Malware Analysis Report

2024-10-18 21:24

Sample ID 240319-jn78xaea28
Target d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a
SHA256 d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a
Tags
asyncrat stormkitty default rat stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a

Threat Level: Known bad

The file d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a was found to be: Known bad.

Malicious Activity Summary

asyncrat stormkitty default rat stealer

StormKitty

StormKitty payload

AsyncRat

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Drops desktop.ini file(s)

Looks up geolocation information via web service

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Gathers network information

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-19 07:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-19 07:50

Reported

2024-03-19 07:52

Platform

win7-20240221-en

Max time kernel

146s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a.exe"

Signatures

AsyncRat

rat asyncrat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\6fcd8a8fe803777f3dbb82604d7347ca\Admin@UADPPTXT_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\6fcd8a8fe803777f3dbb82604d7347ca\Admin@UADPPTXT_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\6fcd8a8fe803777f3dbb82604d7347ca\Admin@UADPPTXT_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\6fcd8a8fe803777f3dbb82604d7347ca\Admin@UADPPTXT_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\6fcd8a8fe803777f3dbb82604d7347ca\Admin@UADPPTXT_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Looks up geolocation information via web service

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 596 set thread context of 1592 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2208 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a.exe C:\Windows\SysWOW64\WScript.exe
PID 2208 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a.exe C:\Windows\SysWOW64\WScript.exe
PID 2208 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a.exe C:\Windows\SysWOW64\WScript.exe
PID 2208 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a.exe C:\Windows\SysWOW64\WScript.exe
PID 2468 wrote to memory of 1344 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 1344 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 1344 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 1344 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 2000 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 2000 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 2000 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 2000 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1344 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1344 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1344 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1344 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2000 wrote to memory of 596 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe
PID 2000 wrote to memory of 596 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe
PID 2000 wrote to memory of 596 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe
PID 2000 wrote to memory of 596 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe
PID 2468 wrote to memory of 1108 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 1108 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 1108 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 1108 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 596 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 596 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 596 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 596 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 596 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 596 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 596 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1108 wrote to memory of 964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1108 wrote to memory of 964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1108 wrote to memory of 964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1108 wrote to memory of 964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 596 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 596 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1592 wrote to memory of 2752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 1592 wrote to memory of 2752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 1592 wrote to memory of 2752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 1592 wrote to memory of 2752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2752 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2752 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2752 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2752 wrote to memory of 2132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2752 wrote to memory of 2132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2752 wrote to memory of 2132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2752 wrote to memory of 2132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2752 wrote to memory of 1672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2752 wrote to memory of 1672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2752 wrote to memory of 1672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2752 wrote to memory of 1672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1592 wrote to memory of 980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 1592 wrote to memory of 980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 1592 wrote to memory of 980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 1592 wrote to memory of 980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 980 wrote to memory of 2908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 980 wrote to memory of 2908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 980 wrote to memory of 2908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 980 wrote to memory of 2908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 980 wrote to memory of 1348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 980 wrote to memory of 1348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 980 wrote to memory of 1348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a.exe

"C:\Users\Admin\AppData\Local\Temp\d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\dgmc.vbe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ipconfig /release

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c innlltqdtq.exe tirru.msc

C:\Windows\SysWOW64\ipconfig.exe

ipconfig /release

C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe

innlltqdtq.exe tirru.msc

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ipconfig /renew

C:\Windows\SysWOW64\ipconfig.exe

ipconfig /renew

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

Network

Country Destination Domain Proto
US 8.8.8.8:53 icanhazip.com udp
US 104.16.185.241:80 icanhazip.com tcp
US 8.8.8.8:53 api.mylnikov.org udp
US 172.67.196.114:443 api.mylnikov.org tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.184:80 apps.identrust.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\dgmc.vbe

MD5 223e418a5069dfcfb8d61f5b4519a123
SHA1 9d68dec1ac850812890321e836c9dfd207409776
SHA256 dbb4a26b43ad9039c07a966522f664ff9d95511d36e35c7f8b7b233e8bbbbd84
SHA512 d25d601e14ba9506c2423c2dd37770436fa894bc26d55b9bbae7bdb77846a6c96d9717f0e4605f72a6e20f327b0079aac6f0c129885e62b2ecd2412b67f13fee

\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe

MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

C:\Users\Admin\AppData\Local\Temp\RarSFX0\tirru.msc

MD5 5ace2edc02b9593447201783c575402f
SHA1 75accdd4bf79d1720585baaa01cb4365d3b56d8e
SHA256 2dc5684bef3b689c53b73b4a30270b58a8e30cc7c298c0c70c9e31bc9262c687
SHA512 316cb3188576f43776ec92c9fc454745c0ff95baaa813576873b9a197ea739f46cdd696ae865d468aaa787f138d0da3c7333788d6ebe5f6abeae5e6f83850530

