Malware Analysis Report

2024-09-11 08:52

Sample ID 240424-a8my2adc3y
Target explorer.exe
SHA256 fd15b9b162dcbe4f16157d4b13f69a6b2ede55fcd5ddb2a19bce8eb68a363e43
Tags
redline sectoprat xworm cheat discovery infostealer persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fd15b9b162dcbe4f16157d4b13f69a6b2ede55fcd5ddb2a19bce8eb68a363e43

Threat Level: Known bad

The file explorer.exe was found to be: Known bad.

Malicious Activity Summary

redline sectoprat xworm cheat discovery infostealer persistence rat spyware stealer trojan

RedLine payload

RedLine

SectopRAT

Detect Xworm Payload

SectopRAT payload

Xworm

Checks computer location settings

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Adds Run key to start application

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-04-24 00:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-24 00:53

Reported

2024-04-24 00:55

Platform

win7-20240215-en

Max time kernel

147s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\explorer.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\X1.lnk C:\Users\Admin\AppData\Roaming\X1.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Roaming\X2.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Roaming\X2.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\X1.lnk C:\Users\Admin\AppData\Roaming\X1.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\build.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\X1 = "C:\\Users\\Admin\\AppData\\Roaming\\X1.exe" C:\Users\Admin\AppData\Roaming\X1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe" C:\Users\Admin\AppData\Roaming\X2.exe N/A

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X2.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\build.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\build.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\X2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\build.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\X2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1876 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\X1.exe
PID 1876 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\X1.exe
PID 1876 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\X1.exe
PID 1876 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\X2.exe
PID 1876 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\X2.exe
PID 1876 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\X2.exe
PID 1876 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\build.exe
PID 1876 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\build.exe
PID 1876 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\build.exe
PID 1876 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\build.exe
PID 2560 wrote to memory of 800 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 800 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 800 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2520 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2520 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2520 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2520 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2520 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2520 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 816 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 816 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 816 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2520 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2520 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2520 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2520 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\schtasks.exe
PID 2520 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\schtasks.exe
PID 2520 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\schtasks.exe
PID 2560 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\schtasks.exe
PID 2560 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\schtasks.exe
PID 2560 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\schtasks.exe
PID 1420 wrote to memory of 2224 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\X1.exe
PID 1420 wrote to memory of 2224 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\X1.exe
PID 1420 wrote to memory of 2224 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\X1.exe
PID 1420 wrote to memory of 1760 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1420 wrote to memory of 1760 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1420 wrote to memory of 1760 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1420 wrote to memory of 1552 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1420 wrote to memory of 1552 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1420 wrote to memory of 1552 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1420 wrote to memory of 2988 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\X1.exe
PID 1420 wrote to memory of 2988 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\X1.exe
PID 1420 wrote to memory of 2988 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\X1.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\explorer.exe

"C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Users\Admin\AppData\Roaming\X1.exe

"C:\Users\Admin\AppData\Roaming\X1.exe"

C:\Users\Admin\AppData\Roaming\X2.exe

"C:\Users\Admin\AppData\Roaming\X2.exe"

C:\Users\Admin\AppData\Roaming\build.exe

"C:\Users\Admin\AppData\Roaming\build.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\X2.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\X1.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'X1.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'X2.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\X1.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "X1" /tr "C:\Users\Admin\AppData\Roaming\X1.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {59FBF37D-4D02-42E2-A3B8-2EC8BA4B6280} S-1-5-21-2248906074-2862704502-246302768-1000:GHPZRGFC\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\X1.exe

C:\Users\Admin\AppData\Roaming\X1.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\X1.exe

C:\Users\Admin\AppData\Roaming\X1.exe

Network

Country Destination Domain Proto
NL 91.92.252.220:1337 91.92.252.220 tcp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 api.ip.sb udp
US 172.67.75.172:443 api.ip.sb tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 91.92.252.220:4442 tcp
NL 91.92.252.220:7000 tcp

Files

memory/1876-0-0x0000000000810000-0x0000000000848000-memory.dmp

memory/1876-1-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

C:\Users\Admin\AppData\Roaming\X1.exe

MD5 2ab2f26ab78dbd53cea3b71c00d568c2
SHA1 53f0a2fdde2f1fe6e1ad44b87b8325624cdeb3fa
SHA256 1f204b43acfdf5d1088f37b2159d98d5500bdaeec99cd3f0d6e8ceb77282351b
SHA512 677cf83b6ed165d8ba5734e95bb1b53305cc69cd6a98edd26f2d8ca75978828d734b36739dbb58bf5b7830fe9c6ff894d4d9bf2aebe7285ba1c7de73f5c90e8d

