Malware Analysis Report

2024-10-10 10:08

Sample ID 240421-bjgw6afc9z
Target 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe
SHA256 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc
Tags
agenttesla njrat umbral hacked evasion keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc

Threat Level: Known bad

The file 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe was found to be: Known bad.

Malicious Activity Summary

agenttesla njrat umbral hacked evasion keylogger spyware stealer trojan

njRAT/Bladabindi

Detect Umbral payload

Umbral

AgentTesla

Detects executables containing possible sandbox analysis VM names

Detects executables containing possible sandbox system UUIDs

Detects executables containing possible sandbox analysis VM usernames

Detects executables attemping to enumerate video devices using WMI

AgentTesla payload

Modifies Windows Firewall

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Unsigned PE

Enumerates physical storage devices

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Detects videocard installed

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-21 01:10

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-21 01:10

Reported

2024-04-21 01:13

Platform

win7-20231129-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Umbral

stealer umbral

njRAT/Bladabindi

trojan njrat

AgentTesla payload

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables attemping to enumerate video devices using WMI

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM names

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox system UUIDs

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C C:\Users\Admin\AppData\Local\Temp\Umbral.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\Umbral.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\Umbral.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e210f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\Umbral.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2216 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\Umbral.exe
PID 2216 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\Umbral.exe
PID 2216 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\Umbral.exe
PID 2216 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2216 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2216 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2216 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2216 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe
PID 2216 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe
PID 2216 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe
PID 3060 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 3060 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 3060 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 3060 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 3060 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 3060 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 3060 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 3060 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 3060 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 3060 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 3060 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 3060 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 1580 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 1580 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 1580 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\Wbem\wmic.exe

Processes

C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe

"C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe"

C:\Users\Admin\AppData\Local\Temp\Umbral.exe

"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe

"C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE

C:\Windows\SysWOW64\netsh.exe

netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

Network

Country Destination Domain Proto
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 keyauth.win udp
US 172.67.72.57:443 keyauth.win tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 23.63.101.170:80 apps.identrust.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.124.142.205:19177 0.tcp.eu.ngrok.io tcp
DE 3.124.142.205:19177 0.tcp.eu.ngrok.io tcp
DE 3.124.142.205:19177 0.tcp.eu.ngrok.io tcp
DE 3.124.142.205:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
GB 172.217.16.227:443 gstatic.com tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.124.142.205:19177 0.tcp.eu.ngrok.io tcp
DE 3.124.142.205:19177 0.tcp.eu.ngrok.io tcp
DE 3.124.142.205:19177 0.tcp.eu.ngrok.io tcp
DE 3.124.142.205:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.158.249.75:19177 0.tcp.eu.ngrok.io tcp
DE 18.158.249.75:19177 0.tcp.eu.ngrok.io tcp
DE 18.158.249.75:19177 0.tcp.eu.ngrok.io tcp
DE 18.158.249.75:19177 0.tcp.eu.ngrok.io tcp
DE 18.158.249.75:19177 0.tcp.eu.ngrok.io tcp
DE 18.158.249.75:19177 0.tcp.eu.ngrok.io tcp
DE 18.158.249.75:19177 0.tcp.eu.ngrok.io tcp
DE 18.158.249.75:19177 0.tcp.eu.ngrok.io tcp
DE 18.158.249.75:19177 0.tcp.eu.ngrok.io tcp
DE 18.158.249.75:19177 0.tcp.eu.ngrok.io tcp