C:\Users\Admin\AppData\Local\Temp\RarSFX0\jmsfmvjc.3gp

MD5 802a42df47211020f63e3a050b3dbcd8
SHA1 b7037c56899d4032c5fbfaf3b54d202cbf415615
SHA256 52904d235ea9092b2a021827b3249a954e800931c8e44b067fb79bb8887496f7
SHA512 048708da64d4fb7a04dda7d655b33cb3efa413f43e44f73643c8c95e68c7d6639dc137a75c950ccf817440c1e630765de8fce86fbfec911c605a596391b2989d

C:\Users\Admin\AppData\Local\Temp\RarSFX0\pmda.hes

MD5 042b73b18e96dd8e5848507d7ac60ddc
SHA1 cc789c7fca70c7a2cb3666a4c691cfafa74f3cb2
SHA256 d5f12fabd9bab67d33cf3e26a325c7f720dc9d58b505605c5b17a2e26b7b7437
SHA512 8c9bd44c14960f587abc387fe817be479e02c2b7c503b849d441101f2f248460d0452040f646c1832b19a5690db47b43687250e295835abe7cee4900f0768969

memory/1592-56-0x00000000012A0000-0x00000000022A0000-memory.dmp

memory/1592-57-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1592-58-0x00000000012A0000-0x00000000022A0000-memory.dmp

memory/1592-60-0x00000000012A0000-0x00000000022A0000-memory.dmp

memory/1592-62-0x00000000012A0000-0x00000000022A0000-memory.dmp

memory/1592-63-0x00000000012A0000-0x00000000012D0000-memory.dmp

memory/1592-64-0x00000000731E0000-0x00000000738CE000-memory.dmp

memory/1592-65-0x0000000000CE0000-0x0000000000D20000-memory.dmp

memory/1592-151-0x0000000000CE0000-0x0000000000D20000-memory.dmp

memory/1592-155-0x00000000731E0000-0x00000000738CE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab1935.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

C:\Users\Admin\AppData\Local\Temp\Tar1C09.tmp

MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3f57c6c591f604748c658dd0fdda2f2a
SHA1 403a8fcc80d534c388fc706c4f63ea4dd5f47ea2
SHA256 aa33505e3d6cac84e0fea3f8999f702e5fd0cfefe90471e8634c883bd6b45646
SHA512 6402d88fbe940525d37b3a557d3fcd68676f4c2c7c3bb98d5719dd08a7d68818ccf9c91f604376326e09a3fc48b71a1db507f55636d8ad78ff7a9b5613d8d5f4

memory/1592-222-0x0000000000CE0000-0x0000000000D20000-memory.dmp

C:\Users\Admin\AppData\Local\d5011100ca42dc188689c88b9f9f8a1d\msgid.dat

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

memory/1592-228-0x0000000000CE0000-0x0000000000D20000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-19 07:50

Reported

2024-03-19 07:52

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a.exe"

Signatures

AsyncRat

rat asyncrat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\ae2b3b02108afcee055284706dff9e4a\Admin@OAILVCNY_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\ae2b3b02108afcee055284706dff9e4a\Admin@OAILVCNY_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\ae2b3b02108afcee055284706dff9e4a\Admin@OAILVCNY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\ae2b3b02108afcee055284706dff9e4a\Admin@OAILVCNY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\ae2b3b02108afcee055284706dff9e4a\Admin@OAILVCNY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\ae2b3b02108afcee055284706dff9e4a\Admin@OAILVCNY_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\ae2b3b02108afcee055284706dff9e4a\Admin@OAILVCNY_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\ae2b3b02108afcee055284706dff9e4a\Admin@OAILVCNY_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Looks up geolocation information via web service

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 212 set thread context of 3888 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3756 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a.exe C:\Windows\SysWOW64\WScript.exe
PID 3756 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a.exe C:\Windows\SysWOW64\WScript.exe
PID 3756 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a.exe C:\Windows\SysWOW64\WScript.exe
PID 4500 wrote to memory of 1624 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4500 wrote to memory of 1624 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4500 wrote to memory of 1624 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 1696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1624 wrote to memory of 1696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1624 wrote to memory of 1696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 3492 wrote to memory of 212 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe
PID 3492 wrote to memory of 212 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe
PID 3492 wrote to memory of 212 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe
PID 4500 wrote to memory of 724 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4500 wrote to memory of 724 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4500 wrote to memory of 724 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 724 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 724 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 724 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 212 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 212 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 212 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 212 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 212 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3888 wrote to memory of 1900 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 3888 wrote to memory of 1900 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 3888 wrote to memory of 1900 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 3732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1900 wrote to memory of 3732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1900 wrote to memory of 3732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1900 wrote to memory of 4508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1900 wrote to memory of 4508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1900 wrote to memory of 4508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1900 wrote to memory of 1612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1900 wrote to memory of 1612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1900 wrote to memory of 1612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3888 wrote to memory of 648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 3888 wrote to memory of 648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 3888 wrote to memory of 648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 648 wrote to memory of 216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 648 wrote to memory of 216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 648 wrote to memory of 216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 648 wrote to memory of 3668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 648 wrote to memory of 3668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 648 wrote to memory of 3668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a.exe

"C:\Users\Admin\AppData\Local\Temp\d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\dgmc.vbe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ipconfig /release

