 eee5ddcffbed16222cac0a1b4e2e466e
SHA1 28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
SHA256 2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
SHA512 8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

memory/1436-209-0x00000000026D0000-0x00000000027D5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Temp\Task.bat

MD5 11bb3db51f701d4e42d3287f71a6a43e
SHA1 63a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA256 6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
SHA512 907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

memory/3036-218-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/2552-224-0x000000001B510000-0x000000001B7F2000-memory.dmp

memory/2552-225-0x0000000002720000-0x0000000002728000-memory.dmp

memory/2552-226-0x000007FEF4AF0000-0x000007FEF548D000-memory.dmp

memory/2552-227-0x00000000028B4000-0x00000000028B7000-memory.dmp

memory/2552-228-0x00000000028BB000-0x0000000002922000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\FourthX.exe

MD5 b03886cb64c04b828b6ec1b2487df4a4
SHA1 a7b9a99950429611931664950932f0e5525294a4
SHA256 5dfaa8987f5d0476b835140d8a24fb1d9402e390bbe92b8565da09581bd895fc
SHA512 21d1a5a4a218411c2ec29c9ca34ce321f6514e7ca3891eded8c3274aeb230051661a86eda373b9a006554e067de89d816aa1fa864acf0934bbb16a6034930659

\ProgramData\xcfonrchdkar\vueqjgslwynd.exe

MD5 2894bac8eef6977463a9b6b2b4ebfb45
SHA1 24e371157c3114cd29a54cd635ddb884046a3f6b
SHA256 d880568ca69cbd902df113d63331abce86cc5f454ceadac09c5cee53942a5762
SHA512 903c63b84eb3f5c8dabe8e95388779fb50408eb58f80c8fdbfaec363fdaaff921089d00c117636304eaa2602c76ed53667472c6a983e9fcfd19d1b8b103a92a6

C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe

MD5 6a190e993f065d939995adfdb07cc8a1
SHA1 9664f606593178eb502cc38b5431189cc4c2cd5e
SHA256 6c8188b31f1c40c05d61e65ea787b2fdde140b631a41a72318d33c5ca475df21
SHA512 a6c1421c487bb344f8bb7ebe9cf2ac2a72cea9c9b70fd9a4092f0891e2de2a3f8150f7ad213bd46300639f21649c79a8360ab917833cbfcb7460bc06de2d17e2

memory/3052-234-0x0000000019AE0000-0x0000000019DC2000-memory.dmp

memory/3052-235-0x0000000000A30000-0x0000000000A38000-memory.dmp

memory/3052-236-0x000007FEF5490000-0x000007FEF5E2D000-memory.dmp

memory/3052-238-0x0000000000F7B000-0x0000000000FE2000-memory.dmp

memory/3028-239-0x0000000140000000-0x000000014000E000-memory.dmp

memory/3028-240-0x0000000140000000-0x000000014000E000-memory.dmp

memory/3052-237-0x0000000000F74000-0x0000000000F77000-memory.dmp

memory/1336-242-0x0000000002C20000-0x0000000002D25000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

MD5 eb694e009d058b2de86841a5a77285aa
SHA1 6d27757198bdc8f3d08d9b5d805f12102cab9a1d
SHA256 fd176732784982b974f1731a97f3d0de4d4197c99e6cf6a3dd615df1c7d2cb0d
SHA512 0e1edc72070543d77ff48963a85f302d4b6844ed2b4502594d3bdc8714c2f29e60abf582b28936a59e09edd1293de58ffaf49a5c504c79690954ee22f0ce50e3