C:\Users\Admin\AppData\Roaming\X2.exe

MD5 f8c0512008daff966ef349e7178d1239
SHA1 2a74048cf5009ab0f850e3992ffe7a453e3e18a5
SHA256 b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6
SHA512 f8c208da88e213f96531b09ea4cdffd82368373aeb9868f11e35135052cf80ffceb89c64da83969aa2df3505579fefc673a0e6346b3b6c361a7d29089f56a3fa

C:\Users\Admin\AppData\Roaming\build.exe

MD5 60e00124f9d54b2d423f02dc81b57127
SHA1 a250651ba1f3eb72bcf0f24a31ff2a66b0a39959
SHA256 ece58cdda5d85a7fe7d7262313b8041e3c988d814b7dd60f0468dbb7109596ba
SHA512 4a5b7529c9fd3325632a13fde5b01cd4bd21258fca2c358d3322127f9c74b86c69250a673d9fe9878a2c828870026661df62a3b95d5235b378bf83ff29a82add

memory/2520-19-0x0000000000D90000-0x0000000000DA2000-memory.dmp

memory/2520-17-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

memory/2560-16-0x0000000000B50000-0x0000000000B62000-memory.dmp

memory/2560-20-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

memory/1876-22-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

memory/2636-23-0x0000000000F10000-0x0000000000F2E000-memory.dmp

memory/2636-24-0x0000000074590000-0x0000000074C7E000-memory.dmp

memory/2636-25-0x0000000004890000-0x00000000048D0000-memory.dmp

memory/2560-26-0x0000000000380000-0x0000000000400000-memory.dmp

memory/2520-27-0x000000001B2A0000-0x000000001B320000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 eadc481711120311a2aa7451bb6f6778
SHA1 9e34b8ec445a544990db9904e166d931d09bf08c
SHA256 6cf072aa6ccedc96b86b32fda4950c5575c4c84c5e0962040a72ec99eebb49f9
SHA512 fb756f9c9d0725338420f97608e8608da0983abb159a047d7d2afa0c4187a6e700f12887b628b027a9ffcf8132fb74a5f89c186c7b10f48a456b17f16e53bf02

memory/2144-37-0x000000001B500000-0x000000001B7E2000-memory.dmp

memory/800-38-0x0000000002350000-0x0000000002358000-memory.dmp

memory/800-39-0x000007FEEEC00000-0x000007FEEF59D000-memory.dmp

memory/800-40-0x0000000002D30000-0x0000000002DB0000-memory.dmp

memory/2144-41-0x0000000002990000-0x0000000002A10000-memory.dmp

memory/2144-43-0x000007FEEEC00000-0x000007FEEF59D000-memory.dmp

memory/2144-45-0x000000000299B000-0x0000000002A02000-memory.dmp

memory/800-44-0x0000000002D30000-0x0000000002DB0000-memory.dmp

memory/800-47-0x000007FEEEC00000-0x000007FEEF59D000-memory.dmp

memory/800-48-0x0000000002D30000-0x0000000002DB0000-memory.dmp

memory/800-46-0x0000000002D30000-0x0000000002DB0000-memory.dmp

memory/2144-42-0x0000000002994000-0x0000000002997000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2732-58-0x000000001B630000-0x000000001B912000-memory.dmp