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c innlltqdtq.exe tirru.msc

C:\Windows\SysWOW64\ipconfig.exe

ipconfig /release

C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe

innlltqdtq.exe tirru.msc

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ipconfig /renew

C:\Windows\SysWOW64\ipconfig.exe

ipconfig /renew

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3208 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
NL 142.250.179.170:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 170.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 icanhazip.com udp
US 104.16.185.241:80 icanhazip.com tcp
US 8.8.8.8:53 api.mylnikov.org udp
US 8.8.8.8:53 241.185.16.104.in-addr.arpa udp
US 104.21.44.66:443 api.mylnikov.org tcp
US 8.8.8.8:53 66.44.21.104.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:8808 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:8808 tcp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp
N/A 127.0.0.1:8808 tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\dgmc.vbe

MD5 223e418a5069dfcfb8d61f5b4519a123
SHA1 9d68dec1ac850812890321e836c9dfd207409776
SHA256 dbb4a26b43ad9039c07a966522f664ff9d95511d36e35c7f8b7b233e8bbbbd84
SHA512 d25d601e14ba9506c2423c2dd37770436fa894bc26d55b9bbae7bdb77846a6c96d9717f0e4605f72a6e20f327b0079aac6f0c129885e62b2ecd2412b67f13fee

C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe

MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

C:\Users\Admin\AppData\Local\Temp\RarSFX0\tirru.msc

MD5 e8dfcdd500284f9f73b272ec8e476c6e
SHA1 569b2a004b52be018b77999c928f526bb89d45e8
SHA256 f9f2e535cce94a5851371d573da51e72ab78ee20924e34dabbf655831306ab6d
SHA512 3f06fa46a6b7e97b90b1bb8fa92566e47b22a6b51e6c04eef0bca2d4df41241be61e72dac181cc12c46a26685108f75877efb2cea06ef52d004fbf3b26f99fd3

C:\Users\Admin\AppData\Local\Temp\RarSFX0\jmsfmvjc.3gp

MD5 802a42df47211020f63e3a050b3dbcd8
SHA1 b7037c56899d4032c5fbfaf3b54d202cbf415615
SHA256 52904d235ea9092b2a021827b3249a954e800931c8e44b067fb79bb8887496f7
SHA512 048708da64d4fb7a04dda7d655b33cb3efa413f43e44f73643c8c95e68c7d6639dc137a75c950ccf817440c1e630765de8fce86fbfec911c605a596391b2989d

C:\Users\Admin\AppData\Local\Temp\RarSFX0\pmda.hes

MD5 042b73b18e96dd8e5848507d7ac60ddc
SHA1 cc789c7fca70c7a2cb3666a4c691cfafa74f3cb2
SHA256 d5f12fabd9bab67d33cf3e26a325c7f720dc9d58b505605c5b17a2e26b7b7437
SHA512 8c9bd44c14960f587abc387fe817be479e02c2b7c503b849d441101f2f248460d0452040f646c1832b19a5690db47b43687250e295835abe7cee4900f0768969

memory/3888-55-0x0000000001390000-0x0000000002390000-memory.dmp

memory/3888-56-0x0000000071E20000-0x00000000725D0000-memory.dmp

memory/3888-57-0x0000000001390000-0x00000000013C0000-memory.dmp

memory/3888-58-0x000000000C520000-0x000000000C530000-memory.dmp

memory/3888-77-0x000000000C8A0000-0x000000000C906000-memory.dmp

memory/3888-78-0x0000000071E20000-0x00000000725D0000-memory.dmp

memory/3888-79-0x000000000C520000-0x000000000C530000-memory.dmp

C:\Users\Admin\AppData\Local\ae2b3b02108afcee055284706dff9e4a\Admin@OAILVCNY_en-US\Browsers\Firefox\Bookmarks.txt

MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

C:\Users\Admin\AppData\Local\ae2b3b02108afcee055284706dff9e4a\Admin@OAILVCNY_en-US\System\Process.txt

MD5 a890f2fffa1286effce94aa55ca2596d
SHA1 7d07d672e4156aea1cfa20f0d684ef726147c4b6
SHA256 d36e0621419328daeb5178d5620c0f6435a1568b9a0cce143e20aab779fb0ae7
SHA512 ca31b2902f9aa594be3b8283c8d354c667c1a219f61bf9ee19919b9335b73178f7d40fb69dbe97c6f7f8ca9dffb569cbfe867d91bdc352be6d88a778c7628319

memory/3888-232-0x000000000C520000-0x000000000C530000-memory.dmp

memory/3888-234-0x000000000D3B0000-0x000000000D442000-memory.dmp

memory/3888-235-0x000000000DA00000-0x000000000DFA4000-memory.dmp

memory/3888-239-0x000000000CC70000-0x000000000CC7A000-memory.dmp

C:\Users\Admin\AppData\Local\ae2b3b02108afcee055284706dff9e4a\msgid.dat

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

memory/3888-245-0x000000000C520000-0x000000000C530000-memory.dmp