gurcu | 8d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3

Resubmissions

10/04/2024, 02:58

240410-dgn9kacd4610

10/04/2024, 02:58

10/04/2024, 02:58

10/04/2024, 02:58

23/08/2023, 14:58

Analysis

max time kernel
1200s
max time network
1201s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 401KB
Sample240410-dgnm2aff7x
SHA256 8d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3
MD5 69e3cdc923b668aec4cb405c040565c6
SHA1 6a675ebf6f241e543f7bb50ccc8ead462a427880
SHA512 5580919f6710fc210f079875eae22a87c85e854b57f59d10fc22680460f370154d7d223a66c9797387e4675a7954ba6f051a34571499481927980eb9ebf07cdb
SSDEEP 6144:+CGmWI/2hvRn6Ie646G0D1eBlxy9bAmI6:+KWI/8B6Q9b5eBlxnmI6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gurcu collection spyware stealer

Malware Config

Extracted

Family

gurcu

https://api.telegram.org/bot6193093056:AAHzyNGUGS9aUG6CCx6ENLoXpCFLzEQywIQ/sendMessage?chat_id=1098292643

Signatures

Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu

Checks computer location settings 2 TTPs 22 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	loader.exe

Executes dropped EXE 42 IoCs

pid	Process
3972	loader.exe
4368	tor.exe
400	loader.exe
4928	tor.exe
612	loader.exe
3608	tor.exe
2228	loader.exe
3960	tor.exe
5092	loader.exe
4304	tor.exe
1208	loader.exe
3432	tor.exe
3508	loader.exe
1544	tor.exe
4824	loader.exe
4956	tor.exe
4344	loader.exe
4580	tor.exe
748	loader.exe
392	tor.exe
3628	loader.exe
1068	tor.exe
3700	loader.exe
4460	tor.exe
3136	loader.exe
2192	tor.exe
4928	loader.exe
3224	tor.exe
1308	loader.exe
2876	tor.exe
1612	loader.exe
4940	tor.exe
1808	loader.exe
844	tor.exe
336	loader.exe
1816	tor.exe
4992	loader.exe
3048	tor.exe
4164	loader.exe
2052	tor.exe
4868	loader.exe
2608	tor.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	loader.exe
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	loader.exe
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	loader.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
83	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1720	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4704	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3972	loader.exe
3972	loader.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	loader.exe
Token: SeDebugPrivilege	3972	loader.exe
Token: SeDebugPrivilege	400	loader.exe
Token: SeDebugPrivilege	612	loader.exe
Token: SeDebugPrivilege	2228	loader.exe
Token: SeDebugPrivilege	5092	loader.exe
Token: SeDebugPrivilege	1208	loader.exe
Token: SeDebugPrivilege	3508	loader.exe
Token: SeDebugPrivilege	4824	loader.exe
Token: SeDebugPrivilege	4344	loader.exe
Token: SeDebugPrivilege	748	loader.exe
Token: SeDebugPrivilege	3628	loader.exe
Token: SeDebugPrivilege	3700	loader.exe
Token: SeDebugPrivilege	3136	loader.exe
Token: SeDebugPrivilege	4928	loader.exe
Token: SeDebugPrivilege	1308	loader.exe
Token: SeDebugPrivilege	1612	loader.exe
Token: SeDebugPrivilege	1808	loader.exe
Token: SeDebugPrivilege	336	loader.exe
Token: SeDebugPrivilege	4992	loader.exe
Token: SeDebugPrivilege	4164	loader.exe
Token: SeDebugPrivilege	4868	loader.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 3432	1004	loader.exe	86
PID 1004 wrote to memory of 3432	1004	loader.exe	86
PID 3432 wrote to memory of 3460	3432	cmd.exe	88
PID 3432 wrote to memory of 3460	3432	cmd.exe	88
PID 3432 wrote to memory of 4704	3432	cmd.exe	89
PID 3432 wrote to memory of 4704	3432	cmd.exe	89
PID 3432 wrote to memory of 1720	3432	cmd.exe	95
PID 3432 wrote to memory of 1720	3432	cmd.exe	95
PID 3432 wrote to memory of 3972	3432	cmd.exe	96
PID 3432 wrote to memory of 3972	3432	cmd.exe	96
PID 3972 wrote to memory of 1176	3972	loader.exe	100
PID 3972 wrote to memory of 1176	3972	loader.exe	100
PID 3972 wrote to memory of 4368	3972	loader.exe	102
PID 3972 wrote to memory of 4368	3972	loader.exe	102
PID 400 wrote to memory of 4928	400	loader.exe	108
PID 400 wrote to memory of 4928	400	loader.exe	108
PID 612 wrote to memory of 3608	612	loader.exe	114
PID 612 wrote to memory of 3608	612	loader.exe	114
PID 2228 wrote to memory of 3960	2228	loader.exe	119
PID 2228 wrote to memory of 3960	2228	loader.exe	119
PID 5092 wrote to memory of 4304	5092	loader.exe	124
PID 5092 wrote to memory of 4304	5092	loader.exe	124
PID 1208 wrote to memory of 3432	1208	loader.exe	129
PID 1208 wrote to memory of 3432	1208	loader.exe	129
PID 3508 wrote to memory of 1544	3508	loader.exe	134
PID 3508 wrote to memory of 1544	3508	loader.exe	134
PID 4824 wrote to memory of 4956	4824	loader.exe	139
PID 4824 wrote to memory of 4956	4824	loader.exe	139
PID 4344 wrote to memory of 4580	4344	loader.exe	144
PID 4344 wrote to memory of 4580	4344	loader.exe	144
PID 748 wrote to memory of 392	748	loader.exe	149
PID 748 wrote to memory of 392	748	loader.exe	149
PID 3628 wrote to memory of 1068	3628	loader.exe	154
PID 3628 wrote to memory of 1068	3628	loader.exe	154
PID 3700 wrote to memory of 4460	3700	loader.exe	159
PID 3700 wrote to memory of 4460	3700	loader.exe	159
PID 3136 wrote to memory of 2192	3136	loader.exe	164
PID 3136 wrote to memory of 2192	3136	loader.exe	164
PID 4928 wrote to memory of 3224	4928	loader.exe	169
PID 4928 wrote to memory of 3224	4928	loader.exe	169
PID 1308 wrote to memory of 2876	1308	loader.exe	174
PID 1308 wrote to memory of 2876	1308	loader.exe	174
PID 1612 wrote to memory of 4940	1612	loader.exe	179
PID 1612 wrote to memory of 4940	1612	loader.exe	179
PID 1808 wrote to memory of 844	1808	loader.exe	184
PID 1808 wrote to memory of 844	1808	loader.exe	184
PID 336 wrote to memory of 1816	336	loader.exe	189
PID 336 wrote to memory of 1816	336	loader.exe	189
PID 4992 wrote to memory of 3048	4992	loader.exe	194
PID 4992 wrote to memory of 3048	4992	loader.exe	194
PID 4164 wrote to memory of 2052	4164	loader.exe	199
PID 4164 wrote to memory of 2052	4164	loader.exe	199
PID 4868 wrote to memory of 2608	4868	loader.exe	204
PID 4868 wrote to memory of 2608	4868	loader.exe	204