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

MD5 c13ce508c36f4dfd32a43e4cbf1f76fc
SHA1 938804fc81bbbbc9efb8d62c9647a5c2117810d6
SHA256 b59542d6e41f53323b9ff6fc75d2aba9e595c06af163dd39418e92328ba344a0
SHA512 5122d6ff7528766744525c60327116521b3fdf4b8856c62c97cb5a63b09325f6302e830ead1553d0a1e26e4139ff0dc5e7441387a279eec46291764a164c6afc

memory/2084-289-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 8224823845e814651a715e2abb22000a
SHA1 f132bcdbed8a53e73998711821622990bda87e71
SHA256 24a87c16db7fba668f8410415f1681f4d7c0e9168ce01398c29b78e01b234e1e
SHA512 7965f947f6f764d95a365e9211f068bed8b34392c045bf7bf9ccece35cc05179f7f3831d837cddfd6fcef014f4575a24b1c2cf06e50bf933ebed19f15cb95f6b

memory/2912-295-0x00000000024F0000-0x00000000028E8000-memory.dmp

memory/2584-296-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2912-301-0x00000000024F0000-0x00000000028E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 5481dc098dab972fd228163e73902d76
SHA1 8bd0ea4853b1c35a1e08dab9e9867ad95238fe64
SHA256 46caed11a438f819eecc37173b8bc9b62a28ef376b8fdd2d31a6e091392028c9
SHA512 665123ddfc146079e948e2adf7beea4f2a2350bd20ff6169308cd1db352fbd5e7bf0a7eb54e4766ed28151b3e90fc31d2055f31425d457ffb9eda4c974063030

memory/2036-2309-0x0000000002092000-0x00000000020A0000-memory.dmp

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/2036-2628-0x0000000000400000-0x0000000001F00000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-07 04:59

Reported

2024-03-07 05:04

Platform

win10-20240221-en

Max time kernel

47s

Max time network

288s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe"

Signatures

Amadey

trojan amadey

SmokeLoader

trojan backdoor smokeloader

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\399D.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\B55.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\B55.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\399D.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\399D.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\B55.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A N/A N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\B55.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\399D.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11AF.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\11AF.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\B55.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\399D.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4652 set thread context of 2044 N/A C:\Users\Admin\AppData\Local\Temp\11AF.exe C:\Users\Admin\AppData\Local\Temp\11AF.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorgu.job C:\Users\Admin\AppData\Local\Temp\B55.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3368 wrote to memory of 4388 N/A N/A C:\Users\Admin\AppData\Local\Temp\B55.exe
PID 3368 wrote to memory of 4388 N/A N/A C:\Users\Admin\AppData\Local\Temp\B55.exe
PID 3368 wrote to memory of 4388 N/A N/A C:\Users\Admin\AppData\Local\Temp\B55.exe
PID 3368 wrote to memory of 4652 N/A N/A C:\Users\Admin\AppData\Local\Temp\11AF.exe
PID 3368 wrote to memory of 4652 N/A N/A C:\Users\Admin\AppData\Local\Temp\11AF.exe
PID 3368 wrote to memory of 4652 N/A N/A C:\Users\Admin\AppData\Local\Temp\11AF.exe
PID 3368 wrote to memory of 1348 N/A N/A C:\Windows\system32\regsvr32.exe
PID 3368 wrote to memory of 1348 N/A N/A C:\Windows\system32\regsvr32.exe
PID 1348 wrote to memory of 164 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1348 wrote to memory of 164 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1348 wrote to memory of 164 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4652 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\11AF.exe C:\Users\Admin\AppData\Local\Temp\11AF.exe
PID 4652 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\11AF.exe C:\Users\Admin\AppData\Local\Temp\11AF.exe
PID 4652 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\11AF.exe C:\Users\Admin\AppData\Local\Temp\11AF.exe
PID 4652 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\11AF.exe C:\Users\Admin\AppData\Local\Temp\11AF.exe
PID 4652 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\11AF.exe C:\Users\Admin\AppData\Local\Temp\11AF.exe
PID 4652 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\11AF.exe C:\Users\Admin\AppData\Local\Temp\11AF.exe
PID 4652 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\11AF.exe C:\Users\Admin\AppData\Local\Temp\11AF.exe
PID 4652 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\11AF.exe C:\Users\Admin\AppData\Local\Temp\11AF.exe
PID 3368 wrote to memory of 5092 N/A N/A C:\Users\Admin\AppData\Local\Temp\2F3C.exe
PID 3368 wrote to memory of 5092 N/A N/A C:\Users\Admin\AppData\Local\Temp\2F3C.exe
PID 3368 wrote to memory of 5092 N/A N/A C:\Users\Admin\AppData\Local\Temp\2F3C.exe
PID 3368 wrote to memory of 2952 N/A N/A C:\Users\Admin\AppData\Local\Temp\399D.exe
PID 3368 wrote to memory of 2952 N/A N/A C:\Users\Admin\AppData\Local\Temp\399D.exe
PID 3368 wrote to memory of 2952 N/A N/A C:\Users\Admin\AppData\Local\Temp\399D.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe

