Malware Analysis Report

2025-01-02 12:10

Sample ID 240419-vap1ysae5t
Target 9df4f81a51495c100a04818a8e6d52a7e8adf0cc7761ac2d6ce2b4bc2bcad845
SHA256 9df4f81a51495c100a04818a8e6d52a7e8adf0cc7761ac2d6ce2b4bc2bcad845
Tags
asyncrat redline zgrat 02 default discovery infostealer rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9df4f81a51495c100a04818a8e6d52a7e8adf0cc7761ac2d6ce2b4bc2bcad845

Threat Level: Known bad

The file 9df4f81a51495c100a04818a8e6d52a7e8adf0cc7761ac2d6ce2b4bc2bcad845 was found to be: Known bad.

Malicious Activity Summary

asyncrat redline zgrat 02 default discovery infostealer rat spyware stealer

RedLine payload

Asyncrat family

AsyncRat

RedLine

Detect ZGRat V1

Async RAT payload

ZGRat

Nirsoft

Async RAT payload

NirSoft WebBrowserPassView

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Unsigned PE

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Delays execution with timeout.exe

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 16:47

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 16:47

Reported

2024-04-19 16:50

Platform

win7-20240221-en

Max time kernel

117s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe"

Signatures

AsyncRat

rat asyncrat

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

ZGRat

rat zgrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ghfcvh.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Runtime.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Runtime.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ghfcvh.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Runtime.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2340 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe C:\Windows\SysWOW64\cmd.exe
PID 2340 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe C:\Windows\SysWOW64\cmd.exe
PID 2340 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe C:\Windows\SysWOW64\cmd.exe
PID 2340 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe C:\Windows\SysWOW64\cmd.exe
PID 2340 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe C:\Windows\SysWOW64\cmd.exe
PID 2340 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe C:\Windows\SysWOW64\cmd.exe
PID 2340 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe C:\Windows\SysWOW64\cmd.exe
PID 2340 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe C:\Windows\SysWOW64\cmd.exe
PID 2344 wrote to memory of 2636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2344 wrote to memory of 2636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2344 wrote to memory of 2636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2344 wrote to memory of 2636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 404 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 404 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 404 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 404 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 404 wrote to memory of 2432 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Runtime.exe
PID 404 wrote to memory of 2432 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Runtime.exe
PID 404 wrote to memory of 2432 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Runtime.exe
PID 404 wrote to memory of 2432 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Runtime.exe
PID 2432 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Runtime.exe C:\Users\Admin\AppData\Local\Temp\ghfcvh.exe
PID 2432 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Runtime.exe C:\Users\Admin\AppData\Local\Temp\ghfcvh.exe
PID 2432 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Runtime.exe C:\Users\Admin\AppData\Local\Temp\ghfcvh.exe
PID 2432 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Runtime.exe C:\Users\Admin\AppData\Local\Temp\ghfcvh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe

"C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Runtime" /tr '"C:\Users\Admin\AppData\Roaming\Runtime.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp31CA.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Runtime" /tr '"C:\Users\Admin\AppData\Roaming\Runtime.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\Runtime.exe

"C:\Users\Admin\AppData\Roaming\Runtime.exe"

C:\Users\Admin\AppData\Local\Temp\ghfcvh.exe

"C:\Users\Admin\AppData\Local\Temp\ghfcvh.exe"

Network

Country Destination Domain Proto
NL 80.79.7.197:8808 tcp
NL 80.79.7.197:6606 tcp
NL 80.79.7.197:6606 tcp
US 209.126.11.251:31618 tcp
NL 80.79.7.197:6606 tcp

Files

memory/2340-0-0x0000000000D30000-0x0000000000D46000-memory.dmp

memory/2340-1-0x00000000743D0000-0x0000000074ABE000-memory.dmp

memory/2340-2-0x0000000004840000-0x0000000004880000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp31CA.tmp.bat