memory/1260-62-0x0000000001D20000-0x0000000001D28000-memory.dmp

memory/2732-63-0x0000000002D40000-0x0000000002DC0000-memory.dmp

memory/2732-64-0x000007FEEE260000-0x000007FEEEBFD000-memory.dmp

memory/2732-61-0x000007FEEE260000-0x000007FEEEBFD000-memory.dmp

memory/2732-65-0x0000000002D40000-0x0000000002DC0000-memory.dmp

memory/1260-67-0x0000000002C40000-0x0000000002CC0000-memory.dmp

memory/1260-66-0x000007FEEE260000-0x000007FEEEBFD000-memory.dmp

memory/1260-68-0x0000000002C40000-0x0000000002CC0000-memory.dmp

memory/2520-69-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

memory/2732-70-0x0000000002D40000-0x0000000002DC0000-memory.dmp

memory/1260-72-0x0000000002C40000-0x0000000002CC0000-memory.dmp

memory/2732-73-0x0000000002D40000-0x0000000002DC0000-memory.dmp

memory/2560-71-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

memory/2732-74-0x000007FEEE260000-0x000007FEEEBFD000-memory.dmp

memory/1260-75-0x000007FEEE260000-0x000007FEEEBFD000-memory.dmp

memory/2636-81-0x0000000074590000-0x0000000074C7E000-memory.dmp

memory/816-84-0x0000000002C80000-0x0000000002D00000-memory.dmp

memory/816-82-0x000007FEEEC00000-0x000007FEEF59D000-memory.dmp

memory/816-89-0x000007FEEEC00000-0x000007FEEF59D000-memory.dmp

memory/816-90-0x0000000002C80000-0x0000000002D00000-memory.dmp

memory/1584-91-0x0000000002CF0000-0x0000000002D70000-memory.dmp

memory/1584-92-0x000007FEEEC00000-0x000007FEEF59D000-memory.dmp

memory/1584-93-0x0000000002CF0000-0x0000000002D70000-memory.dmp

memory/1584-94-0x0000000002CF0000-0x0000000002D70000-memory.dmp

memory/816-95-0x0000000002C80000-0x0000000002D00000-memory.dmp

memory/2636-96-0x0000000004890000-0x00000000048D0000-memory.dmp

memory/1584-97-0x000007FEEEC00000-0x000007FEEF59D000-memory.dmp

memory/1584-98-0x0000000002CFB000-0x0000000002D62000-memory.dmp

memory/1584-99-0x000007FEEEC00000-0x000007FEEF59D000-memory.dmp

memory/816-107-0x000007FEEEC00000-0x000007FEEF59D000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

memory/1612-134-0x000007FEEE260000-0x000007FEEEBFD000-memory.dmp

memory/1612-135-0x0000000002B80000-0x0000000002C00000-memory.dmp

memory/1612-133-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tar39DC.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

memory/1612-149-0x000007FEEE260000-0x000007FEEEBFD000-memory.dmp

memory/1612-151-0x000007FEEE260000-0x000007FEEEBFD000-memory.dmp

memory/1612-153-0x0000000002B80000-0x0000000002C00000-memory.dmp

memory/2560-154-0x0000000000380000-0x0000000000400000-memory.dmp

memory/1612-152-0x0000000002B84000-0x0000000002B87000-memory.dmp

memory/1612-150-0x0000000002B80000-0x0000000002C00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp427E.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp4293.tmp

MD5 d5ee43d2a25c2370159327c951da3f57
SHA1 11b76c32e3a08381101d597187e3c96788659025
SHA256 c66200d56aced972e2dd7d63f73c12d0e7f575827ea54f83ac66a37f832234ed
SHA512 8108a4bcde1fed31b7ae863510e4705ad74c934a53e42dbd51cad8701c4a272af939e38076904dc7941dcbfd57aa60152798250af34696c196171a465fb5a1dd

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-24 00:53

Reported

2024-04-24 00:55

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\explorer.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\X2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\explorer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\X1.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\X1.lnk C:\Users\Admin\AppData\Roaming\X1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\X1.lnk C:\Users\Admin\AppData\Roaming\X1.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Roaming\X2.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Roaming\X2.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\build.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\X1 = "C:\\Users\\Admin\\AppData\\Roaming\\X1.exe" C:\Users\Admin\AppData\Roaming\X1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe" C:\Users\Admin\AppData\Roaming\X2.exe N/A

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\X2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\build.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\build.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\build.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\X2.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\X2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\build.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\X1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\X2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3544 wrote to memory of 5280 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\X1.exe
PID 3544 wrote to memory of 5280 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\X1.exe
PID 3544 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\X2.exe
PID 3544 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\X2.exe
PID 3544 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\build.exe
PID 3544 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\build.exe
PID 3544 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Users\Admin\AppData\Roaming\build.exe
PID 4972 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4972 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5280 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5280 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5280 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5280 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4972 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4972 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5280 wrote to memory of 6024 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5280 wrote to memory of 6024 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4972 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4972 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4972 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4972 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5280 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\schtasks.exe
PID 5280 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Roaming\X1.exe C:\Windows\System32\schtasks.exe
PID 4972 wrote to memory of 5212 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\schtasks.exe
PID 4972 wrote to memory of 5212 N/A C:\Users\Admin\AppData\Roaming\X2.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\explorer.exe

"C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Users\Admin\AppData\Roaming\X1.exe

"C:\Users\Admin\AppData\Roaming\X1.exe"

C:\Users\Admin\AppData\Roaming\X2.exe

"C:\Users\Admin\AppData\Roaming\X2.exe"