"C:\Users\Admin\AppData\Local\Temp\a2c996efff932151e3d97d6c0816cc4ad58e54068bc1b037ce2d279a55521008.exe"

C:\Users\Admin\AppData\Local\Temp\B55.exe

C:\Users\Admin\AppData\Local\Temp\B55.exe

C:\Users\Admin\AppData\Local\Temp\11AF.exe

C:\Users\Admin\AppData\Local\Temp\11AF.exe

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1951.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\1951.dll

C:\Users\Admin\AppData\Local\Temp\11AF.exe

C:\Users\Admin\AppData\Local\Temp\11AF.exe

C:\Users\Admin\AppData\Local\Temp\2F3C.exe

C:\Users\Admin\AppData\Local\Temp\2F3C.exe

C:\Users\Admin\AppData\Local\Temp\399D.exe

C:\Users\Admin\AppData\Local\Temp\399D.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 selebration17io.io udp
RU 91.215.85.120:80 selebration17io.io tcp
RU 185.215.113.45:80 185.215.113.45 tcp
US 8.8.8.8:53 120.85.215.91.in-addr.arpa udp
US 8.8.8.8:53 45.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 trmpc.com udp
SA 2.88.204.95:80 trmpc.com tcp
N/A 127.0.0.1:49871 tcp

Files

memory/3688-1-0x00000000020D0000-0x00000000021D0000-memory.dmp

memory/3688-2-0x0000000002030000-0x000000000203B000-memory.dmp

memory/3688-3-0x0000000000400000-0x0000000001F00000-memory.dmp

memory/3368-4-0x00000000010A0000-0x00000000010B6000-memory.dmp

memory/3688-5-0x0000000000400000-0x0000000001F00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B55.exe

MD5 3039c5befd722f92f6f87df38c1b677d
SHA1 d5f52398ef32fe71ecfff5a83b8c93cc9e8da993
SHA256 6cfc00d72c160676038ff25ac0a7a99791924db9a8040b608a4803dd5ca4b060
SHA512 a5eae8dac40c9a4389824793a4bf39d70e8621c7bf07b112a966a2b1fe5da9147825972ddf141a9b412bd01c28cc7c5e10afbdde4961bacc9ba28a0fcf558527

memory/4388-15-0x0000000000960000-0x0000000000E18000-memory.dmp

memory/4388-16-0x0000000077A24000-0x0000000077A25000-memory.dmp

memory/4388-17-0x0000000000960000-0x0000000000E18000-memory.dmp

memory/4388-18-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

memory/4388-19-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

memory/4388-20-0x0000000004D10000-0x0000000004D11000-memory.dmp

memory/4388-21-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

memory/4388-22-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

memory/4388-23-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

memory/4388-24-0x0000000004D00000-0x0000000004D01000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\11AF.exe

MD5 65ac443eaa4eba05fb6befa6907fe19c
SHA1 b1393809b1153fcbd645a8bad9883948cad3428f
SHA256 392229ad4e3e2ee25eee282cc6375ebb092f82ffff81a52f4e0de05b7903ddd9
SHA512 bc3104a77476e13caec5d7ab98d2d1f5ffd5ec88ba18341da8ac36e389e64fdc6e2fd7b280b65961080d5b54cf0317704d4dc2c7e9392e9e29dd1e746cf0c2a7

memory/4388-30-0x0000000004D30000-0x0000000004D31000-memory.dmp

memory/4388-31-0x0000000004D20000-0x0000000004D21000-memory.dmp

memory/4388-36-0x0000000000960000-0x0000000000E18000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1951.dll

