Overview

overview

10

Static

static

10

Xd2c386a3a...9a.exe

windows7-x64

10

Xd2c386a3a...9a.exe

windows10-1703-x64

10

Xd2c386a3a...9a.exe

windows10-2004-x64

10

Xd2c386a3a...9a.exe

windows11-21h2-x64

10

Resubmissions

10-04-2024 02:25

240410-cwlljsbh99 10

10-04-2024 02:25

240410-cwlasafc5v 10

10-04-2024 02:25

240410-cwkn9afc5t 10

10-04-2024 02:25

240410-cwkdgsfc5s 10

14-10-2023 04:25

231014-e12vfagc2y 10

Analysis

  • max time kernel
    1795s
  • max time network
    1801s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10-04-2024 02:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe

  • Size

    289KB

  • MD5

    88cfc2ccc0575567122d1d233f9eb1c3

  • SHA1

    4be67d0d801197f88c14d62f4495f17e89fc471f

  • SHA256

    41505242cdbf259aada52b773daeec33d239e4aefd685ba9e406d2cf2f9871a4

  • SHA512

    a2dd9ab7a2fe2a6d596c78394f65956f3e8973940229b305e2d763be69ff9f27b1450b5e08ca57cd0886a873fb663daad20ca94d9262a6c80a582dfc5f2e42b7

  • SSDEEP

    6144:uHClm6SWPoK5Z0EwVSmRPQp+L5v9bbSUpi:uHCnZxb8hLLSUpi

Score
10/10
gurcucollectiondiscoveryspywarestealer

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6176004110:AAFKA5be4dMwA848HWxzYIzrzzOGIHMOJGc/sendMessage?chat_id=615133582

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Executes dropped EXE 62 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
    "C:\Users\Admin\AppData\Local\Temp\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "Xd2c386a3a6edfe99de10f6ce6b3659c4809a" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe" &&START "" "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2060
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:872
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:468
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "Xd2c386a3a6edfe99de10f6ce6b3659c4809a" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:4960
        • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3512
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp9153.tmp" -C "C:\Users\Admin\AppData\Local\xdh16uwiax"
            4⤵
              PID:5064
            • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
              "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:2256
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1216
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2228
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4440
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1028
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:652
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4868
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:992
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4512
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4840
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2332
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1532
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1384
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2100
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4176
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3480
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3020
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2556
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:416
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4700
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:460
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3188
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:992
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4384
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3008
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3900
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1960
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4676
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3980
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4668
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4808
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2376
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4400
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3900
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2400
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4292
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3388
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3808
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4112
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:632
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1976
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1768
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4292
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3500
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1608
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2096
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2788
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:652
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1112
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2000
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2380
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1840
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4172
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:5048
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1396
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4944
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:864
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:220
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1964

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe.log
        Filesize

        847B

        MD5

        486ebddc86ea8b3e965d390d22283a23

        SHA1

        eaffc047f067084867e8575c576a9ec60e094ba8

        SHA256

        50a57273ecb794e53b0622eb841341e2643c11f53fa47356e6e754ab2268171d

        SHA512

        0a50ba02250b38355a6f4fb94e40c61258a74031d9aea7cdf675f3e068f39ec0748ecf292aaf2f94b1963b9d66516ee79aa6c552617048e248774af0ff07189d

        Download Submit

      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        Filesize

        289KB

        MD5

        88cfc2ccc0575567122d1d233f9eb1c3

        SHA1

        4be67d0d801197f88c14d62f4495f17e89fc471f

        SHA256

        41505242cdbf259aada52b773daeec33d239e4aefd685ba9e406d2cf2f9871a4

        SHA512

        a2dd9ab7a2fe2a6d596c78394f65956f3e8973940229b305e2d763be69ff9f27b1450b5e08ca57cd0886a873fb663daad20ca94d9262a6c80a582dfc5f2e42b7

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmp9153.tmp
        Filesize

        13.3MB

        MD5

        89d2d5811c1aff539bb355f15f3ddad0

        SHA1

        5bb3577c25b6d323d927200c48cd184a3e27c873

        SHA256

        b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

        SHA512

        39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

        Download Submit

      • C:\Users\Admin\AppData\Local\xdh16uwiax\data\cached-microdesc-consensus
        Filesize

        2.7MB

        MD5

        a0db8a87f7b723266c8b04255da46b06

        SHA1

        4df00ea56d22d88f3d2e005ef66bad5b3ef92ebf

        SHA256

        60b43cdce0f807f7891521f396f53def34a7d98986dbde0faa2a197189c587f3

        SHA512

        41b8fc467d11af7ca6a42c7e94d1b8295ab3ae5d6d186b4f378e6e079440520e8324b695da1134beb2bc1697d2491edcc70c1b75ab6fc66b9c1cb2ecbcdb4a7d

