Overview

overview

10

Static

static

10

446278b00e...89.exe

windows7-x64

10

446278b00e...89.exe

windows10-1703-x64

10

446278b00e...89.exe

windows10-2004-x64

10

446278b00e...89.exe

windows11-21h2-x64

10

Resubmissions

10-04-2024 02:13

240410-cnvjgsbh46 10

10-04-2024 02:13

240410-cntxysfb9y 10

10-04-2024 02:13

240410-cntbesbh45 10

10-04-2024 02:13

240410-cns1nabh44 10

27-06-2023 15:25

230627-stryjsfe8s 10

Analysis

  • max time kernel
    1798s
  • max time network
    1800s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10-04-2024 02:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe

  • Size

    344KB

  • MD5

    aec814bf30dd191b641feef457a718ce

  • SHA1

    96c2bea5b416d10a2dae60acd2b7f9c7cebb8115

  • SHA256

    446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89

  • SHA512

    fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0

  • SSDEEP

    6144:SXRrO+JguvyIs1DkhmgPZw6JXAL5+9bbYZQ4:ir/9m3cYZQ

Score
10/10
gurcucollectiondiscoveryspywarestealer

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6202531839:AAHT41T-v1F7LRPMrYNhW3IEdF7Ab7I7uTM/sendMessage?chat_id=-1001903439899

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Executes dropped EXE 62 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
    "C:\Users\Admin\AppData\Local\Temp\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe" &&START "" "C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3984
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:2756
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:2796
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:3852
        • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
          "C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4472
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp465F.tmp" -C "C:\Users\Admin\AppData\Local\8lxyt4fm8n"
            4⤵
              PID:4852
            • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
              "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:660
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2784
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3692
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1400
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4344
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2728
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1536
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1052
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3308
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3412
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4656
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3852
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2384
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2264
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3956
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4184
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3516
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1848
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4640
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:940
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1932
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4744
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4500
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2396
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3352
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4656
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1064
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4832
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:832
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2740
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1536
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3084
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1208
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4684
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:112
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1464
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4984
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3160
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:8
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1644
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:1524
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3304
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4172
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4296
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5060
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2000
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5044
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1212
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1896
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2044
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:428
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4752
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3168
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3280
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1232
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:496
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3580
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4544
      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1108
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1520

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\8lxyt4fm8n\data\cached-microdesc-consensus
        Filesize

        2.7MB

        MD5

        814f8cba43d923834b0d0027591e52bf

        SHA1

        2814b4faa0221b252164fbf9586051c07faa050f

        SHA256

        406d96a4788b07a0c4bda0e289d04472bc92a13f3b5b51e7478d095986735597

        SHA512

        45d866ec699d731eb7a50669bfa2fb469652b92d92b4546d373777192bff9d2201095ec9e13079ff422b4a7a15175142aa7d2abb57aaf4262b3e837340677069

        Download Submit

      • C:\Users\Admin\AppData\Local\8lxyt4fm8n\data\cached-microdescs.new
        Filesize

        9.4MB

        MD5

        088a4738778a621443dbc42cfcc8e770

        SHA1

        4d2e9518962d25c3e50fd11efdbfb5109eb0bf54

        SHA256

        5d9023a48dc349b1c83beca3cb70bb7de5d6f81160cc70041444f53738dba023

        SHA512

        5820f5cbf980272bf795b04b2f7d37b6ca8ee7e688f5ae37a5c877519293aecda82beb39ee4e75f1f10dcb7b831c260709f32419f2bbb47af6283d21a890dc46

        Download Submit

      • C:\Users\Admin\AppData\Local\8lxyt4fm8n\host\hostname
        Filesize

        64B

        MD5

        ae9d896047ba97a7f8a625224def5145

        SHA1

        d785b0e14bcd5d7a436abcf3b91212de3bfc355d

        SHA256

        db4af14d936a375009436da5b8ac3d8ccd908995c54249e78f9d129baa72e30b

        SHA512

        4613e09304ebe86434db72fb0d414bd4d434859faf7cd0cb175def3b10a82a59d25e8bbc423801a22f9542d37391d2dbb895f9886c187f72ee6699fc3f509d72

