Malware Analysis Report

2024-10-10 10:06

Sample ID 240428-24magsbg61
Target https://download.oxy.st/d/wXOh/2/b18d9bd17d358652a7abc06ed4c4f63f
Tags
umbral stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://download.oxy.st/d/wXOh/2/b18d9bd17d358652a7abc06ed4c4f63f was found to be: Known bad.

Malicious Activity Summary

umbral stealer

Umbral

Detect Umbral payload

Executes dropped EXE

Checks computer location settings

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-28 23:08

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-28 23:08

Reported

2024-04-28 23:11

Platform

win10v2004-20240226-en

Max time kernel

163s

Max time network

166s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download.oxy.st/d/wXOh/2/b18d9bd17d358652a7abc06ed4c4f63f

Signatures

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Umbral

stealer umbral

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7zOCB940149\KrampusUI.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7zOCB95F789\KrampusUI.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7zOCB9908C9\KrampusUI.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Critical Error_4BetaFix\KrampusUI.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2-step.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2-step.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2492 wrote to memory of 4636 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOCB940149\KrampusUI.exe
PID 2492 wrote to memory of 4636 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOCB940149\KrampusUI.exe
PID 4636 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\7zOCB940149\KrampusUI.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 4636 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\7zOCB940149\KrampusUI.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 4636 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\7zOCB940149\KrampusUI.exe C:\Users\Admin\AppData\Local\Temp\2-step.exe
PID 4636 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\7zOCB940149\KrampusUI.exe C:\Users\Admin\AppData\Local\Temp\2-step.exe
PID 4756 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\2-step.exe C:\Windows\System32\Wbem\wmic.exe
PID 4756 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\2-step.exe C:\Windows\System32\Wbem\wmic.exe
PID 2492 wrote to memory of 1764 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOCB95F789\KrampusUI.exe
PID 2492 wrote to memory of 1764 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOCB95F789\KrampusUI.exe
PID 1764 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\7zOCB95F789\KrampusUI.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 1764 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\7zOCB95F789\KrampusUI.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 1764 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\7zOCB95F789\KrampusUI.exe C:\Users\Admin\AppData\Local\Temp\2-step.exe
PID 1764 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\7zOCB95F789\KrampusUI.exe C:\Users\Admin\AppData\Local\Temp\2-step.exe
PID 2316 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\2-step.exe C:\Windows\System32\Wbem\wmic.exe
PID 2316 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\2-step.exe C:\Windows\System32\Wbem\wmic.exe
PID 2492 wrote to memory of 5000 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOCB9908C9\KrampusUI.exe
PID 2492 wrote to memory of 5000 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOCB9908C9\KrampusUI.exe
PID 5000 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\7zOCB9908C9\KrampusUI.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 5000 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\7zOCB9908C9\KrampusUI.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 5000 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\7zOCB9908C9\KrampusUI.exe C:\Users\Admin\AppData\Local\Temp\2-step.exe
PID 5000 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\7zOCB9908C9\KrampusUI.exe C:\Users\Admin\AppData\Local\Temp\2-step.exe
PID 3056 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\2-step.exe C:\Windows\System32\Wbem\wmic.exe
PID 3056 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\2-step.exe C:\Windows\System32\Wbem\wmic.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download.oxy.st/d/wXOh/2/b18d9bd17d358652a7abc06ed4c4f63f

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4588 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5720 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5872 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=3644 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5540 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=3712 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5308 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --mojo-platform-channel-handle=6224 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --mojo-platform-channel-handle=6180 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --mojo-platform-channel-handle=5560 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --mojo-platform-channel-handle=5704 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6412 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=5560 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --mojo-platform-channel-handle=6544 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6796 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7200 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Critical Error_4Beta.rar"

C:\Users\Admin\AppData\Local\Temp\7zOCB940149\KrampusUI.exe

"C:\Users\Admin\AppData\Local\Temp\7zOCB940149\KrampusUI.exe"