        Download Submit

      • C:\Users\Admin\AppData\Local\xdh16uwiax\data\cached-microdescs.new
        Filesize

        5.4MB

        MD5

        f72285a0d49c10beaee015c7cab377bd

        SHA1

        f6eef54016949bb2591358af05267c1a51486737

        SHA256

        04963c7b167123a18b2e8dc5a98661133d60aa21d9a809c33099d8fab328b2b7

        SHA512

        1c25765355aabb8fcba6f49887d2b8fed427abfd48532d06f94570d4da5bb4ddad60a556a7932a53e3a46efec1e961abd35d976669d6f4745e15f6696e712905

        Download Submit

      • C:\Users\Admin\AppData\Local\xdh16uwiax\host\hostname
        Filesize

        64B

        MD5

        ecf226f49f4449cf6618017e9b0a2b6f

        SHA1

        0e9f32f3ec570ff49006ae255e9ea5ee2b7015e6

        SHA256

        d4a2076173aceb260f45ad4269152ebfb9b4081ab7856096f94cc79ff7676156

        SHA512

        43dcfb95eeab061444296a2d81ba4631b54c25c151c6c4b5a156a64661f07c8a3a800f1491628c2be8b008c9b2e4c994e65b2de72b90453d44c7693badee26c1

        Download Submit

      • C:\Users\Admin\AppData\Local\xdh16uwiax\port.dat
        Filesize

        4B

        MD5

        28ce9bc954876829eeb56ff46da8e1ab

        SHA1

        f47df51ff80ec5044c45d5d466a9b5cdb230eb07

        SHA256

        38099af079394374e008c94fece05081917547be767de7ca70c87efba133da07

        SHA512

        f9aea6cf58b1600f7dbb5c9438cb83bdc0a215bfb77605f3de72350b11a9e5b3177f494e9bcaf9225931f9fb3af8423776a78cb892d02c8b8fa9f9ced1047779

        Download Submit

      • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
        Filesize

        7.4MB

        MD5

        88590909765350c0d70c6c34b1f31dd2

        SHA1

        129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

        SHA256

        46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

        SHA512

        a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

        Download Submit

      • C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt
        Filesize

        218B

        MD5

        cd3a41ec58193b28aac9a953ef175bec

        SHA1

        08c36978a00e5a7df449c78bbe9f00e7e54c8fba

        SHA256

        c5bd1cdc22ad67041fe118d375876be5e2765d9c7db192cf8427950596966010

        SHA512

        8d27e44eed6118ef65a24a6c5925e8584aa2bad07c0419a1c10ee31d8813a338ee302a56d56f6b8409be30ef82bccf77286005691b2b8151439815f58cc1454b

        Download Submit

      • memory/220-0-0x000001DDCA830000-0x000001DDCA87E000-memory.dmp

        Filesize

        312KB

        Download

      • memory/220-1-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/220-6-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/220-2-0x000001DDCC4B0000-0x000001DDCC4C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/652-110-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/652-112-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/992-126-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/992-124-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1216-50-0x000001F126030000-0x000001F126040000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1216-53-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1216-49-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1480-334-0x000001F71B2C0000-0x000001F71B2D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1480-333-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1480-336-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1532-156-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1532-158-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1608-451-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1976-421-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1976-418-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1976-419-0x0000028D00E00000-0x0000028D00E10000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2100-176-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2100-174-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2400-367-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2400-369-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2556-211-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2556-213-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3188-248-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3188-250-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3388-387-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3388-385-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3480-192-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3480-193-0x0000027E25DF0000-0x0000027E25E00000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3480-195-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3512-54-0x00000163FBD50000-0x00000163FBF03000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/3512-11-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3512-60-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3512-12-0x00000163FAE70000-0x00000163FAE80000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3512-72-0x00000163FAE70000-0x00000163FAE80000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3900-280-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3900-283-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3900-281-0x00000220694D0000-0x00000220694E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4112-399-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4112-402-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4112-400-0x000001C563530000-0x000001C563540000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4292-435-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4292-433-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4384-264-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4384-262-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4400-352-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4400-353-0x0000022CEA130000-0x0000022CEA140000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4400-355-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4440-94-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4440-92-0x000001D97E010000-0x000001D97E020000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4440-91-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4668-321-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4668-319-0x000001E3B5CD0000-0x000001E3B5CE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4668-318-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4676-300-0x0000018A8F430000-0x0000018A8F440000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4676-302-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4676-299-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4700-229-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4700-230-0x0000022AAB800000-0x0000022AAB810000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4700-232-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4840-142-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4840-144-0x00007FFFC1470000-0x00007FFFC1F32000-memory.dmp

        Filesize

        10.8MB

        Download