C:\Users\Admin\AppData\Roaming\build.exe

"C:\Users\Admin\AppData\Roaming\build.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\X1.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\X2.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'X1.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'X2.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\X1.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "X1" /tr "C:\Users\Admin\AppData\Roaming\X1.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\X1.exe

C:\Users\Admin\AppData\Roaming\X1.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\X1.exe

C:\Users\Admin\AppData\Roaming\X1.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
NL 91.92.252.220:1337 91.92.252.220 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
NL 91.92.252.220:4442 tcp
US 8.8.8.8:53 220.252.92.91.in-addr.arpa udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp
US 8.8.8.8:53 31.13.26.104.in-addr.arpa udp
GB 142.250.187.202:443 tcp
NL 91.92.252.220:7000 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 210.143.182.52.in-addr.arpa udp

Files

memory/3544-0-0x0000000000250000-0x0000000000288000-memory.dmp

memory/3544-1-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

C:\Users\Admin\AppData\Roaming\X1.exe

MD5 2ab2f26ab78dbd53cea3b71c00d568c2
SHA1 53f0a2fdde2f1fe6e1ad44b87b8325624cdeb3fa
SHA256 1f204b43acfdf5d1088f37b2159d98d5500bdaeec99cd3f0d6e8ceb77282351b
SHA512 677cf83b6ed165d8ba5734e95bb1b53305cc69cd6a98edd26f2d8ca75978828d734b36739dbb58bf5b7830fe9c6ff894d4d9bf2aebe7285ba1c7de73f5c90e8d

memory/5280-16-0x0000000000A40000-0x0000000000A52000-memory.dmp

C:\Users\Admin\AppData\Roaming\X2.exe

MD5 f8c0512008daff966ef349e7178d1239
SHA1 2a74048cf5009ab0f850e3992ffe7a453e3e18a5
SHA256 b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6
SHA512 f8c208da88e213f96531b09ea4cdffd82368373aeb9868f11e35135052cf80ffceb89c64da83969aa2df3505579fefc673a0e6346b3b6c361a7d29089f56a3fa

C:\Users\Admin\AppData\Roaming\build.exe

MD5 60e00124f9d54b2d423f02dc81b57127
SHA1 a250651ba1f3eb72bcf0f24a31ff2a66b0a39959
SHA256 ece58cdda5d85a7fe7d7262313b8041e3c988d814b7dd60f0468dbb7109596ba
SHA512 4a5b7529c9fd3325632a13fde5b01cd4bd21258fca2c358d3322127f9c74b86c69250a673d9fe9878a2c828870026661df62a3b95d5235b378bf83ff29a82add

memory/4972-35-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/4972-34-0x0000000000D40000-0x0000000000D52000-memory.dmp

memory/5280-17-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/3544-39-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/5280-40-0x000000001B620000-0x000000001B630000-memory.dmp

memory/4972-41-0x0000000002EC0000-0x0000000002ED0000-memory.dmp

memory/2760-53-0x0000000074D00000-0x00000000754B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5cyu2sdt.a5e.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3384-55-0x000001F3CDF40000-0x000001F3CDF50000-memory.dmp

memory/3384-54-0x000001F3CDF40000-0x000001F3CDF50000-memory.dmp

memory/5036-65-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/3384-52-0x000001F3E8680000-0x000001F3E86A2000-memory.dmp

memory/3384-66-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/3384-68-0x000001F3CDF40000-0x000001F3CDF50000-memory.dmp

memory/5036-69-0x00000205B16D0000-0x00000205B16E0000-memory.dmp

memory/2760-67-0x0000000000C70000-0x0000000000C8E000-memory.dmp

memory/3384-70-0x000001F3CDF40000-0x000001F3CDF50000-memory.dmp

memory/5280-71-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/2760-72-0x0000000005C20000-0x0000000006238000-memory.dmp

memory/5036-79-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/3384-78-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3a6bad9528f8e23fb5c77fbd81fa28e8
SHA1 f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

memory/4424-80-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/1800-99-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/4972-101-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/4424-102-0x000001FE3DFD0000-0x000001FE3DFE0000-memory.dmp