C:\Users\Admin\AppData\Local\Temp\Update.exe

"C:\Users\Admin\AppData\Local\Temp\Update.exe"

C:\Users\Admin\AppData\Local\Temp\2-step.exe

"C:\Users\Admin\AppData\Local\Temp\2-step.exe"

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Users\Admin\AppData\Local\Temp\7zOCB95F789\KrampusUI.exe

"C:\Users\Admin\AppData\Local\Temp\7zOCB95F789\KrampusUI.exe"

C:\Users\Admin\AppData\Local\Temp\Update.exe

"C:\Users\Admin\AppData\Local\Temp\Update.exe"

C:\Users\Admin\AppData\Local\Temp\2-step.exe

"C:\Users\Admin\AppData\Local\Temp\2-step.exe"

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Users\Admin\AppData\Local\Temp\7zOCB9908C9\KrampusUI.exe

"C:\Users\Admin\AppData\Local\Temp\7zOCB9908C9\KrampusUI.exe"

C:\Users\Admin\AppData\Local\Temp\Update.exe

"C:\Users\Admin\AppData\Local\Temp\Update.exe"

C:\Users\Admin\AppData\Local\Temp\2-step.exe

"C:\Users\Admin\AppData\Local\Temp\2-step.exe"

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

Network

Country Destination Domain Proto
US 8.8.8.8:53 download.oxy.st udp
US 8.8.8.8:53 download.oxy.st udp
RU 185.178.208.137:443 download.oxy.st tcp
US 8.8.8.8:53 download.oxy.st udp
US 8.8.8.8:53 137.208.178.185.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
GB 51.140.242.104:443 nav-edge.smartscreen.microsoft.com tcp
GB 51.140.242.104:443 nav-edge.smartscreen.microsoft.com tcp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
BE 2.21.17.194:443 www.microsoft.com tcp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
NL 104.109.143.150:443 bzib.nelreports.net tcp
US 8.8.8.8:53 104.242.140.51.in-addr.arpa udp
US 8.8.8.8:53 contextual.media.net udp
US 8.8.8.8:53 contextual.media.net udp
BE 2.21.16.25:443 contextual.media.net tcp
US 8.8.8.8:53 25.16.21.2.in-addr.arpa udp
US 8.8.8.8:53 150.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 194.17.21.2.in-addr.arpa udp
US 8.8.8.8:53 ads.themoneytizer.com udp
US 172.67.43.178:443 ads.themoneytizer.com tcp
US 172.67.43.178:443 ads.themoneytizer.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 smatr.net udp
US 8.8.8.8:53 smatr.net udp
NL 88.208.46.222:443 smatr.net tcp
US 8.8.8.8:53 cdn.adlook.me udp
US 8.8.8.8:53 cdn.adlook.me udp
US 8.8.8.8:53 lg3.media.net udp
US 8.8.8.8:53 lg3.media.net udp
US 23.220.112.27:443 lg3.media.net tcp
US 8.8.8.8:53 227.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 178.43.67.172.in-addr.arpa udp
US 8.8.8.8:53 222.46.208.88.in-addr.arpa udp
RU 193.17.93.93:443 cdn.adlook.me tcp
US 8.8.8.8:53 onetag-sys.com udp
US 8.8.8.8:53 onetag-sys.com udp
US 8.8.8.8:53 onetag-sys.com udp
US 8.8.8.8:53 download.oxy.st udp
DE 51.89.9.253:443 onetag-sys.com tcp
US 8.8.8.8:53 ced.sascdn.com udp
US 8.8.8.8:53 ced.sascdn.com udp
US 8.8.8.8:53 gum.criteo.com udp
US 8.8.8.8:53 gum.criteo.com udp
US 8.8.8.8:53 tag.leadplace.fr udp
