Overview

overview

10

Static

static

10

446278b00e...89.exe

windows7-x64

10

446278b00e...89.exe

windows10-1703-x64

10

446278b00e...89.exe

windows10-2004-x64

10

446278b00e...89.exe

windows11-21h2-x64

10

Resubmissions

10-04-2024 02:13

240410-cnvjgsbh46 10

10-04-2024 02:13

240410-cntxysfb9y 10

10-04-2024 02:13

240410-cntbesbh45 10

10-04-2024 02:13

240410-cns1nabh44 10

27-06-2023 15:25

230627-stryjsfe8s 10

Analysis

  • max time kernel
    1784s
  • max time network
    1800s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-04-2024 02:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe

  • Size

    344KB

  • MD5

    aec814bf30dd191b641feef457a718ce

  • SHA1

    96c2bea5b416d10a2dae60acd2b7f9c7cebb8115

  • SHA256

    446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89

  • SHA512

    fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0

  • SSDEEP

    6144:SXRrO+JguvyIs1DkhmgPZw6JXAL5+9bbYZQ4:ir/9m3cYZQ

Score
10/10
gurcucollectiondiscoveryspywarestealer

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6202531839:AAHT41T-v1F7LRPMrYNhW3IEdF7Ab7I7uTM/sendMessage?chat_id=-1001903439899

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Checks computer location settings 2 TTPs 32 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 62 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
    "C:\Users\Admin\AppData\Local\Temp\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe" &&START "" "C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4048
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:2672
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:4176
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:3532
        • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
          "C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3644
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp53CD.tmp" -C "C:\Users\Admin\AppData\Local\8lxyt4fm8n"
            4⤵
              PID:452
            • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
              "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:4940
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3248
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2296
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3288
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4028
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3084
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2064
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3976
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4592
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2436
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:540
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2656
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3792
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1456
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4688
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2796
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:976
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2112
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:948
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1476
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2572
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4984
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:556
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:396
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3692
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1580
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2820
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:696
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5028
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3576
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1648
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4932
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1736
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1536
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3408
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:60
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3300
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4692
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:824
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3500
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:4932
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1760
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1772
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1952
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2904
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2696
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4292
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:632
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4164
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1100
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4724
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4888
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4416
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:244
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2312
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:836
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1880
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4772
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:928

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\8lxyt4fm8n\data\cached-microdesc-consensus.tmp
        Filesize

        2.7MB

        MD5

        814f8cba43d923834b0d0027591e52bf

        SHA1

        2814b4faa0221b252164fbf9586051c07faa050f

        SHA256

        406d96a4788b07a0c4bda0e289d04472bc92a13f3b5b51e7478d095986735597

        SHA512

        45d866ec699d731eb7a50669bfa2fb469652b92d92b4546d373777192bff9d2201095ec9e13079ff422b4a7a15175142aa7d2abb57aaf4262b3e837340677069

        Download Submit

      • C:\Users\Admin\AppData\Local\8lxyt4fm8n\data\cached-microdescs.new
        Filesize

        9.1MB

        MD5

        d1a0301acabb7cc5e80db990057ac5a8

        SHA1

        27859e4b7b48be77b0b18560bb0ea7955480281b

        SHA256

        9d0cbf2ac8c890f3376daac38cc8a34cc5590a5b093e7cd63476df7204075ef6

        SHA512

        7127ea6f4fa42d6e2c00f19c5ee4b7bfcb104090feae5cc7dbc167242fb084138058bfe8d2d16df4594b5e057fa12b264a839fa78b1e299cfe8a200e52100f6d

        Download Submit

      • C:\Users\Admin\AppData\Local\8lxyt4fm8n\host\hostname
        Filesize

        64B

        MD5

        b8fb5e27441d23d5fd29d510313874bb

        SHA1

        4eff309f6cc5f1215d09bf77ac67d1b061a0395d

        SHA256

        95d213a739683d1538279c90e0161c1abdd48a353a0189cda71a86ed3c94dc15

        SHA512

        8fd53dd586921fd1c5af30d73b3e984ff0ff882a4763d6d10ae05b2658869a5adabc3b36242c0c1a310f82e4b04da3bd0dba4b3c559931b6f399e4e4d95454a8

        Download Submit

      • C:\Users\Admin\AppData\Local\8lxyt4fm8n\port.dat
        Filesize

        4B

        MD5

        2e2079d63348233d91cad1fa9b1361e9

        SHA1

        9848d55438bbd5d4b5dc448271c638f368b4ca3b

        SHA256

        8118ace068f81646b3c4a6f76d1b041c725314fcbb4d76b8bd2d94312b771f32

        SHA512

        f5793e8c51a50751d8dfde45e4d91782410fc4e8d14f64609361291891cd458d729280b2a437304f95e3ae884d01549a496ffcc76b544e80f85ed046f6ac5ffb

        Download Submit

      • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
        Filesize

        7.4MB

        MD5

        88590909765350c0d70c6c34b1f31dd2

        SHA1

        129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

        SHA256

        46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

        SHA512

        a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

        Download Submit

      • C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt
        Filesize

        218B

        MD5

        f2b50067991aaa72037e1e0262b7a251

        SHA1

        86a08da078c825f7ff67c98a245018c5e35d8c11

        SHA256

        8d3cc46349102eb2c6d6139b22420262029222170a433ee781d39bf0acad4ea8

        SHA512

        56dfcfa3238f2397a5ca38b34048ac838146d6c0c81a5eb8833d7256ced3818fdbfc5646dd7a369a1e76dd7f67bad2b6f265d7cc8ad8327d87e99e0c784bb0c9

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe.log
        Filesize

        847B

        MD5

        3308a84a40841fab7dfec198b3c31af7

        SHA1

        4e7ab6336c0538be5dd7da529c0265b3b6523083

        SHA256

        169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e

        SHA512

        97521d5fb94efdc836ea2723098a1f26a7589a76af51358eee17292d29c9325baf53ad6b4496c5ca3e208d1c9b9ad6797a370e2ae378072fc68f5d6e8b73b198

        Download Submit

      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        Filesize

        344KB

        MD5

        aec814bf30dd191b641feef457a718ce

        SHA1

        96c2bea5b416d10a2dae60acd2b7f9c7cebb8115

        SHA256

        446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89

        SHA512

        fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmp53CD.tmp
        Filesize

        13.3MB

        MD5

        89d2d5811c1aff539bb355f15f3ddad0

        SHA1

        5bb3577c25b6d323d927200c48cd184a3e27c873

        SHA256

        b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

        SHA512

        39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

        Download Submit

      • memory/824-277-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/824-279-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1456-143-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1456-140-0x000001E86C330000-0x000001E86C340000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1456-139-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1476-169-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1476-171-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1480-326-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1648-237-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1648-235-0x00000171C6050000-0x00000171C6060000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1648-234-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1736-245-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1736-243-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1772-303-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1772-301-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2112-163-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2112-161-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2436-119-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2436-121-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2656-127-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2656-129-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2776-191-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2776-189-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2796-149-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2796-151-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2820-210-0x00000227D8C90000-0x00000227D8CA0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2820-209-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2820-212-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2904-316-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2904-314-0x00000228653C0000-0x00000228653D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2904-313-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3036-6-0x00007FF9749F0000-0x00007FF9754B1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3036-0-0x000001D46B7A0000-0x000001D46B7FC000-memory.dmp

        Filesize

        368KB

        Download

      • memory/3036-4-0x000001D46D400000-0x000001D46D410000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3036-3-0x00007FF9749F0000-0x00007FF9754B1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3084-98-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3084-100-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3248-45-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3248-42-0x000001B269AF0000-0x000001B269B00000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3248-41-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3288-81-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3288-82-0x0000026B73220000-0x0000026B73230000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3288-84-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3300-268-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3300-269-0x0000018FBA090000-0x0000018FBA0A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3300-271-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3408-252-0x000001B7479F0000-0x000001B747A00000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3408-254-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3408-251-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3644-11-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3644-47-0x000001E4EF7B0000-0x000001E4EF7C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3644-12-0x000001E4EF7B0000-0x000001E4EF7C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3644-46-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3692-201-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3692-203-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3976-109-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3976-106-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3976-107-0x000001FFCB520000-0x000001FFCB530000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4932-289-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4932-291-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4984-177-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4984-179-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5028-224-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5028-222-0x00007FF9746C0000-0x00007FF975181000-memory.dmp

        Filesize

        10.8MB

        Download