Overview

overview

10

Static

static

10

Xd2c386a3a...9a.exe

windows7-x64

10

Xd2c386a3a...9a.exe

windows10-1703-x64

10

Xd2c386a3a...9a.exe

windows10-2004-x64

10

Xd2c386a3a...9a.exe

windows11-21h2-x64

10

Resubmissions

10/04/2024, 02:25

240410-cwlljsbh9910

10/04/2024, 02:25

240410-cwlasafc5v10

10/04/2024, 02:25

240410-cwkn9afc5t10

10/04/2024, 02:25

240410-cwkdgsfc5s10

14/10/2023, 04:25

231014-e12vfagc2y10

Analysis

  • max time kernel
    1795s
  • max time network
    1801s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10/04/2024, 02:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
  • Size 289KB
  • Sample240410-cwlljsbh99
  • SHA256 41505242cdbf259aada52b773daeec33d239e4aefd685ba9e406d2cf2f9871a4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
gurcucollectiondiscoveryspywarestealer

Malware Config

Extracted

Family

  • gurcu

C2

  • https://api.telegram.org/bot6176004110:AAFKA5be4dMwA848HWxzYIzrzzOGIHMOJGc/sendMessage?chat_id=615133582

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Executes dropped EXE 62 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
    "C:\Users\Admin\AppData\Local\Temp\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "Xd2c386a3a6edfe99de10f6ce6b3659c4809a" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe" &&START "" "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2060
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:872
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:468
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "Xd2c386a3a6edfe99de10f6ce6b3659c4809a" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:4960
        • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3512
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp9153.tmp" -C "C:\Users\Admin\AppData\Local\xdh16uwiax"
            4⤵
              PID:5064
            • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
              "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:2256
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1216
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2228
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4440
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1028
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:652
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4868
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:992
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4512
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4840
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2332
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1532
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1384
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2100
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4176
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3480
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3020
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2556
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:416
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4700
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:460
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3188
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:992
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4384
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3008
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3900
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1960
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4676
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3980
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4668
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4808
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2376
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4400
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3900
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2400
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4292
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3388
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3808
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4112
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:632
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1976
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1768
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4292
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3500
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1608
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2096
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2788
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:652
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1112
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2000
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2380
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1840
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4172
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:5048
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1396
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4944
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:864
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:220
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1964

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe.log
            • Size 847B
            • SHA256 50a57273ecb794e53b0622eb841341e2643c11f53fa47356e6e754ab2268171d
            • MD5 SHA1 SHA512
            Submit Download

            Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
            • Path C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
            • Size 289KB
            • SHA256 41505242cdbf259aada52b773daeec33d239e4aefd685ba9e406d2cf2f9871a4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            tmp9153.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\tmp9153.tmp
            • Size 13.3MB
            • SHA256 b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cached-microdesc-consensus
            • Path C:\Users\Admin\AppData\Local\xdh16uwiax\data\cached-microdesc-consensus
            • Size 2.7MB
            • SHA256 60b43cdce0f807f7891521f396f53def34a7d98986dbde0faa2a197189c587f3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cached-microdescs.new
            • Path C:\Users\Admin\AppData\Local\xdh16uwiax\data\cached-microdescs.new
            • Size 5.4MB
            • SHA256 04963c7b167123a18b2e8dc5a98661133d60aa21d9a809c33099d8fab328b2b7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            hostname
            • Path C:\Users\Admin\AppData\Local\xdh16uwiax\host\hostname
            • Size 64B
            • SHA256 d4a2076173aceb260f45ad4269152ebfb9b4081ab7856096f94cc79ff7676156
            • MD5 SHA1 SHA512
            Submit Download

            port.dat
            • Path C:\Users\Admin\AppData\Local\xdh16uwiax\port.dat
            • Size 4B
            • SHA256 38099af079394374e008c94fece05081917547be767de7ca70c87efba133da07
            • MD5 SHA1 SHA512
            Submit Download

            tor.exe
            • Path C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
            • Size 7.4MB
            • SHA256 46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            torrc.txt
            • Path C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt
            • Size 218B
            • SHA256 c5bd1cdc22ad67041fe118d375876be5e2765d9c7db192cf8427950596966010
            • MD5 SHA1 SHA512
            Submit Download

            memory/220-0-0x000001DDCA830000-0x000001DDCA87E000-memory.dmp
            Download

            memory/220-1-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/220-6-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/220-2-0x000001DDCC4B0000-0x000001DDCC4C0000-memory.dmp
            Download

            memory/652-110-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/652-112-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/992-126-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/992-124-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/1216-50-0x000001F126030000-0x000001F126040000-memory.dmp
            Download

            memory/1216-53-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/1216-49-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/1480-334-0x000001F71B2C0000-0x000001F71B2D0000-memory.dmp
            Download

            memory/1480-333-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/1480-336-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/1532-156-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/1532-158-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/1608-451-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/1976-421-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/1976-418-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/1976-419-0x0000028D00E00000-0x0000028D00E10000-memory.dmp
            Download

            memory/2100-176-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/2100-174-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/2400-367-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/2400-369-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/2556-211-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/2556-213-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/3188-248-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/3188-250-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/3388-387-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/3388-385-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/3480-192-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/3480-193-0x0000027E25DF0000-0x0000027E25E00000-memory.dmp
            Download

            memory/3480-195-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/3512-54-0x00000163FBD50000-0x00000163FBF03000-memory.dmp
            Download

            memory/3512-11-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/3512-60-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/3512-12-0x00000163FAE70000-0x00000163FAE80000-memory.dmp
            Download

            memory/3512-72-0x00000163FAE70000-0x00000163FAE80000-memory.dmp
            Download

            memory/3900-280-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/3900-283-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/3900-281-0x00000220694D0000-0x00000220694E0000-memory.dmp
            Download

            memory/4112-399-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4112-402-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4112-400-0x000001C563530000-0x000001C563540000-memory.dmp
            Download

            memory/4292-435-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4292-433-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4384-264-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4384-262-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4400-352-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4400-353-0x0000022CEA130000-0x0000022CEA140000-memory.dmp
            Download

            memory/4400-355-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4440-94-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4440-92-0x000001D97E010000-0x000001D97E020000-memory.dmp
            Download

            memory/4440-91-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4668-321-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4668-319-0x000001E3B5CD0000-0x000001E3B5CE0000-memory.dmp
            Download

            memory/4668-318-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4676-300-0x0000018A8F430000-0x0000018A8F440000-memory.dmp
            Download

            memory/4676-302-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4676-299-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4700-229-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4700-230-0x0000022AAB800000-0x0000022AAB810000-memory.dmp
            Download

            memory/4700-232-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4840-142-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download

            memory/4840-144-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp
            Download