US 8.8.8.8:53 tag.leadplace.fr udp
US 8.8.8.8:53 secure.quantserve.com udp
US 8.8.8.8:53 secure.quantserve.com udp
US 8.8.8.8:53 p.cpx.to udp
US 8.8.8.8:53 p.cpx.to udp
US 8.8.8.8:53 adtrack.adleadevent.com udp
US 8.8.8.8:53 adtrack.adleadevent.com udp
US 8.8.8.8:53 yastatic.net udp
US 8.8.8.8:53 yastatic.net udp
US 8.8.8.8:53 ogffa.net udp
US 8.8.8.8:53 ogffa.net udp
US 2.18.190.81:443 ced.sascdn.com tcp
DE 91.228.74.205:443 secure.quantserve.com tcp
RU 178.154.131.217:443 yastatic.net tcp
RU 178.154.131.217:443 yastatic.net tcp
IE 52.210.131.165:443 adtrack.adleadevent.com tcp
NL 178.250.1.11:443 gum.criteo.com tcp
IE 18.203.226.119:443 p.cpx.to tcp
NL 88.208.46.222:443 ogffa.net tcp
FR 145.239.193.51:443 tag.leadplace.fr tcp
US 8.8.8.8:53 counter.yadro.ru udp
US 8.8.8.8:53 counter.yadro.ru udp
US 8.8.8.8:53 system-notify.app udp
US 8.8.8.8:53 system-notify.app udp
RU 88.212.201.198:443 counter.yadro.ru tcp
DE 157.90.33.121:443 system-notify.app tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 cdn.adlook.me udp
US 8.8.8.8:53 cdn.adlook.me udp
US 8.8.8.8:53 cdn.adlook.me udp
US 8.8.8.8:53 download.oxy.st udp
US 8.8.8.8:53 ads.adlook.me udp
US 8.8.8.8:53 ads.adlook.me udp
US 8.8.8.8:53 27.112.220.23.in-addr.arpa udp
US 8.8.8.8:53 93.93.17.193.in-addr.arpa udp
US 8.8.8.8:53 253.9.89.51.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 81.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 217.131.154.178.in-addr.arpa udp
US 8.8.8.8:53 11.1.250.178.in-addr.arpa udp
US 8.8.8.8:53 165.131.210.52.in-addr.arpa udp
US 8.8.8.8:53 205.74.228.91.in-addr.arpa udp
US 8.8.8.8:53 51.193.239.145.in-addr.arpa udp
US 8.8.8.8:53 119.226.203.18.in-addr.arpa udp
US 8.8.8.8:53 121.33.90.157.in-addr.arpa udp
US 8.8.8.8:53 198.201.212.88.in-addr.arpa udp
RU 193.17.93.93:443 cdn.adlook.me tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
RU 5.101.76.186:443 ads.adlook.me tcp
US 8.8.8.8:53 csm.nl3.eu.criteo.net udp
US 8.8.8.8:53 csm.nl3.eu.criteo.net udp
NL 178.250.1.25:443 csm.nl3.eu.criteo.net tcp
US 8.8.8.8:53 rules.quantcount.com udp
US 8.8.8.8:53 rules.quantcount.com udp
CH 18.165.183.57:443 rules.quantcount.com tcp
US 8.8.8.8:53 133.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 186.76.101.5.in-addr.arpa udp
US 8.8.8.8:53 id5-sync.com udp
US 8.8.8.8:53 id5-sync.com udp
DE 157.90.33.121:443 system-notify.app tcp
US 8.8.8.8:53 tag.leadplace.fr udp
US 8.8.8.8:53 tag.leadplace.fr udp
US 8.8.8.8:53 ib.adnxs.com udp
US 8.8.8.8:53 ib.adnxs.com udp
DE 162.19.138.82:443 id5-sync.com tcp
US 8.8.8.8:53 tag.leadplace.fr udp
US 8.8.8.8:53 download.oxy.st udp
DE 162.19.138.82:443 id5-sync.com tcp
FR 145.239.193.51:443 tag.leadplace.fr tcp
DE 37.252.171.149:443 ib.adnxs.com tcp
US 8.8.8.8:53 match.adsrvr.org udp
US 8.8.8.8:53 match.adsrvr.org udp
