Overview

overview

10

Static

static

10

k2fef48209...18.exe

windows7-x64

10

k2fef48209...18.exe

windows10-1703-x64

10

k2fef48209...18.exe

windows10-2004-x64

10

k2fef48209...18.exe

windows11-21h2-x64

10

Resubmissions

10/04/2024, 02:38

240410-c4pceacb2410

10/04/2024, 02:37

240410-c4ne4scb2310

10/04/2024, 02:37

240410-c4llhsca9910

10/04/2024, 02:37

240410-c4jf6aca9810

14/10/2023, 01:31

231014-bxezqahg8w10

Analysis

  • max time kernel
    1797s
  • max time network
    1803s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 02:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
  • Size 339KB
  • Sample240410-c4pceacb24
  • SHA256 d71329c78c704ee9cc7133761b5e738a315e7eb784e348d7743a8a7366724e9f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
gurcucollectionspywarestealer

Malware Config

Extracted

Family

  • gurcu

C2

  • https://api.telegram.org/bot6193093056:AAHzyNGUGS9aUG6CCx6ENLoXpCFLzEQywIQ/sendMessage?chat_id=1098292643

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Checks computer location settings 2 TTPs 32 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 62 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
    "C:\Users\Admin\AppData\Local\Temp\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3752
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "k2fef4820980d3c2c1f2cce2f95e94f5e1c18" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe" &&START "" "C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:3116
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:4664
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "k2fef4820980d3c2c1f2cce2f95e94f5e1c18" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:4228
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          "C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:4476
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmpC7E.tmp" -C "C:\Users\Admin\AppData\Local\lcybndk48g"
            4⤵
              PID:2872
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:1428
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:4052
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4360
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2444
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:724
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4112
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3372
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2688
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2968
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:400
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3336
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2760
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:824
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:3788
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4632
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:1860
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3376 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:4596
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1624
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:3028
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2432
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:824
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4712
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:3512
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4200
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:4000
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4576
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:1856
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1484
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:2184
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1172
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:1600
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4436
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:992
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2184
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:4012
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:756
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:3200
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2044
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:1124
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3552
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:2760
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1548
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:2032
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2772
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:4200
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1404
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:2100
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1548
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:3876
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1608
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:4064
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3016
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:868
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2476
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:436
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1828
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:2892
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3496
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:5072
          • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3656
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:1984
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
            1⤵
              PID:4544
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k UnistackSvcGroup
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3612
            • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
              C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
              1⤵
              • Checks computer location settings
              • Executes dropped EXE
              PID:3800
              • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
                "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
                2⤵
                • Executes dropped EXE
                PID:896

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe.log
                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe.log
                  • Size 847B
                  • SHA256 169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e
                  • MD5 SHA1 SHA512
                  Submit Download

                  k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
                  • Path C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
                  • Size 339KB
                  • SHA256 d71329c78c704ee9cc7133761b5e738a315e7eb784e348d7743a8a7366724e9f
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  tmpC7E.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpC7E.tmp
                  • Size 13.3MB
                  • SHA256 b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  cached-certs
                  • Path C:\Users\Admin\AppData\Local\lcybndk48g\data\cached-certs
                  • Size 18KB
                  • SHA256 a9f4b0a3ce3e73d23bbccac99870af042a2e892d440b7d4dd2521507af5a777a
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  cached-microdesc-consensus.tmp
                  • Path C:\Users\Admin\AppData\Local\lcybndk48g\data\cached-microdesc-consensus.tmp
                  • Size 2.7MB
                  • SHA256 60b43cdce0f807f7891521f396f53def34a7d98986dbde0faa2a197189c587f3
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  cached-microdescs.new
                  • Path C:\Users\Admin\AppData\Local\lcybndk48g\data\cached-microdescs.new
                  • Size 9.3MB
                  • SHA256 ec17baa0ca7a4768ff62f19c0bd93d124543cd69880fa55113fbb4080ec9688f
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  hostname
                  • Path C:\Users\Admin\AppData\Local\lcybndk48g\host\hostname
                  • Size 64B
                  • SHA256 b99116975c3c4f41f28eeb0aae8f674b59d22e2bd79061073b77b8c16c2c63e3
                  • MD5 SHA1 SHA512
                  Submit Download