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	loader.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	loader.exe

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "loader" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\loader.exe" &&START "" "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3460
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4704
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "loader" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1720
- - C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
    "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:3972
  - - C:\Windows\System32\tar.exe
      "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp4297.tmp" -C "C:\Users\Admin\AppData\Local\jjmzzxbvaf"
      4⤵
      PID:1176
  - - C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
      "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
      4⤵
      Executes dropped EXE
      PID:4368

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:4928

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:612
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:3608

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:3960

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:4304

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:3432

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:1544

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:4956

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:4580

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:392

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:1068

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:4460

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:2192

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:3224

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:2876

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:4940

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:844

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:336
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:1816

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:3048

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:2052

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
  "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

loader.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\loader.exe.log
Size 847B
SHA256 169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e
MD5 3308a84a40841fab7dfec198b3c31af7
SHA1 4e7ab6336c0538be5dd7da529c0265b3b6523083
SHA512 97521d5fb94efdc836ea2723098a1f26a7589a76af51358eee17292d29c9325baf53ad6b4496c5ca3e208d1c9b9ad6797a370e2ae378072fc68f5d6e8b73b198
MD5 SHA1 SHA512

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
Size 401KB
SHA256 8d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3
MD5 69e3cdc923b668aec4cb405c040565c6
SHA1 6a675ebf6f241e543f7bb50ccc8ead462a427880
SHA512 5580919f6710fc210f079875eae22a87c85e854b57f59d10fc22680460f370154d7d223a66c9797387e4675a7954ba6f051a34571499481927980eb9ebf07cdb
SSDEEP 6144:+CGmWI/2hvRn6Ie646G0D1eBlxy9bAmI6:+KWI/8B6Q9b5eBlxnmI6
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp4297.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4297.tmp
Size 13.3MB
SHA256 b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12
MD5 89d2d5811c1aff539bb355f15f3ddad0
SHA1 5bb3577c25b6d323d927200c48cd184a3e27c873
SHA512 39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289
SSDEEP 393216:2YEKAkOvd2hKJDrq/OtTCRMTJqIdLZOBgfZn:XEJP2cJD2+GOJqMZOBGZn
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Local\jjmzzxbvaf\data\cached-microdesc-consensus.tmp
Size 2.7MB
SHA256 60b43cdce0f807f7891521f396f53def34a7d98986dbde0faa2a197189c587f3
MD5 a0db8a87f7b723266c8b04255da46b06
SHA1 4df00ea56d22d88f3d2e005ef66bad5b3ef92ebf
SHA512 41b8fc467d11af7ca6a42c7e94d1b8295ab3ae5d6d186b4f378e6e079440520e8324b695da1134beb2bc1697d2491edcc70c1b75ab6fc66b9c1cb2ecbcdb4a7d
SSDEEP 12288:v8nySbLlrTqASpoC6J9gRbMVwvKZq2gbIIuXM6h4Uviymjo09LQQ:vMxBSu+1MpKR6l6yMQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Local\jjmzzxbvaf\data\cached-microdescs.new
Size 5.7MB
SHA256 4990425f13bfe80d163a50c9b8a1bec552e7dd76f7103ddb16b217233d83f267
MD5 3f16fcc945983c97834135d5351a8e7c
SHA1 d515cd22383399505649e838eb0f05c214e98325
SHA512 3f985149241c823459f6d4b5feda24c2e3783393f08017427b329e7a1ec170aac710cdc778b14d2e32311a1c151f3062eb0e3fd1c5e63c4f491c3db8cfbb3f98
SSDEEP 24576:+b0n2A15Tcih0r7lY2stpZmE7B0/xl/HVyNeyh2dRzSIuXcwRIp1yoOCRKtifxvb:U8y69Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