US 8.8.8.8:53 pixel.quantserve.com udp
US 8.8.8.8:53 pixel.quantserve.com udp
US 52.223.40.198:443 match.adsrvr.org tcp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 57.183.165.18.in-addr.arpa udp
US 8.8.8.8:53 25.1.250.178.in-addr.arpa udp
US 8.8.8.8:53 82.138.19.162.in-addr.arpa udp
US 8.8.8.8:53 149.171.252.37.in-addr.arpa udp
US 8.8.8.8:53 198.40.223.52.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 20.42.65.92:443 nw-umwatson.events.data.microsoft.com tcp
US 8.8.8.8:53 92.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 tmzr.themoneytizer.fr udp
US 8.8.8.8:53 tmzr.themoneytizer.fr udp
NL 88.208.46.222:443 ogffa.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 172.67.174.127:443 tmzr.themoneytizer.fr udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 127.174.67.172.in-addr.arpa udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 s.cpx.to udp
US 8.8.8.8:53 s.cpx.to udp
US 8.8.8.8:53 uidsync.net udp
US 8.8.8.8:53 uidsync.net udp
IE 63.32.182.32:443 s.cpx.to tcp
DE 23.88.8.125:443 uidsync.net tcp
DE 23.88.8.125:443 uidsync.net tcp
NL 178.250.1.11:443 gum.criteo.com tcp
DE 162.19.138.82:443 id5-sync.com tcp
US 8.8.8.8:53 id.crwdcntrl.net udp
US 8.8.8.8:53 id.crwdcntrl.net udp
IE 52.49.90.166:443 id.crwdcntrl.net tcp
US 8.8.8.8:53 gum.criteo.com udp
US 8.8.8.8:53 gum.criteo.com udp
US 8.8.8.8:53 gum.criteo.com udp
US 8.8.8.8:53 download.oxy.st udp
NL 178.250.1.11:443 gum.criteo.com tcp
US 8.8.8.8:53 ww1097.smartadserver.com udp
US 8.8.8.8:53 ww1097.smartadserver.com udp
NL 178.250.1.11:443 gum.criteo.com tcp
NL 178.250.1.11:443 gum.criteo.com tcp
FR 164.132.25.177:443 ww1097.smartadserver.com tcp
US 8.8.8.8:53 lb.eu-1-id5-sync.com udp
US 8.8.8.8:53 lb.eu-1-id5-sync.com udp
FR 164.132.25.177:443 ww1097.smartadserver.com tcp
DE 141.95.98.64:443 lb.eu-1-id5-sync.com tcp
US 8.8.8.8:53 dnacdn.net udp
US 8.8.8.8:53 dnacdn.net udp
US 8.8.8.8:53 ag.gbc.criteo.com udp
US 8.8.8.8:53 ag.gbc.criteo.com udp
US 8.8.8.8:53 gem.gbc.criteo.com udp
US 8.8.8.8:53 gem.gbc.criteo.com udp
FR 178.250.7.13:443 dnacdn.net tcp
NL 185.235.87.159:443 ag.gbc.criteo.com tcp
NL 185.235.87.215:443 gem.gbc.criteo.com tcp
DE 162.19.138.82:443 lb.eu-1-id5-sync.com tcp
NL 178.250.1.25:443 csm.nl3.eu.criteo.net tcp
US 8.8.8.8:53 32.182.32.63.in-addr.arpa udp
US 8.8.8.8:53 125.8.88.23.in-addr.arpa udp
US 8.8.8.8:53 166.90.49.52.in-addr.arpa udp
US 8.8.8.8:53 177.25.132.164.in-addr.arpa udp
US 8.8.8.8:53 64.98.95.141.in-addr.arpa udp
US 8.8.8.8:53 13.7.250.178.in-addr.arpa udp
US 8.8.8.8:53 159.87.235.185.in-addr.arpa udp
US 8.8.8.8:53 215.87.235.185.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 download.oxy.st udp
US 8.8.8.8:53 download.oxy.st udp
NL 88.208.46.222:443 ogffa.net tcp
US 8.8.8.8:53 onetag-sys.com udp
US 8.8.8.8:53 download.oxy.st udp