MD5 e1329119a3ac291e8f513c7f617fad12
SHA1 784b19b008031cdf9b0b715052c24ce76ab8ae75
SHA256 148af077de2b470f4eff429bef293ea063ee7988dbab667c4d24d7303f9bd060
SHA512 9bec413ec8a30c7b4f285e26fcf1cceffaeeb10890eae9ac694775c96ef151af931488f6716f7910b3b919ffe4d6e4a65806ebc550100207743f11df89fa5340

memory/2340-11-0x00000000743D0000-0x0000000074ABE000-memory.dmp

\Users\Admin\AppData\Roaming\Runtime.exe

MD5 b423cbb605900fff304f59d4a42843e7
SHA1 33fd4e8fe5e0c001409b9a7a9fb4336e634142ff
SHA256 6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b
SHA512 4dd3a03e3d5e038794daa9e83171368d8b2e7b793036a1d71bcd781434b4758db121fcfc1909935811518210e20ef23bc7323ecdc9314da5431cabe166454d20

memory/2432-16-0x00000000003D0000-0x00000000003E6000-memory.dmp

memory/2432-17-0x0000000074380000-0x0000000074A6E000-memory.dmp

memory/2432-18-0x0000000001F20000-0x0000000001F60000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar62C0.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

memory/2432-56-0x0000000000910000-0x0000000000934000-memory.dmp

\Users\Admin\AppData\Local\Temp\ghfcvh.exe

MD5 bb863e1524d9f107582c53a22b5470d8
SHA1 c28e68268822facc813445b68c987acd6e078fdd
SHA256 3acadbcf10f157c1b83f1e9f7d4bc45d3ea9636d52cf2d16d70adab44d95ea77
SHA512 a68b52b36993412bad89335b2bbfed2bf532eccf07a08dc81b6a4e5c5a94ad321ed888c29b717bd472d6a6b53cef2497943fb4e6931c35317fc779932bbce9d7

memory/2168-85-0x0000000074380000-0x0000000074A6E000-memory.dmp

memory/2168-84-0x0000000000CB0000-0x0000000000D0C000-memory.dmp

memory/2168-86-0x0000000004F20000-0x0000000004F60000-memory.dmp

memory/2432-87-0x0000000074380000-0x0000000074A6E000-memory.dmp

memory/2432-88-0x0000000006A90000-0x0000000006B70000-memory.dmp

memory/2168-89-0x0000000074380000-0x0000000074A6E000-memory.dmp

memory/2432-90-0x00000000068C0000-0x0000000006940000-memory.dmp

memory/2432-111-0x00000000043C0000-0x00000000043CA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 16:47

Reported

2024-04-19 16:50

Platform

win10v2004-20240412-en

Max time kernel

139s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe"

Signatures

AsyncRat

rat asyncrat

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

ZGRat

rat zgrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Runtime.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lhausw.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lhausw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lhausw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lhausw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lhausw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lhausw.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Runtime.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\lhausw.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Runtime.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2372 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe C:\Windows\SysWOW64\cmd.exe
PID 536 wrote to memory of 3568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 536 wrote to memory of 3568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 536 wrote to memory of 3568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2692 wrote to memory of 4956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2692 wrote to memory of 4956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2692 wrote to memory of 4956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 536 wrote to memory of 2936 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Runtime.exe
PID 536 wrote to memory of 2936 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Runtime.exe
PID 536 wrote to memory of 2936 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Runtime.exe
PID 2936 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Roaming\Runtime.exe C:\Users\Admin\AppData\Local\Temp\lhausw.exe
PID 2936 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Roaming\Runtime.exe C:\Users\Admin\AppData\Local\Temp\lhausw.exe
PID 2936 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Roaming\Runtime.exe C:\Users\Admin\AppData\Local\Temp\lhausw.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe

"C:\Users\Admin\AppData\Local\Temp\6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Runtime" /tr '"C:\Users\Admin\AppData\Roaming\Runtime.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp415E.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Runtime" /tr '"C:\Users\Admin\AppData\Roaming\Runtime.exe"'

C:\Users\Admin\AppData\Roaming\Runtime.exe

"C:\Users\Admin\AppData\Roaming\Runtime.exe"