Files

memory/2216-0-0x0000000001200000-0x000000000145A000-memory.dmp

memory/2216-1-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

memory/2216-3-0x000000001B350000-0x000000001B3D0000-memory.dmp

memory/1580-14-0x0000000000840000-0x0000000000880000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 3071f4f7b11a6bf6c623e83eed6d2418
SHA1 37fd78d1296659109f2c94c9c750b5a98d158f11
SHA256 508bcd1a6b7ed82e60873eb1b035647ec9f8f9facdf65d6d6a73b8ef37d5bb9e
SHA512 e6bc32a3c955f80a9a54c261722f49032c1f32c50f98f0792af85769b87b4e9ef16ee4fd4f1e9e0a991e6f9311d54db99737401e6b5f32b503531e6859ad45b8

memory/2788-23-0x0000000000B40000-0x0000000000DBE000-memory.dmp

memory/1580-25-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

memory/2216-24-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe

MD5 33eb68c8c4fc521d64ed82219cdb19f2
SHA1 2d114152924ea141df11082d6f337bf7e9a81035
SHA256 24251c6105a1f345dbb16860c2405647127b8b03e03b0d0c1c61f896a6c7b7b0
SHA512 0b5090dbb977ac8b79b01a3d33c26592a7b98bd9461212f70fa3c092b359c93ad22c1c4bace3aacc22c74884b154989be2a724edf74efd20ef80dee78ac75f8a

memory/3060-26-0x00000000741A0000-0x000000007474B000-memory.dmp

memory/2788-28-0x000000001B020000-0x000000001B0A0000-memory.dmp

memory/3060-27-0x0000000002010000-0x0000000002050000-memory.dmp

memory/2788-31-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

memory/1580-32-0x000000001B0A0000-0x000000001B120000-memory.dmp

memory/3060-30-0x00000000741A0000-0x000000007474B000-memory.dmp

memory/2788-29-0x000000001C770000-0x000000001C984000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Umbral.exe

MD5 774fa31e76af56bbad395e1e3ac68721
SHA1 fe65c14179b2cf0cbd44758578cf878d7dcef879
SHA256 944c19f992f5301ac8936dcdbd4efb59fbc4f47dcdcc39a77b5e87b4effd27f4
SHA512 529ba2a356bf4fb3d4820c0da1dca58d1583ae37188e61300190d543144140f0f73072a9faf195dc214a13ac8c365354e2ab212a24646a332085481f47de8c7e

memory/2788-34-0x000000001B020000-0x000000001B0A0000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bc829140e404961c4718079b922f9d2e
SHA1 d76f3500dd24f91eb46d362e1610710c8b70a037
SHA256 6a875f3703ecfb8b0d129b3655d64ba1604653f67b750fcf18dc7900a8125a43
SHA512 f270bd65ec82d757576fddd720bac2010971621f15ab7659a04cc52f98e49187dfe4aa47443fcbf1fdf992bf0e324db0dfe521cfe8cc3410e6e3c60d981113d1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar44C1.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 f41c284c2cffaa502f6198c27635bb67
SHA1 0182ff4c8dcdadddffda9c9242de90923ed74f05
SHA256 3494c05e9d324d14ac0a6b3d6a94816dcf74c4ea8ed77b2080ffbf9e33bc888f
SHA512 3cff241e4b18e17e7521e5cc2bb6cbaf69b4a4c7ff9160ce4c1c2245c7d39ce72af574f59a01c6db7babbe597deef2ce4871dede3215ac96f7c6fbff3bd461f3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0e4c889f28d5fea4b584755348fdb4f6
SHA1 830345659ae8297e68526db5e74872ed9962391c
SHA256 5f9c43f325393cfef8d4f8e047dfd81443a9acaa3d7a272cc1a3d8c6ca109221
SHA512 ecc01e3dd38a133ad7155334dc3e839ff9dcf795c420e5ae87f1a422105320607cd10a26532cdb1a5586e9281bac4b4e1b89b9c6bb937fb86c083c68fd22956a

memory/3060-184-0x00000000741A0000-0x000000007474B000-memory.dmp

memory/1580-185-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

memory/2788-187-0x000000001B020000-0x000000001B0A0000-memory.dmp

memory/3060-186-0x0000000002010000-0x0000000002050000-memory.dmp

memory/3060-188-0x00000000741A0000-0x000000007474B000-memory.dmp

memory/2788-189-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

memory/2788-190-0x000000001B020000-0x000000001B0A0000-memory.dmp

memory/1580-191-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-21 01:10

Reported

2024-04-21 01:13

Platform

win10v2004-20240412-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Umbral

stealer umbral

njRAT/Bladabindi

trojan njrat

AgentTesla payload

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables attemping to enumerate video devices using WMI