DE 51.89.9.253:443 onetag-sys.com udp
US 23.220.112.27:443 lg3.media.net udp
US 8.8.8.8:53 tag.leadplace.fr udp
US 8.8.8.8:53 download.oxy.st udp
FR 145.239.193.51:443 tag.leadplace.fr tcp
DE 37.252.171.149:443 ib.adnxs.com tcp
DE 51.89.9.253:443 onetag-sys.com tcp
US 8.8.8.8:53 cdn.adlook.me udp
US 8.8.8.8:53 download.oxy.st udp
NL 178.250.1.11:443 gum.criteo.com tcp
US 8.8.8.8:53 gum.criteo.com udp
US 8.8.8.8:53 download.oxy.st udp
US 8.8.8.8:53 csm.nl3.eu.criteo.net udp
US 8.8.8.8:53 csm.nl3.eu.criteo.net udp
RU 88.212.201.198:443 counter.yadro.ru tcp
NL 178.250.1.25:443 csm.nl3.eu.criteo.net tcp
DE 157.90.33.121:443 uidsync.net tcp
DE 23.88.8.125:443 uidsync.net tcp
DE 23.88.8.125:443 uidsync.net tcp
US 8.8.8.8:53 s1.oxy.st udp
US 8.8.8.8:53 s1.oxy.st udp
US 104.21.234.182:443 s1.oxy.st tcp
FR 178.250.7.13:443 dnacdn.net tcp
NL 185.235.87.159:443 ag.gbc.criteo.com tcp
NL 185.235.87.215:443 gem.gbc.criteo.com tcp
NL 178.250.1.11:443 gum.criteo.com tcp
RU 178.154.131.217:443 yastatic.net tcp
NL 178.250.1.11:443 gum.criteo.com tcp
US 8.8.8.8:53 182.234.21.104.in-addr.arpa udp
NL 178.250.1.11:443 gum.criteo.com tcp
FR 164.132.25.177:443 ww1097.smartadserver.com tcp
NL 178.250.1.11:443 gum.criteo.com tcp
FR 164.132.25.177:443 ww1097.smartadserver.com tcp
NL 23.62.61.97:443 www.bing.com udp
US 8.8.8.8:53 134.190.18.2.in-addr.arpa udp
FR 164.132.25.177:443 ww1097.smartadserver.com tcp
FR 164.132.25.177:443 ww1097.smartadserver.com tcp
US 8.8.8.8:53 dl-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 dl-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 app-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 app-edge.smartscreen.microsoft.com udp
GB 51.11.108.188:443 app-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
FR 164.132.25.177:443 ww1097.smartadserver.com tcp
US 8.8.8.8:53 metrics.biddertmz.com udp
US 8.8.8.8:53 metrics.biddertmz.com udp
IE 34.248.22.168:443 metrics.biddertmz.com tcp
FR 164.132.25.177:443 ww1097.smartadserver.com tcp
US 8.8.8.8:53 168.22.248.34.in-addr.arpa udp
US 8.8.8.8:53 cdn.adlook.me udp
US 8.8.8.8:53 cdn.adlook.me udp
NL 178.250.1.11:443 gum.criteo.com tcp
US 8.8.8.8:53 yastatic.net udp
US 8.8.8.8:53 yastatic.net udp
RU 193.17.93.93:443 cdn.adlook.me tcp
US 8.8.8.8:53 gstatic.com udp
GB 216.58.201.99:443 gstatic.com tcp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
FR 164.132.25.177:443 ww1097.smartadserver.com tcp
FR 164.132.25.177:443 ww1097.smartadserver.com tcp
GB 216.58.201.99:443 gstatic.com tcp
GB 216.58.201.99:443 gstatic.com tcp
US 8.8.8.8:53 226.162.46.104.in-addr.arpa udp
FR 164.132.25.177:443 ww1097.smartadserver.com tcp
FR 164.132.25.177:443 ww1097.smartadserver.com tcp
RU 185.178.208.137:443 tcp
NL 178.250.1.11:443 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
RU 178.154.131.217:443 tcp