hostname

Path C:\Users\Admin\AppData\Local\jjmzzxbvaf\host\hostname
Size 64B
SHA256 4cde34fd58cda6fa82911c28c35cc313e6646977589c707745e997cb56d2d3ba
MD5 a916dabbd89642bdeedeb9f7cceb8905
SHA1 06b04d97625d7c254fbda69ad950ff94cba238f7
SHA512 77ac13d4e10dec3d9aaabbb31fd7f581ae3b018817645e321c6f4f31e8fa8a37a4778bbedf020bd75927808207dafd82fe096f3d1e6f3a2cd43db99c82902887
MD5 SHA1 SHA512

Submit Download

port.dat

Path C:\Users\Admin\AppData\Local\jjmzzxbvaf\port.dat
Size 4B
SHA256 c864021c8f2bf3ad3d713c75125a7da8d3f10712d9e633f49f681af79b41146b
MD5 e3b0ab92511ce1f46960bed57f65f532
SHA1 70d44fb570e9dd46eee84f262ba682e93f837eb9
SHA512 ec26cacac991341ab6f78ef1558410bc3680943bdb3badbf0a989c78862dadf919c071d7b2c75cb4f8336ca9e126bb8d76e927de4b5c3126cc938664da3ba6fc
MD5 SHA1 SHA512

Submit Download

tor.exe

Path C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
Size 7.4MB
SHA256 46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82
MD5 88590909765350c0d70c6c34b1f31dd2
SHA1 129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7
SHA512 a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192
SSDEEP 98304:3iPgwPv8LqpP5ZkfiSMdm+KHMU2O1R0fzwkEOlcHA6IZGQ:VbM8jjX1R0R6YL
MD5 SHA1 SHA512 SSDEEP

Submit Download

torrc.txt

Path C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt
Size 218B
SHA256 aa784a6e4b23ed5333818425debbd97b1b53a39224892f5eec59d560c96d15bb
MD5 5d448328032fb4d02087d451f203dbae
SHA1 1f2a62f7a99bd2e9a27277a47990790530284e14
SHA512 13bb6b64be0d298e63f29ffc3f63328d66d42f67498619bc8d8c3ff043e186c51b1d72c52654579d9a397b544908aeaaa709561d4427b61107acceab9a973a59
MD5 SHA1 SHA512

Submit Download

memory/336-239-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/336-237-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/400-79-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/400-83-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/400-80-0x000001BBF1320000-0x000001BBF1330000-memory.dmp

Download

memory/612-92-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/612-90-0x0000027422400000-0x0000027422410000-memory.dmp

Download

memory/612-89-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/748-150-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/748-148-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/1004-0-0x000001538E590000-0x000001538E5F8000-memory.dmp

Download

memory/1004-1-0x00007FF8491E0000-0x00007FF849CA1000-memory.dmp

Download

memory/1004-4-0x000001538EAA0000-0x000001538EAB0000-memory.dmp

Download

memory/1004-6-0x00007FF8491E0000-0x00007FF849CA1000-memory.dmp

Download

memory/1208-110-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/1208-112-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/1308-201-0x0000027EBEF80000-0x0000027EBEF90000-memory.dmp

Download

memory/1308-203-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/1308-200-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/1612-215-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/1612-213-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/1808-227-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/1808-225-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/2228-94-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/2228-96-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/3136-182-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/3136-180-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/3508-118-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/3508-119-0x000001EECB7D0000-0x000001EECB7E0000-memory.dmp

Download

memory/3508-121-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/3628-152-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/3628-154-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/3700-164-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/3700-166-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/3972-11-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/3972-12-0x000002AE306D0000-0x000002AE306E0000-memory.dmp

Download

memory/3972-65-0x000002AE306D0000-0x000002AE306E0000-memory.dmp

Download

memory/3972-64-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/4164-258-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/4164-259-0x000002AA44FF0000-0x000002AA45000000-memory.dmp

Download

memory/4164-261-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/4344-132-0x0000017733CB0000-0x0000017733CC0000-memory.dmp

Download

memory/4344-131-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/4344-134-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/4824-123-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/4824-125-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/4868-271-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/4868-273-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/4928-190-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/4928-188-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/4992-245-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/4992-246-0x00000150CC6C0000-0x00000150CC6D0000-memory.dmp

Download

memory/4992-248-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/5092-98-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download

memory/5092-100-0x00007FF8487C0000-0x00007FF849281000-memory.dmp

Download