C:\Users\Admin\AppData\Local\Temp\lhausw.exe

"C:\Users\Admin\AppData\Local\Temp\lhausw.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
NL 80.79.7.197:8808 tcp
US 8.8.8.8:53 197.7.79.80.in-addr.arpa udp
NL 80.79.7.197:8888 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
NL 80.79.7.197:6606 tcp
NL 80.79.7.197:6606 tcp
US 209.126.11.251:31618 tcp
US 8.8.8.8:53 251.11.126.209.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
NL 80.79.7.197:6606 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/2372-0-0x0000000000090000-0x00000000000A6000-memory.dmp

memory/2372-1-0x0000000074890000-0x0000000075040000-memory.dmp

memory/2372-2-0x0000000004A50000-0x0000000004A60000-memory.dmp

memory/2372-3-0x0000000004B00000-0x0000000004B9C000-memory.dmp

memory/2372-9-0x0000000074890000-0x0000000075040000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp415E.tmp.bat

MD5 9a695a48b76e803a533ef2fcac15a1e6
SHA1 77f0b084005cb86d1c3e283f335925b215570499
SHA256 dd54446820f85c03145085758f19d55a277ef77a4db82820f5dbac9a683589b8
SHA512 27d590da262edfc8e400a245e976804edbe6e427661428725873cd78fcde0872fa653c1f034a03692cdb9871576ba19a1f8df5f9b7dd438fe5c0dc9c06c10be5

C:\Users\Admin\AppData\Roaming\Runtime.exe

MD5 b423cbb605900fff304f59d4a42843e7
SHA1 33fd4e8fe5e0c001409b9a7a9fb4336e634142ff
SHA256 6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b
SHA512 4dd3a03e3d5e038794daa9e83171368d8b2e7b793036a1d71bcd781434b4758db121fcfc1909935811518210e20ef23bc7323ecdc9314da5431cabe166454d20

memory/2936-13-0x0000000074890000-0x0000000075040000-memory.dmp

memory/2936-14-0x0000000004C70000-0x0000000004C80000-memory.dmp

memory/2936-15-0x00000000054D0000-0x0000000005A74000-memory.dmp

memory/2936-16-0x00000000050C0000-0x0000000005152000-memory.dmp

memory/2936-17-0x00000000050A0000-0x00000000050AA000-memory.dmp

memory/2936-20-0x0000000006130000-0x0000000006196000-memory.dmp

memory/2936-21-0x0000000074890000-0x0000000075040000-memory.dmp

memory/2936-22-0x0000000004C70000-0x0000000004C80000-memory.dmp

memory/2936-23-0x0000000006A20000-0x0000000006A96000-memory.dmp

memory/2936-24-0x00000000069B0000-0x00000000069D4000-memory.dmp

memory/2936-25-0x0000000006AC0000-0x0000000006ADE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lhausw.exe

MD5 bb863e1524d9f107582c53a22b5470d8
SHA1 c28e68268822facc813445b68c987acd6e078fdd
SHA256 3acadbcf10f157c1b83f1e9f7d4bc45d3ea9636d52cf2d16d70adab44d95ea77
SHA512 a68b52b36993412bad89335b2bbfed2bf532eccf07a08dc81b6a4e5c5a94ad321ed888c29b717bd472d6a6b53cef2497943fb4e6931c35317fc779932bbce9d7

memory/2848-37-0x0000000074890000-0x0000000075040000-memory.dmp

memory/2848-38-0x00000000003C0000-0x000000000041C000-memory.dmp

memory/2848-39-0x0000000004E00000-0x0000000004E10000-memory.dmp

memory/2848-40-0x0000000005F10000-0x0000000006528000-memory.dmp

memory/2848-41-0x0000000005070000-0x000000000517A000-memory.dmp

memory/2848-42-0x0000000004F80000-0x0000000004F92000-memory.dmp

memory/2848-43-0x0000000004FE0000-0x000000000501C000-memory.dmp

memory/2848-44-0x0000000005020000-0x000000000506C000-memory.dmp

memory/2936-45-0x0000000006C10000-0x0000000006CF0000-memory.dmp

memory/2848-46-0x00000000068C0000-0x0000000006910000-memory.dmp

memory/2848-47-0x0000000007820000-0x00000000079E2000-memory.dmp

memory/2848-48-0x0000000007F20000-0x000000000844C000-memory.dmp

memory/2848-49-0x0000000074890000-0x0000000075040000-memory.dmp

memory/2848-51-0x0000000074890000-0x0000000075040000-memory.dmp

memory/2936-52-0x0000000006CF0000-0x0000000006D70000-memory.dmp

memory/2936-53-0x0000000007100000-0x000000000710A000-memory.dmp