                  port.dat
                  • Path C:\Users\Admin\AppData\Local\lcybndk48g\port.dat
                  • Size 4B
                  • SHA256 43eb64f59e486941b18ab12531dd6a4c6d5cc41f9f246effea3f923e619fd7e4
                  • MD5 SHA1 SHA512
                  Submit Download

                  tor.exe
                  • Path C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
                  • Size 1.7MB
                  • SHA256 914b2120717ba047f099bc8105aa2a094731f0d5c0285d10bc867cdc3945ae3e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  tor.exe
                  • Path C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
                  • Size 7.4MB
                  • SHA256 46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  torrc.txt
                  • Path C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt
                  • Size 218B
                  • SHA256 69d3fb8910bd88eb7dbb31d1031469d4f84a9fac5b5d86060dcc90b109f77a4c
                  • MD5 SHA1 SHA512
                  Submit Download

                  memory/724-95-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/724-92-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/756-251-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/756-249-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/824-137-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/824-131-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/1172-214-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/1172-212-0x0000028573A50000-0x0000028573A60000-memory.dmp
                  Download

                  memory/1172-211-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/1404-312-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/1404-310-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/1484-199-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/1484-201-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/1548-286-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/1548-288-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/1548-320-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/1548-318-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/1608-332-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/1608-330-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/1624-147-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/1624-149-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/2044-261-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/2044-262-0x000001FA34530000-0x000001FA34540000-memory.dmp
                  Download

                  memory/2044-264-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/2184-239-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/2184-237-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/2432-159-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/2432-161-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/2476-350-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/2772-298-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/2772-300-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/2968-110-0x000001D929D70000-0x000001D929D80000-memory.dmp
                  Download

                  memory/2968-112-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/2968-109-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/3016-346-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/3016-348-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/3336-125-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/3336-122-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/3336-123-0x00000156DBAD0000-0x00000156DBAE0000-memory.dmp
                  Download

                  memory/3372-103-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/3372-101-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/3552-274-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/3552-276-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/3612-418-0x0000028F30F30000-0x0000028F30F31000-memory.dmp
                  Download

                  memory/3612-417-0x0000028F30E20000-0x0000028F30E21000-memory.dmp
                  Download

                  memory/3612-416-0x0000028F30E20000-0x0000028F30E21000-memory.dmp
                  Download

                  memory/3612-414-0x0000028F30DF0000-0x0000028F30DF1000-memory.dmp
                  Download

                  memory/3612-398-0x0000028F28A80000-0x0000028F28A90000-memory.dmp
                  Download

                  memory/3612-382-0x0000028F28980000-0x0000028F28990000-memory.dmp
                  Download

                  memory/3752-1-0x00007FFC8C830000-0x00007FFC8D2F1000-memory.dmp
                  Download

                  memory/3752-0-0x000001F2A88E0000-0x000001F2A893C000-memory.dmp
                  Download

                  memory/3752-2-0x000001F2C2EB0000-0x000001F2C2EC0000-memory.dmp
                  Download

                  memory/3752-6-0x00007FFC8C830000-0x00007FFC8D2F1000-memory.dmp
                  Download

                  memory/4200-181-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/4200-179-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/4360-86-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/4360-82-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/4360-83-0x000001F3FAED0000-0x000001F3FAEE0000-memory.dmp
                  Download

                  memory/4436-225-0x000002453E8D0000-0x000002453E8E0000-memory.dmp
                  Download

                  memory/4436-227-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/4436-224-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/4476-59-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/4476-12-0x0000022A7BC70000-0x0000022A7BC80000-memory.dmp
                  Download

                  memory/4476-11-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/4576-191-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/4576-193-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/4632-141-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/4632-139-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/4712-173-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download

                  memory/4712-171-0x00007FFC8AD40000-0x00007FFC8B801000-memory.dmp
                  Download