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM names

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox system UUIDs

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\Umbral.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3684 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\Umbral.exe
PID 3684 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\Umbral.exe
PID 3684 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3684 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3684 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3684 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe
PID 3684 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe
PID 4052 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4052 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4052 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4052 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4052 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4052 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4052 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4052 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4808 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 4808 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 4808 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 4052 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4052 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4808 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 4808 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 4808 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 4808 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 4808 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 4808 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\netsh.exe
PID 4052 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4052 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4052 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4052 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4052 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4052 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4052 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4052 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4052 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\Wbem\wmic.exe
PID 4052 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Umbral.exe C:\Windows\System32\Wbem\wmic.exe

Processes

C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe

"C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe"

C:\Users\Admin\AppData\Local\Temp\Umbral.exe

"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe

"C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe"

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\SysWOW64\netsh.exe

netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 keyauth.win udp
US 172.67.72.57:443 keyauth.win tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 57.72.67.172.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 232.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 165.31.192.18.in-addr.arpa udp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
DE 18.192.31.165:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 39.102.125.3.in-addr.arpa udp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 14.251.17.2.in-addr.arpa udp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
DE 3.125.102.39:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.124.142.205:19177 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 205.142.124.3.in-addr.arpa udp
DE 3.124.142.205:19177 0.tcp.eu.ngrok.io tcp
DE 3.124.142.205:19177 0.tcp.eu.ngrok.io tcp
DE 3.124.142.205:19177 0.tcp.eu.ngrok.io tcp
DE 3.124.142.205:19177 0.tcp.eu.ngrok.io tcp
DE 3.124.142.205:19177 0.tcp.eu.ngrok.io tcp
DE 3.124.142.205:19177 0.tcp.eu.ngrok.io tcp

Files

memory/3684-0-0x00000000005C0000-0x000000000081A000-memory.dmp

memory/3684-1-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

memory/3684-3-0x0000000002940000-0x0000000002950000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Umbral.exe

MD5 774fa31e76af56bbad395e1e3ac68721
SHA1 fe65c14179b2cf0cbd44758578cf878d7dcef879
SHA256 944c19f992f5301ac8936dcdbd4efb59fbc4f47dcdcc39a77b5e87b4effd27f4
SHA512 529ba2a356bf4fb3d4820c0da1dca58d1583ae37188e61300190d543144140f0f73072a9faf195dc214a13ac8c365354e2ab212a24646a332085481f47de8c7e

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 3071f4f7b11a6bf6c623e83eed6d2418
SHA1 37fd78d1296659109f2c94c9c750b5a98d158f11
SHA256 508bcd1a6b7ed82e60873eb1b035647ec9f8f9facdf65d6d6a73b8ef37d5bb9e
SHA512 e6bc32a3c955f80a9a54c261722f49032c1f32c50f98f0792af85769b87b4e9ef16ee4fd4f1e9e0a991e6f9311d54db99737401e6b5f32b503531e6859ad45b8

memory/4052-19-0x0000019379E60000-0x0000019379EA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe

MD5 33eb68c8c4fc521d64ed82219cdb19f2
SHA1 2d114152924ea141df11082d6f337bf7e9a81035
SHA256 24251c6105a1f345dbb16860c2405647127b8b03e03b0d0c1c61f896a6c7b7b0
SHA512 0b5090dbb977ac8b79b01a3d33c26592a7b98bd9461212f70fa3c092b359c93ad22c1c4bace3aacc22c74884b154989be2a724edf74efd20ef80dee78ac75f8a