        Download Submit

      • C:\Users\Admin\AppData\Local\8lxyt4fm8n\port.dat
        Filesize

        4B

        MD5

        a381c2c35c9157f6b67fd07d5a200ae1

        SHA1

        9d985188444175d30c709f634f65967f67f1ae22

        SHA256

        6ae2718959c46e34ae3c07be90b553c52e64af99c12d7bf41e393247249f25ab

        SHA512

        6030cae94624657ccecd1d514a16c76b25768a91b8a4a3c1162b5df32d7f402b0739dd52c11b5bb79ae404bec7b0b2233fb6a4c770e06bee51908fb46aec1e3e

        Download Submit

      • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
        Filesize

        7.4MB

        MD5

        88590909765350c0d70c6c34b1f31dd2

        SHA1

        129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

        SHA256

        46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

        SHA512

        a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

        Download Submit

      • C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt
        Filesize

        218B

        MD5

        b348503700419d731730b48ea219e182

        SHA1

        40b8d43d84232faa3b96f0d7e39ad08febcf14c4

        SHA256

        12ab2b96d1d4257687c24eb0ad51c3147067c5c7a19ab8a0aa824116802255d0

        SHA512

        a245141289850c7ed3e448ad540219a4ef3fba1a87147dc8d24dee6a2435f2e07173c915a9e0e348e5c1bde532d3b6b07fdb0f8dbf448cbfab196c86dd6a0737

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe.log
        Filesize

        847B

        MD5

        486ebddc86ea8b3e965d390d22283a23

        SHA1

        eaffc047f067084867e8575c576a9ec60e094ba8

        SHA256

        50a57273ecb794e53b0622eb841341e2643c11f53fa47356e6e754ab2268171d

        SHA512

        0a50ba02250b38355a6f4fb94e40c61258a74031d9aea7cdf675f3e068f39ec0748ecf292aaf2f94b1963b9d66516ee79aa6c552617048e248774af0ff07189d

        Download Submit

      • C:\Users\Admin\AppData\Local\Nvidia\446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
        Filesize

        344KB

        MD5

        aec814bf30dd191b641feef457a718ce

        SHA1

        96c2bea5b416d10a2dae60acd2b7f9c7cebb8115

        SHA256

        446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89

        SHA512

        fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmp465F.tmp
        Filesize

        13.3MB

        MD5

        89d2d5811c1aff539bb355f15f3ddad0

        SHA1

        5bb3577c25b6d323d927200c48cd184a3e27c873

        SHA256

        b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

        SHA512

        39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

        Download Submit

      • memory/8-272-0x000001C177E50000-0x000001C177E60000-memory.dmp

        Filesize

        64KB

        Download

      • memory/8-274-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/8-271-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/112-250-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/112-252-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/832-216-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/832-217-0x000001E5D61A0000-0x000001E5D61B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/832-219-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/940-172-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/940-173-0x000002BEEA9C0000-0x000002BEEA9D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/940-175-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1052-107-0x00000228DDA50000-0x00000228DDA60000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1052-106-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1052-109-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1064-212-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1064-214-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1208-242-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1208-244-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1400-81-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1400-82-0x000002882C450000-0x000002882C460000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1400-88-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1536-229-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1536-230-0x000001546E740000-0x000001546E750000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1536-232-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1848-160-0x000001D92FCD0000-0x000001D92FCE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1848-162-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1848-159-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2264-138-0x0000020627500000-0x0000020627510000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2264-140-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2264-137-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2484-0-0x000001FF20C30000-0x000001FF20C8C000-memory.dmp

        Filesize

        368KB

        Download

      • memory/2484-6-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2484-2-0x000001FF3B300000-0x000001FF3B310000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2484-1-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2552-187-0x0000012CB0630000-0x0000012CB0640000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2552-186-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2552-189-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2728-98-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2728-100-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2784-45-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2784-41-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2784-42-0x0000028073F40000-0x0000028073F50000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3352-200-0x00000205F0E40000-0x00000205F0E50000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3352-202-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3352-199-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3412-112-0x0000023477210000-0x0000023477220000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3412-111-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3412-114-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3852-131-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3852-128-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3852-129-0x00000255C9210000-0x00000255C9220000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4184-149-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4184-147-0x000001F5B12B0000-0x000001F5B12C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4184-146-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4472-62-0x0000019578350000-0x0000019578360000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4472-54-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4472-12-0x0000019578350000-0x0000019578360000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4472-11-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4744-182-0x000002E44F700000-0x000002E44F710000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4744-181-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4744-184-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4984-259-0x000001FF254C0000-0x000001FF254D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4984-258-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4984-261-0x00007FF9772B0000-0x00007FF977D72000-memory.dmp

        Filesize

        10.8MB

        Download