Overview

overview

10

Static

static

10

dba803bf09...JC.exe

windows7-x64

10

dba803bf09...JC.exe

windows10-1703-x64

10

dba803bf09...JC.exe

windows10-2004-x64

10

dba803bf09...JC.exe

windows11-21h2-x64

10

Resubmissions

10-04-2024 02:55

240410-dektcsff5x 10

10-04-2024 02:54

240410-dd6z7scc89 10

10-04-2024 02:54

240410-dd6pfacc88 10

10-04-2024 02:54

240410-dd53xacc87 10

09-09-2023 16:01

230909-tgqqdscd3z 7

Analysis

  • max time kernel
    1184s
  • max time network
    1200s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10-04-2024 02:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe

  • Size

    203KB

  • MD5

    661cdb95fe5810f365ddb936ea8f3432

  • SHA1

    6210c0691ee20e61dc9a9da1a371d561cd850774

  • SHA256

    dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a

  • SHA512

    aa25009dfbddfb300c14ab65c9eeb68aa785a54d40fa28a684275b9f506cc6fd337842cf42c54bcff79018241c9a0ac606ad4ebf614a2a355aed7e6dbe70c41d

  • SSDEEP

    6144:8N0J0dLFzW/wKWsBGKqkv07bKXZSgsBuQdwLhXC1:8NDpzGAsgL+ZSwQdwLhXC1

Score
10/10
gurcuzgratcollectiondiscoveryratspywarestealer

Malware Config

Signatures

  • Detect Gurcu Stealer V3 payload 3 IoCs
  • Detect ZGRat V1 2 IoCs
  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Executes dropped EXE 42 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:260
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe" &&START "" "C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1508
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:3016
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:884
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:2648
        • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
          "C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2476
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp6532.tmp" -C "C:\Users\Admin\AppData\Local\9krryil1hy"
            4⤵
              PID:420
            • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
              "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:1224
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:1156
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4244
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1032
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4092
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2148
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2780
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2436
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1160
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2416
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4324
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2252
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1944
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2800
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:872
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3456
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4200
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1780
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1544
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4064
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:260
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2316
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1624
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4220
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:876
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:848
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:420
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3016
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:492
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4108
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1196
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2612
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2780
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3308
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3808
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:728
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1820
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4560
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4800
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4016
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4648

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\9krryil1hy\data\cached-microdesc-consensus
        Filesize

        2.6MB

        MD5

        8155dd4a16697830a63d507d2666b2a9

        SHA1

        e07a54b15c905cd1d9d41db3ccde3bade36bcdb4

        SHA256

        6b4f443629c32b632d8ad7bcb17d84da1e4eaec556dccdf98c5e9051cb404fed

        SHA512

        0cb6c3fa12cbe7f8e63c5c73c0665fc2593109801ba318c582c4bd1c14dfd27fff3252c22b9078040e743ec788ad9534856c72ca5e38d992d9cb5aeacf819e6f

        Download Submit

      • C:\Users\Admin\AppData\Local\9krryil1hy\data\cached-microdescs.new
        Filesize

        6.6MB

        MD5

        35799c3cc1495ababbf36ed84a254d64

        SHA1

        e77cef374787ece137f420113f4e919378fd8b62

        SHA256

        487dcb427db4dc37540bfcba93d97b5fd96727d51662dd031d62950a0befcf1f

        SHA512

        f741c9a40b4df7f6fec3d20330340f8e6323fc2b70a9a8eabc5cc1a058c69f9a8f87058f3c5909c87153c4c0268dca3481b3baa8752ec14709ceff6300ba7379

        Download Submit

      • C:\Users\Admin\AppData\Local\9krryil1hy\host\hostname
        Filesize

        64B

        MD5

        12016ef47c7a9eab635be07842b52b44

        SHA1

        93e0f0ab72b7e4483f54b71148a0e8b6d463e53a

        SHA256

        b42aa286ef7928dd75cb10d4c2f78728452898d32c6831b9772ac0c99a5ca60d

        SHA512

        3b5d288ba32ab44f7bf9b1f4ac5327bc34d027991d78e0fe1955f6aecbcf438d3eb4fe51fb8c39cf52b098822652bf05e3472afeb4a3eaa645c307f036222314

        Download Submit

      • C:\Users\Admin\AppData\Local\9krryil1hy\port.dat
        Filesize

        4B

        MD5

        3e524bf740dc8cfd3f49bd3e96daee6e

        SHA1

        ed311b7d4b06954c623a4ab91025aeb6599b29e8

        SHA256

        050fac337331bbe89445ea091074cc3ac2bbabd78ed965ad53a8506116cf2f07

        SHA512

        e02c03264f4093568f2d0dfcbb027831a37f3312ec686bd2fc5ecb8cc35010d05bd84ab7c5bd61499b44c6019e742358dee676690d7a9e1095ce54f0dd04fc76