memory/4052-31-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

memory/3684-37-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

memory/4832-38-0x000002332EFB0000-0x000002332F22E000-memory.dmp

memory/4832-36-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

memory/4808-39-0x00000000752A0000-0x0000000075851000-memory.dmp

memory/4052-40-0x000001937C500000-0x000001937C510000-memory.dmp

memory/4832-41-0x0000023330EC0000-0x0000023330ED2000-memory.dmp

memory/4808-42-0x00000000752A0000-0x0000000075851000-memory.dmp

memory/4832-43-0x0000023331020000-0x0000023331030000-memory.dmp

memory/4832-44-0x0000023349900000-0x0000023349B14000-memory.dmp

memory/4832-46-0x0000023331020000-0x0000023331030000-memory.dmp

memory/3648-47-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

memory/3648-48-0x00000282D4D30000-0x00000282D4D40000-memory.dmp

memory/3648-49-0x00000282D4D30000-0x00000282D4D40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lar0ip4l.pfq.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3648-55-0x00000282EDC10000-0x00000282EDC32000-memory.dmp

memory/3648-62-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

memory/2100-66-0x000001F13C340000-0x000001F13C350000-memory.dmp

memory/2100-65-0x000001F13C340000-0x000001F13C350000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

memory/2100-64-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

memory/2100-78-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

memory/4052-81-0x000001937C690000-0x000001937C706000-memory.dmp

memory/4052-82-0x000001937BC30000-0x000001937BC80000-memory.dmp

memory/4052-83-0x000001937A330000-0x000001937A34E000-memory.dmp

memory/4832-86-0x000002334AD00000-0x000002334AD3C000-memory.dmp

memory/4288-99-0x000002B4BEAD0000-0x000002B4BEAE0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 966914e2e771de7a4a57a95b6ecfa8a9
SHA1 7a32282fd51dd032967ed4d9a40cc57e265aeff2
SHA256 98d3c70d7004fa807897317bd6cd3e977b9b6c72d4d2565aca0f9f8b1c315cba
SHA512 dc39c7124a9c7c8d4c7e8e16290c46360b8d9a8f4e43edaacbbeb09bdcf20159a53db54d2b322372001b6a3de52b2f88e9088b5fdbc7638816ae0d122bb015f5

memory/4288-98-0x000002B4BEAD0000-0x000002B4BEAE0000-memory.dmp

memory/4288-94-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

memory/4052-110-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

memory/4832-111-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

memory/4288-112-0x000002B4BEAD0000-0x000002B4BEAE0000-memory.dmp

memory/4820-115-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

memory/4820-117-0x0000026F76AA0000-0x0000026F76AB0000-memory.dmp

memory/4820-116-0x0000026F76AA0000-0x0000026F76AB0000-memory.dmp

memory/4288-114-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 276798eeb29a49dc6e199768bc9c2e71
SHA1 5fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256 cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA512 0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

memory/4052-129-0x000001937C500000-0x000001937C510000-memory.dmp

memory/4808-128-0x00000000752A0000-0x0000000075851000-memory.dmp

memory/4820-131-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

memory/4052-133-0x000001937BC80000-0x000001937BC8A000-memory.dmp

memory/4052-134-0x000001937C610000-0x000001937C622000-memory.dmp

memory/4832-137-0x0000023331020000-0x0000023331030000-memory.dmp

memory/4044-138-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

memory/4832-140-0x0000023331020000-0x0000023331030000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 02f8663a4dcbe619beca9d48cd769bc0
SHA1 e17f0a4041da07f2003b3c45e1ccf89774bc15b8
SHA256 e1f3a8eab40520ad75dc4c12e2b5020440d3c0c90f030ff4622faa7d50c359f5
SHA512 852137d4fca911faf0c5e52991b09c30eb8baf1d219d25ae82a8c69aa27eab99683a9a63db49cc6f29baf11c089ecb956539e1135cda74a303775c4c811666c2

memory/4044-139-0x000001AAF9680000-0x000001AAF9690000-memory.dmp

memory/4044-152-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp

memory/4052-157-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp