Malware Analysis Report

2024-10-19 06:58

Sample ID 240317-ch8h6abh87
Target fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f
SHA256 fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f
Tags
quasar azorult ebayprofiles infostealer spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f

Threat Level: Known bad

The file fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f was found to be: Known bad.

Malicious Activity Summary

quasar azorult ebayprofiles infostealer spyware trojan

Quasar family

Quasar RAT

Detects Windows executables referencing non-Windows User-Agents

Quasar payload

Detects executables containing common artifacts observed in infostealers

Azorult

Detects Windows executables referencing non-Windows User-Agents

Detects executables containing common artifacts observed in infostealers

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Looks up external IP address via web service

Enumerates connected drives

Maps connected drives based on registry

Suspicious use of SetThreadContext

AutoIT Executable

Program crash

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Runs ping.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-17 02:05

Signatures

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing common artifacts observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-17 02:05

Reported

2024-03-17 02:08

Platform

win7-20240221-en

Max time kernel

3s

Max time network

68s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe"

Signatures

Azorult

trojan infostealer azorult

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing common artifacts observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\windef.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\system32\svchost.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2876 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 2876 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 2876 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 2876 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 3036 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 3036 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 3036 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 3036 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 3036 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 2876 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 2876 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 2876 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 2876 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 2876 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe
PID 2876 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe
PID 2876 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe
PID 2876 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe
PID 2876 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe
PID 3036 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 2876 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe
PID 2876 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Windows\SysWOW64\schtasks.exe
PID 2876 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Windows\SysWOW64\schtasks.exe
PID 2876 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Windows\SysWOW64\schtasks.exe
PID 2876 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Windows\SysWOW64\schtasks.exe
PID 3036 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe

"C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe"

C:\Users\Admin\AppData\Local\Temp\vnc.exe

"C:\Users\Admin\AppData\Local\Temp\vnc.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k

C:\Users\Admin\AppData\Local\Temp\windef.exe

"C:\Users\Admin\AppData\Local\Temp\windef.exe"

C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe

"C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe

"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {C5AAC6BB-DFB0-4C10-94C7-E2C527462ACA} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\vnc.exe

"C:\Users\Admin\AppData\Local\Temp\vnc.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k

C:\Users\Admin\AppData\Local\Temp\windef.exe

"C:\Users\Admin\AppData\Local\Temp\windef.exe"

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\mitijXw8nHfO.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 1508

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe

"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"

Network

Country Destination Domain Proto
RU 5.8.88.191:8080 tcp
US 8.8.8.8:53 0x21.in udp
US 8.8.8.8:53 0x21.in udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
RU 5.8.88.191:443 tcp
RU 5.8.88.191:8080 tcp
US 8.8.8.8:53 0x21.in udp
US 8.8.8.8:53 0x21.in udp
RU 5.8.88.191:8080 tcp
US 8.8.8.8:53 sockartek.icu udp
RU 5.8.88.191:8080 tcp
RU 5.8.88.191:8080 tcp

Files

\Users\Admin\AppData\Local\Temp\vnc.exe

MD5 b8ba87ee4c3fc085a2fed0d839aadce1
SHA1 b3a2e3256406330e8b1779199bb2b9865122d766
SHA256 4e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA512 7a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2

\Users\Admin\AppData\Local\Temp\windef.exe

MD5 b4a202e03d4135484d0e730173abcc72
SHA1 01b30014545ea526c15a60931d676f9392ea0c70
SHA256 7050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512 632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb

memory/2600-31-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2600-33-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2516-32-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2876-30-0x0000000002A90000-0x0000000002A91000-memory.dmp

memory/2516-36-0x000007FFFFFDD000-0x000007FFFFFDE000-memory.dmp

memory/2516-39-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2516-38-0x0000000000190000-0x000000000022C000-memory.dmp

memory/2516-47-0x0000000000190000-0x000000000022C000-memory.dmp

memory/2600-46-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2600-53-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2584-54-0x0000000000CA0000-0x0000000000CFE000-memory.dmp