        Download Submit

      • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
        Filesize

        7.4MB

        MD5

        88590909765350c0d70c6c34b1f31dd2

        SHA1

        129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

        SHA256

        46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

        SHA512

        a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

        Download Submit

      • C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt
        Filesize

        218B

        MD5

        86ba68b64902701f584e81dcd5311792

        SHA1

        4957b24b6f5118d84b0bd1c6dfbc64ed5f9b9a0b

        SHA256

        2abe37967151bb68f5e60cac52ffa6b85c8c3d5173a70a320551a72aa554cd18

        SHA512

        27b9435d98f6e689b0ab2d580ff47699c1d24861880274009da4afc22d7a341c17a862e371417d40783ce9b540a0f3e0ec894a6dcf409a059e43e2c6872b08db

        Download Submit

      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        Filesize

        203KB

        MD5

        661cdb95fe5810f365ddb936ea8f3432

        SHA1

        6210c0691ee20e61dc9a9da1a371d561cd850774

        SHA256

        dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a

        SHA512

        aa25009dfbddfb300c14ab65c9eeb68aa785a54d40fa28a684275b9f506cc6fd337842cf42c54bcff79018241c9a0ac606ad4ebf614a2a355aed7e6dbe70c41d

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe.log
        Filesize

        847B

        MD5

        486ebddc86ea8b3e965d390d22283a23

        SHA1

        eaffc047f067084867e8575c576a9ec60e094ba8

        SHA256

        50a57273ecb794e53b0622eb841341e2643c11f53fa47356e6e754ab2268171d

        SHA512

        0a50ba02250b38355a6f4fb94e40c61258a74031d9aea7cdf675f3e068f39ec0748ecf292aaf2f94b1963b9d66516ee79aa6c552617048e248774af0ff07189d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        271B

        MD5

        ab40dadfd6eccd7b7bf479c1c7bfe928

        SHA1

        f9da67771a80d8a4b5edcff164c0f4267f44e2a2

        SHA256

        a6492277121d80deb89d3452064a23a98e5595b13f80b93d8b45c5e59b70daf2

        SHA512

        5bcd40705b59c33f653e3b513ecd66f79113f455b1a9526b5f335d237116fec85ab6c32239029a207b6f621775218e83633232130d8a3974fa487c0a067ef5e9

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        377B

        MD5

        a6ba99cf0a17ff0c01818486367b9342

        SHA1

        fc861c847f73da990e5f2ea70310e24ddbb18016

        SHA256

        aa18eb373798739c4f35cc0d5f3544a7494ff428cb8c661cfb0e00d183a65621

        SHA512

        174bb4e705f9b28c763bc9d9adbd1fe9e69ab609ce56404667b2a59ea860f8bfa0c5f44addee949a09db0e7764f640eb7db044726d343ccc02ce11be51954429

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        430B

        MD5

        f4b2af9ca03e016e69b38cc8361502f5

        SHA1

        72bc5632c318ea122df61d60d880e0fe56570c2e

        SHA256

        01940d46a9286fd16f6c67cefc58583feda819b39e46688cfca31896e6709f64

        SHA512

        0d05ae21b8c10ed424c9af6d9f3d61cb4119449400bd0f8b6449e422bcafe9fe0fec0b28ce3cbaf0ebc13c6f1fd29470a95ca360eb0aa8874409fe231baac6f0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        536B

        MD5

        7d7060b0046da4a165b900761c2e0f86

        SHA1

        8a3f4f5ed89fcd18cb9a0f2c8b053aae7b2e2675

        SHA256

        f8cfdc6faad6cf7c2fa569f1b43bc219e42fedb4216d0fd3026ef43c70836807

        SHA512

        4517a58e31cc81005662f60431c21eb7490177fc2109fd2bc6babaead3732e2398b81814fa920ecb3b7a7f1006ed962f2f81e0bb940e8eb12d54116d18d4af46

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        642B

        MD5

        06b07d75136c17ca800e5d7ca054b6fe

        SHA1

        a3326cdbfe2ba8b033ddc2d988ec71a51b7ea808

        SHA256

        41b72a3061db65c7549b22e798bff445d7e7f25ab9eda36736df5dc3757b69d9

        SHA512

        0f5b0645cac2881c3bd4e85242028986c4698efeb4d8a9e5dbe9638ed3c04f4c481477f664b8e7781b746a4a2906d1f3ae76f745f0da3e4918ed63813574c059

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        748B

        MD5

        e397541a0b0a681905bde41c9d31dcca

        SHA1

        44d4b77f0c981d05737a02eea421f85786aa4e08

        SHA256

        2061be8c0780effcde75f29962eefc942c92a1f5f6d1aad380b7575ed2bb5b4a

        SHA512

        1a249225a59a458d36b2c01e92929f126e508f314fa247ecab99adacc9aea8d94434fdef1b360ff9e607dd358ca683b5a4165b0d2b77a333ab95bac222fd85bb

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        801B

        MD5

        e07a4d69bd86f2c2b20f65c350e7a0ed

        SHA1

        572a887684b791d0d39e9bb1394ebec6136c9d00

        SHA256

        15121c1b775f22d0f6e0a40d1fa02e118a5f0c56540a70160845f2c95f63dd06

        SHA512

        99bb7d6889ce4a8159d499ac4bb39358b2f6b14a8de5d752a7bf134b1076e115e4276938efb860a34ef979e92ea1bdf72a311bbcd47fbe568fd6d7471521e956