MD5 4f8d7e511b02f84dc194286942018d77
SHA1 6bcf96994536f34e59fe276319ad470a20e2b1ee
SHA256 fae6b84db9375e920ded9af2983e0b48861a531f7cfd90ddc5226576668e4384
SHA512 a2b3dec9ec989d372af877cc440de4aba62dd4f3d906d415e2544b98091db2039a5b7905670b63bd25077ffd701d412569e11493ef05dc35d5d6ea6dd2bdc744

memory/164-41-0x0000000010000000-0x00000000102CA000-memory.dmp

memory/164-40-0x0000000000B20000-0x0000000000B26000-memory.dmp

memory/164-43-0x0000000004A90000-0x0000000004BB0000-memory.dmp

memory/4652-45-0x0000000003E00000-0x0000000003FBB000-memory.dmp

memory/4652-46-0x0000000003FC0000-0x0000000004177000-memory.dmp

memory/164-48-0x0000000004BB0000-0x0000000004CB5000-memory.dmp

memory/2044-47-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2044-51-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2044-52-0x0000000000400000-0x0000000000848000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\11AF.exe

MD5 ce472c7bec2183fcb1e8b318012aa085
SHA1 0da398d780e6cc424d3b68ebd2903a8c849e7701
SHA256 955d0dd8ae390efa84a5823fac5979f8a23f52f86abc5d5499b29bd9860c650c
SHA512 ea4921b08af0977128c47dd91f48698bb7bb8b1dd278fb0b2b04fe2b9b41656f98eeb10c471da3dd627ed11bc5bbd29c9c1d776a67f617591d9319ac495378fa

memory/164-54-0x0000000004BB0000-0x0000000004CB5000-memory.dmp

memory/2044-55-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2044-56-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2044-57-0x0000000000400000-0x0000000000848000-memory.dmp

\Users\Admin\AppData\Local\Temp\1951.dll

MD5 74b609d95b2dcdd821aeba1fa539d635
SHA1 83c0ff0c7cacbd380af1267fbd7705e8a022f40b
SHA256 6697726f4b3ee7ebf83925814291ba899ed84a78d58c94c8081b2ef29f96334a
SHA512 d4353ea9696b82ac7e76acda8405bb47897bf08383bdc05654fac2d9e54b4567d272f26ac03a20ad3158a3ba227082023ebaeca4151c1d789b6f3f9c0edb53c2

memory/164-60-0x0000000004BB0000-0x0000000004CB5000-memory.dmp

memory/2044-61-0x0000000000B10000-0x0000000000B16000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2F3C.exe

MD5 0c9f883f68bee172f35b87653337e142
SHA1 3e540599fab46b00ec82bbbd463eb84645a660da
SHA256 89386cc46643c2d5d5a6160e535f186871bc0d7b8aea1052cc39a10ebe1b2b24
SHA512 d0ac243e599185abf17c1dad6a70e367691e03ff83609699dc4c210ca7797e7f426e77536c7c57d6a2930133e82d0f953fc27eb1ce811a0c47e2f680db1b07de

memory/2044-67-0x0000000002DC0000-0x0000000002EE0000-memory.dmp

memory/2044-68-0x0000000002EE0000-0x0000000002FE5000-memory.dmp

memory/2044-71-0x0000000002EE0000-0x0000000002FE5000-memory.dmp

memory/2952-76-0x00000000011A0000-0x0000000001658000-memory.dmp

memory/2044-77-0x0000000002EE0000-0x0000000002FE5000-memory.dmp

memory/2952-78-0x00000000011A0000-0x0000000001658000-memory.dmp

memory/2952-82-0x0000000005510000-0x0000000005511000-memory.dmp

memory/2952-83-0x00000000054F0000-0x00000000054F1000-memory.dmp

memory/2952-84-0x0000000005530000-0x0000000005531000-memory.dmp

memory/2952-86-0x00000000054E0000-0x00000000054E1000-memory.dmp

memory/2952-85-0x00000000054D0000-0x00000000054D1000-memory.dmp

memory/2952-87-0x0000000005520000-0x0000000005521000-memory.dmp

memory/2952-81-0x0000000005500000-0x0000000005501000-memory.dmp