memory/2584-55-0x0000000073E30000-0x000000007451E000-memory.dmp

memory/2584-56-0x0000000004950000-0x0000000004990000-memory.dmp

memory/2608-64-0x00000000000C0000-0x000000000011E000-memory.dmp

memory/2608-66-0x0000000004810000-0x0000000004850000-memory.dmp

memory/2608-65-0x0000000073E30000-0x000000007451E000-memory.dmp

memory/2584-67-0x0000000073E30000-0x000000007451E000-memory.dmp

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

MD5 ca82ac62eb2e68bd511748dccfa7bdb3
SHA1 2532c803d8c45661a4a220b829672030d3879988
SHA256 d45b8f333fd076a8feee3fb9bd090fc829ca456f6be3c1e7bdcf06d9064961d3
SHA512 99d57ae5254104050c15bf3c09cef6df503e00ca4ad2641112be02f029b972a4e5b48a5cddb9e15b4f01b0d7c5192a8d672b4f9485e322961e9d94edbbd5dc3c

memory/2972-90-0x000007FFFFFD4000-0x000007FFFFFD5000-memory.dmp

memory/2972-92-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2972-91-0x00000000000F0000-0x000000000018C000-memory.dmp

memory/2972-99-0x00000000000F0000-0x000000000018C000-memory.dmp

memory/2016-111-0x0000000000870000-0x00000000008CE000-memory.dmp

memory/2016-112-0x0000000073E30000-0x000000007451E000-memory.dmp

memory/2928-115-0x0000000000080000-0x00000000000A0000-memory.dmp

memory/2928-121-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2928-126-0x0000000000080000-0x00000000000A0000-memory.dmp

memory/2016-127-0x0000000073E30000-0x000000007451E000-memory.dmp

memory/2516-128-0x0000000000190000-0x000000000022C000-memory.dmp

memory/2608-129-0x0000000073E30000-0x000000007451E000-memory.dmp

memory/2608-130-0x0000000004810000-0x0000000004850000-memory.dmp

memory/2972-131-0x00000000000F0000-0x000000000018C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mitijXw8nHfO.bat

MD5 16ba8e0f5761b164409fef593e29a8ca
SHA1 74efe3cf6e9b04b715255dff3db6e512e98bea70
SHA256 75413d1327448329e61f430c4f5d9136f0f2e94ca41cc3f2238241a748e88e10
SHA512 dea36a6a21081db6917f7f60927986eeb64ee37c23d3aca9321a7e4744e9364cae8decf30e5664840091c5ea0a5b2e77562bdf1746a0398fbaf9ee86df9564fa

memory/2860-147-0x0000000073E30000-0x000000007451E000-memory.dmp

memory/2860-148-0x0000000001E60000-0x0000000001EA0000-memory.dmp

memory/2860-149-0x0000000073E30000-0x000000007451E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-17 02:05

Reported

2024-03-17 02:08

Platform

win10v2004-20240226-en

Max time kernel

33s

Max time network

163s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe"

Signatures

Azorult

trojan infostealer azorult

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing common artifacts observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\windef.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Windows\system32\svchost.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2780 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 2780 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 2780 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 2780 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 2780 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 2780 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 964 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 964 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 964 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 2780 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe
PID 2780 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe
PID 2780 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe
PID 964 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 964 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 2780 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe
PID 2780 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe
PID 2780 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Windows\SysWOW64\schtasks.exe
PID 2780 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Windows\SysWOW64\schtasks.exe
PID 2780 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe

"C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe"

C:\Users\Admin\AppData\Local\Temp\vnc.exe

"C:\Users\Admin\AppData\Local\Temp\vnc.exe"

C:\Users\Admin\AppData\Local\Temp\windef.exe

"C:\Users\Admin\AppData\Local\Temp\windef.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k