Files

C:\Users\Admin\AppData\Local\Temp\7zOCB940149\KrampusUI.exe

MD5 3b7d0635ec7df3d5ff0dc1e856889aa1
SHA1 cdf39ae3484d2522f84e8a6a1920f50d6ad3216e
SHA256 5b5dfaa069eaca07dc4a0a4276edbc2c3418d5450addc7c16ca70cead9479131
SHA512 34bc4698b3675c06d30597ce578ce92fcf8aa65281d7563121355666f03f788be6c638b843af251d5a340a89c47ffcf573cdf02b450669cec051c85fb8924aaa

memory/4636-12-0x0000000000C10000-0x0000000000C68000-memory.dmp

memory/4636-13-0x00007FFE89A50000-0x00007FFE8A511000-memory.dmp

memory/4636-14-0x000000001BA20000-0x000000001BA30000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Update.exe

MD5 cc70b6409bf138ea8196b2ac27c7263e
SHA1 6eef6535e01c225240faf18f5718a7ccfff5dc78
SHA256 8021b1c265f5863f79cb7cd1789545d8ed38d5a1b75fe235fd86ea0d545e0ac4
SHA512 763160a911aa21128772ed3685768c8995b7d94ea27d442b127aba6b4b7efdfa2ea1eadfe4f107cd0af769600fa463922332b2f754268bdb44b20ffde9e6d308

memory/3316-37-0x0000000000EF0000-0x0000000000F68000-memory.dmp

memory/4756-39-0x00000144CA310000-0x00000144CA350000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2-step.exe

MD5 02c626b54e983d7723706eb9328f41a5
SHA1 affb6e208919439418f07bcc1991c700b063b33f
SHA256 209ca4d12ae3133eb80bc7e5a8fb67a39ed9bb88fb5f6137badddd54eed0e62a
SHA512 3d30ccfeae87234099398a1b8050221d81a128ed79a9a183f5fb763b1991af56e27e33f3844ad56d277cbd4f0a8655d9842ea0f563a2aaabff597efea016da60

memory/4636-40-0x00007FFE89A50000-0x00007FFE8A511000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\KrampusUI.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Update.exe.log

MD5 386677f585908a33791517dfc2317f88
SHA1 2e6853b4560a9ac8a74cdd5c3124a777bc0d874e
SHA256 7caf8779608c167ab6fa570df00c973aff6dee850bb63439770889a68c7cdae0
SHA512 876d2269e25a4b2754bdf2c7e3c410050f885d7e6bd8abce41c5fc74ae1f8c549b2266dd1588c750f614063f36c8a8e5008cea610505897d04e4ef5c3adc52d9

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2-step.exe.log

MD5 8094b248fe3231e48995c2be32aeb08c
SHA1 2fe06e000ebec919bf982d033c5d1219c1f916b6
SHA256 136c30d964f4abbb5279bdc86d0e00578333782f15f05f0d2d050730dcb7a9bc
SHA512 bf27a3822008796370e2c506c910a40992b9240606ea1bc19f683b2fee86b81897660ac0cf8e746ca093dae9e408949e2e9002ded75678a69f020d3b0452801f