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        854B

        MD5

        746a034478124ccf0ecc544aae6a1ec0

        SHA1

        3c04c646de8f03e5eab8a57336e8dcb1e46e214d

        SHA256

        1b2e2857e8c3aef8c6b89569a60bfb6d68939267c2f4d25ce6ef7acc74422911

        SHA512

        09ca3ddf2b0019fedda5addba171cef55b7d0fea8f465ca6795696bad8d5101a257b2cad23b4fa6e85fa262d78b9a04f54632bca08a4275fd923649ee9acccd5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        907B

        MD5

        c4ab1b3217ed4226acf90017a02f90f4

        SHA1

        a84dc7fbf0c0de2619bfd23bd4372277d454d471

        SHA256

        0fe438a2bf04280a1f4b725763df83747048efbc4b7bc7d97d68b564fc0a873d

        SHA512

        4e9e1c0c021ec36b59d2d4157f96090f83a8e2242420f18b4e9fea7ce5fa053d0070affd90ae953b714a2932705f0ba3c667c1b423193df9c90252a9f6a1d4bd

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        960B

        MD5

        2bcb04c07d14a2b8c2a7821f03335f2e

        SHA1

        b039e4f22cc9b38dd9da21e1c2eaaa0dcc678080

        SHA256

        6d61a1c4c0bb426d0347e05626060298ccf62adaf537bc7491c3616cf9ca8abf

        SHA512

        f2b9f450513140f2afb2632853e1f0fe6895cf1190a6b6d67dea82912bdd121e7607aee5d813b9ea5a87b494c3b259cb14b75e3232b76b4887737150753072f4

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        1013B

        MD5

        0eccfdfaf1162e7de37bd5da378f2b25

        SHA1

        9cd62ce080d725295a0de1ced3c166129d258056

        SHA256

        a407c75b48b54d1615c91603d35c9277b406899cbfe961fb63b2c1e863d8017a

        SHA512

        d8635473ec31a7de23853055e1fced951439cba56208f10e571ecf8ac4fc23c2ca59bc68246ad61c233ceaca34449c73462d42097d3ed1c45a84e5cd2551b8f0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        165B

        MD5

        349a9890a0e7c9899dd445741464e4f9

        SHA1

        078528e57315c09fe1a43d419b3ccbd7159b5ae5

        SHA256

        cfb517c8b0f42f27b99995cef285ff677a3390e5d0eec3c6b5e3b1b01ebfa11e

        SHA512

        1bb6d03361cafb2fc81506a81bbfefedab074c43f5a74bb5c43618970c3ffaa7a21e458b86a8711e5278727dd4789333802b64d916ce8062e036b66bd18735ca

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmp6532.tmp
        Filesize

        13.3MB

        MD5

        89d2d5811c1aff539bb355f15f3ddad0

        SHA1

        5bb3577c25b6d323d927200c48cd184a3e27c873

        SHA256

        b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

        SHA512

        39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

        Download Submit

      • memory/260-4-0x000002DCF5130000-0x000002DCF5140000-memory.dmp

        Filesize

        64KB

        Download

      • memory/260-3-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/260-0-0x000002DCF2D20000-0x000002DCF2D58000-memory.dmp

        Filesize

        224KB

        Download

      • memory/260-6-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/728-286-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/728-281-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/728-282-0x000002407E3B0000-0x000002407E3C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/848-215-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/848-211-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1032-99-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1032-95-0x0000020833DE0000-0x0000020833DF0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1032-94-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1156-48-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1156-47-0x000001CEF2280000-0x000001CEF2290000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1156-44-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1780-166-0x0000012E38D20000-0x0000012E38D30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1780-165-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1780-170-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2148-101-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2148-106-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2148-102-0x000002A23BE70000-0x000002A23BE80000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2252-133-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2252-137-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2316-191-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2316-187-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2416-123-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2416-119-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2436-113-0x000001EE9B620000-0x000001EE9B630000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2436-112-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2436-117-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2476-12-0x0000028D04E10000-0x0000028D04E20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2476-11-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2476-88-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2476-41-0x0000028D04E10000-0x0000028D04E20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2476-40-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2612-260-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2612-256-0x000001E39A400000-0x000001E39A410000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2612-255-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2800-144-0x0000015C50C90000-0x0000015C50CA0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2800-148-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2800-143-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3016-230-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3016-226-0x000001A6F9220000-0x000001A6F9230000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3016-225-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3308-275-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3308-271-0x000001AF3F5A0000-0x000001AF3F5B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3308-270-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3456-155-0x000002A618170000-0x000002A618180000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3456-154-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3456-159-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4016-310-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4016-308-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4064-180-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4064-185-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4064-181-0x000002DFD3E80000-0x000002DFD3E90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4108-241-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4108-236-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4108-237-0x000002CB42B50000-0x000002CB42B60000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4220-201-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4220-205-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4560-297-0x0000028D9AE40000-0x0000028D9AE50000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4560-296-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4560-299-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

        Filesize

        10.8MB

        Download