C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe

"C:\Users\Admin\AppData\Local\Temp\fbc01257551c6cd7bc0f2245ed9ce6521861d0238d2272830074f50bfbff620f.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe

"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\vnc.exe

"C:\Users\Admin\AppData\Local\Temp\vnc.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k

C:\Users\Admin\AppData\Local\Temp\windef.exe

"C:\Users\Admin\AppData\Local\Temp\windef.exe"

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cbfPm8XDb5YV.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1648 -ip 1648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 2056

C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe

"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JVtkAIr3B3Il.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4048 -ip 4048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 2284

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe

"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
RU 5.8.88.191:8080 tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 0x21.in udp
US 8.8.8.8:53 0x21.in udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
RU 5.8.88.191:8080 tcp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
RU 5.8.88.191:443 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
RU 5.8.88.191:8080 tcp
US 8.8.8.8:53 0x21.in udp
US 8.8.8.8:53 0x21.in udp
RU 5.8.88.191:8080 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 sockartek.icu udp
RU 5.8.88.191:8080 tcp
RU 5.8.88.191:8080 tcp
US 208.95.112.1:80 ip-api.com tcp
RU 5.8.88.191:443 tcp
RU 5.8.88.191:8080 tcp
RU 5.8.88.191:8080 tcp
US 8.8.8.8:53 sockartek.icu udp
US 8.8.8.8:53 200.64.52.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
RU 5.8.88.191:443 tcp
RU 5.8.88.191:8080 tcp

Files

C:\Users\Admin\AppData\Local\Temp\vnc.exe

MD5 b8ba87ee4c3fc085a2fed0d839aadce1
SHA1 b3a2e3256406330e8b1779199bb2b9865122d766
SHA256 4e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA512 7a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2

C:\Users\Admin\AppData\Local\Temp\windef.exe

MD5 b4a202e03d4135484d0e730173abcc72
SHA1 01b30014545ea526c15a60931d676f9392ea0c70
SHA256 7050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512 632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb

memory/2780-18-0x0000000003570000-0x0000000003571000-memory.dmp

memory/4156-21-0x0000000000800000-0x000000000089C000-memory.dmp

memory/4156-20-0x00000000008A0000-0x00000000008A1000-memory.dmp

memory/4156-25-0x0000000000800000-0x000000000089C000-memory.dmp

memory/1476-27-0x0000000000AC0000-0x0000000000AE0000-memory.dmp

memory/1476-35-0x0000000000AC0000-0x0000000000AE0000-memory.dmp

memory/4760-38-0x0000000072A60000-0x0000000073210000-memory.dmp

memory/4760-39-0x00000000006A0000-0x00000000006FE000-memory.dmp

memory/4760-40-0x0000000005770000-0x0000000005D14000-memory.dmp

memory/4760-41-0x0000000005260000-0x00000000052F2000-memory.dmp

memory/4156-42-0x0000000000800000-0x000000000089C000-memory.dmp

memory/4760-43-0x0000000005160000-0x0000000005170000-memory.dmp

memory/4760-44-0x00000000051C0000-0x0000000005226000-memory.dmp

memory/4760-45-0x0000000072A60000-0x0000000073210000-memory.dmp

memory/4760-46-0x0000000005740000-0x0000000005752000-memory.dmp

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

MD5 75c751937d40929a69c26d887cef79a3
SHA1 763e4adedafe28913f0e747128c9a0871c554249
SHA256 ac23c4126c25d6d3f9014112d7d789532e8444845db4e079952702f27ee8ba5d
SHA512 0e1ec25ef33b7abb08856b235b3f3466b758573e92d4bc0933a7f78649f78809e62ed69613f4ec844fcc5c1336ed00ed58e941981599ae6002a0d5824d6778b7

memory/4760-48-0x0000000006680000-0x00000000066BC000-memory.dmp

memory/1648-56-0x0000000072A60000-0x0000000073210000-memory.dmp

memory/4760-57-0x0000000072A60000-0x0000000073210000-memory.dmp

memory/1648-59-0x0000000006C60000-0x0000000006C6A000-memory.dmp

memory/2620-70-0x00000000001D0000-0x000000000026C000-memory.dmp

memory/2620-69-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2620-74-0x00000000001D0000-0x000000000026C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windef.exe.log