memory/1800-104-0x000001DBF71D0000-0x000001DBF71E0000-memory.dmp

memory/2760-100-0x0000000005640000-0x0000000005652000-memory.dmp

memory/5280-105-0x000000001B620000-0x000000001B630000-memory.dmp

memory/2760-107-0x00000000056A0000-0x00000000056DC000-memory.dmp

memory/4972-106-0x0000000002EC0000-0x0000000002ED0000-memory.dmp

memory/2760-108-0x0000000074D00000-0x00000000754B0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 17e45724e81fad9d4f4eda74fe6b349e
SHA1 0ef309ee5638e1055c0f0fe7cd693a5643a1e4a3
SHA256 444084a5dd84f5aeaa084a27da160ea4501574fbb27da9d7aab3c6c5b3269eb6
SHA512 c1b0dd77c2ae9c15843b3bac8de6874609ebeffa5e10e552b364340c51bde690ac563c132dbc14f93e68d3a7939ea840fa687eb1bd603d646acf88a3430b6e45

memory/1800-113-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/4424-112-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/6024-114-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/6024-117-0x0000017A3D900000-0x0000017A3D910000-memory.dmp

memory/6024-118-0x0000017A3D900000-0x0000017A3D910000-memory.dmp

memory/4160-116-0x0000029FB7E00000-0x0000029FB7E10000-memory.dmp

memory/4160-115-0x0000029FB7E00000-0x0000029FB7E10000-memory.dmp

memory/4160-119-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/6024-139-0x0000017A3D900000-0x0000017A3D910000-memory.dmp

memory/4160-140-0x0000029FB7E00000-0x0000029FB7E10000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e5663972c1caaba7088048911c758bf3
SHA1 3462dea0f9c2c16a9c3afdaef8bbb1f753c1c198
SHA256 9f7f29a4696876cadca3f14d7e43f9ede0c97fd64be3f5d94bda49a91b6a419e
SHA512 ff4e72c46cf083de62baa2ce2661555dd91b5f144294015f7b262fd4500cb67fe80e1871a82da63b607e3e9cef401f4b73c587bf1134637881ecad51aad1eddc

memory/4160-145-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/6024-144-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/4188-146-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/2760-158-0x00000000055F0000-0x0000000005600000-memory.dmp

memory/4188-157-0x0000013F4E290000-0x0000013F4E2A0000-memory.dmp

memory/4188-160-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/2760-162-0x00000000056E0000-0x000000000572C000-memory.dmp

memory/2760-167-0x0000000005940000-0x0000000005A4A000-memory.dmp

memory/2760-168-0x0000000006C20000-0x0000000006DE2000-memory.dmp

memory/2760-169-0x0000000007320000-0x000000000784C000-memory.dmp

memory/2760-170-0x0000000006BB0000-0x0000000006C16000-memory.dmp

memory/2760-195-0x0000000007E00000-0x00000000083A4000-memory.dmp

memory/2760-196-0x0000000007160000-0x00000000071F2000-memory.dmp

memory/2760-197-0x0000000007280000-0x00000000072F6000-memory.dmp

memory/2760-198-0x0000000007250000-0x000000000726E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp7F85.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp7FC9.tmp

MD5 4c2e2189b87f507edc2e72d7d55583a0
SHA1 1f06e340f76d41ea0d1e8560acd380a901b2a5bd
SHA256 99a5f8dea08b5cf512ed888b3e533cc77c08dc644078793dc870abd8828c1bca
SHA512 8b6b49e55afe8a697aaf71d975fab9e906143339827f75a57876a540d0d7b9e3cbbcdd8b5435d6198900a73895cc52d2082e66ee8cec342e72f2e427dde71600

C:\Users\Admin\AppData\Local\Temp\tmp8023.tmp

MD5 d444c807029c83b8a892ac0c4971f955
SHA1 fa58ce7588513519dc8fed939b26b05dc25e53b5
SHA256 8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259
SHA512 b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e

C:\Users\Admin\AppData\Local\Temp\tmp8049.tmp

MD5 bf69aee53eb7e09784128e340390db21
SHA1 865c14f705ff90740cfca41125503f7b09d3b02d
SHA256 2e278ecc4627497ad3f5cb82afe333e221e36f464a06b9d0926583add3f5c4b3
SHA512 d6ee39f91cae3960aa6f2a251649eb6f7bf213539aaee8ea9c7db511cd2e35de1c62dab75f6e94eb6c48c45c0825fad0e0073e26204f1f2868e4dfffa44cfcc0

C:\Users\Admin\AppData\Local\Temp\tmp8083.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

memory/2760-333-0x0000000074D00000-0x00000000754B0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

memory/6140-337-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/3532-339-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/6140-340-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/3532-342-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

memory/4188-346-0x00007FFD84570000-0x00007FFD85031000-memory.dmp