MD5 10eab9c2684febb5327b6976f2047587
SHA1 a12ed54146a7f5c4c580416aecb899549712449e
SHA256 f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA512 7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50

memory/2216-86-0x0000000072A60000-0x0000000073210000-memory.dmp

memory/2216-87-0x0000000004C70000-0x0000000004C80000-memory.dmp

memory/2616-88-0x00000000006A0000-0x00000000006C0000-memory.dmp

memory/2616-97-0x00000000006A0000-0x00000000006C0000-memory.dmp

memory/1648-98-0x0000000072A60000-0x0000000073210000-memory.dmp

memory/2216-99-0x0000000072A60000-0x0000000073210000-memory.dmp

memory/2620-100-0x00000000001D0000-0x000000000026C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\cbfPm8XDb5YV.bat

MD5 0b945ca34bab0b81e1d7b1a2507345bc
SHA1 d65422775b21eccfdb886966700b173c915edbce
SHA256 f5f824d7edf5077005d5e964cbb4438d6368945428cc0cb8251f6a0609bbb7f2
SHA512 b86876286cbced7cd61e712c510cb810b17faa0a6a82fef303a6a32640695eb116a6d95d5b18ed4236f10dafaa7e218281df2c6b3cf5e8af0f86ff28fbffdacf

memory/4048-106-0x0000000072A60000-0x0000000073210000-memory.dmp

memory/4048-107-0x00000000049D0000-0x00000000049E0000-memory.dmp

memory/1648-108-0x0000000072A60000-0x0000000073210000-memory.dmp

C:\Users\Admin\AppData\Roaming\Logs\03-17-2024

MD5 61aa123c1fc1fddbddd295aabf3d0ef3
SHA1 4836de512b0c51408a88678a63ad8ddb5f4f669b
SHA256 6a857e587cda9e3c1643283b69559ea1630a1f8af5df6a217e85eae02e39f06d
SHA512 24633eeeac246cc6f16fa398ec4942bf8b55b957a082373cbc006da63b7af1cc006f581695e0a84032e9b6d7f6717c71a2634c4825daac880b5e4ad192df2925

memory/4048-111-0x0000000072A60000-0x0000000073210000-memory.dmp

memory/4048-112-0x00000000049D0000-0x00000000049E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\JVtkAIr3B3Il.bat

MD5 c14bbcbe56190e189291bab0d0e9dbdb
SHA1 9b3d9936a25c7ce964da69dabc0fdd2d1accdc24
SHA256 70c4897513453f98efb358cb8b35e5e53ece77100c0ac38d51b331b6cd764fdf
SHA512 9d8d72ed5dc19c27632fd37558f3d60120d59874f4b7ad42cf9758267b76ec4a772a5fe8a28c76d9be0c3cc4573c1922d3d427c707e0f865adbc68bffdebc843

memory/4048-117-0x0000000072A60000-0x0000000073210000-memory.dmp

memory/4556-119-0x0000000072A60000-0x0000000073210000-memory.dmp

memory/4556-120-0x0000000005020000-0x0000000005030000-memory.dmp

C:\Users\Admin\AppData\Roaming\Logs\03-17-2024

MD5 f0d88031fe0aecd68f3aaf296fd0e647
SHA1 847fc72c1ad151d18208c23f8e47fccc64e4cf37
SHA256 482b3d1e369d8881befb7d2f995e4fe2d7fc44bd88eef083425f3cbd030ac5c5
SHA512 c8bd81cb2fdd807c82394f6c108d9e6878fa1fcd772e6ff8f2ea24685f590558cf6cc1649f756685550c391c9d4161a314345186babdf87698a322cf79176e02