Malware Analysis Report

2024-09-11 08:57

Sample ID 240429-bwvc1sec55
Target 93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
SHA256 93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f
Tags
redline sectoprat xworm cheat discovery infostealer persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f

Threat Level: Known bad

The file 93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe was found to be: Known bad.

Malicious Activity Summary

redline sectoprat xworm cheat discovery infostealer persistence rat spyware stealer trojan

Detect Xworm Payload

RedLine payload

RedLine

SectopRAT

Xworm

SectopRAT payload

Detects Windows executables referencing non-Windows User-Agents

Detects executables using Telegram Chat Bot

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Executes dropped EXE

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Adds Run key to start application

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-04-29 01:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-29 01:30

Reported

2024-04-29 01:32

Platform

win7-20240220-en

Max time kernel

146s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Description Indicator Process Target
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables using Telegram Chat Bot

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe" C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1740 set thread context of 2756 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1712 set thread context of 1524 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 2204 set thread context of 2932 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1740 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1740 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1740 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1740 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1740 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1740 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1740 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1740 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1740 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\schtasks.exe
PID 1740 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\schtasks.exe
PID 1740 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\schtasks.exe
PID 1740 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\schtasks.exe
PID 1740 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1740 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1740 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1740 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1740 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1740 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1740 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1740 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1740 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 2756 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2756 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\schtasks.exe
PID 2756 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\schtasks.exe
PID 2756 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\schtasks.exe
PID 2756 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\schtasks.exe
PID 3060 wrote to memory of 1712 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 3060 wrote to memory of 1712 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 3060 wrote to memory of 1712 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 3060 wrote to memory of 1712 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1712 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1712 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1712 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1712 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1712 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1712 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1712 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1712 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1712 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 1712 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 1712 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 1712 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 1712 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1712 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1712 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1712 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1712 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1712 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 1712 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe

"C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vKSqvdpkG.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vKSqvdpkG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp514B.tmp"

C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe

"C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {3079B5C3-A69A-41FD-A25C-434044BF4DB1} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vKSqvdpkG.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vKSqvdpkG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1600.tmp"

C:\Users\Admin\AppData\Roaming\explorer.exe

"C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vKSqvdpkG.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vKSqvdpkG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFFD2.tmp"

C:\Users\Admin\AppData\Roaming\explorer.exe

"C:\Users\Admin\AppData\Roaming\explorer.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 91.92.252.220:7000 tcp
N/A 127.0.0.1:7000 tcp
EG 41.199.23.195:7000 tcp
NL 91.92.252.220:7000 tcp
US 8.8.8.8:53 saveclinetsforme68465454711991.publicvm.com udp
NL 91.92.254.108:7000 saveclinetsforme68465454711991.publicvm.com tcp
NL 91.92.254.108:1111 saveclinetsforme68465454711991.publicvm.com tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp

Files

memory/1740-0-0x0000000000DB0000-0x0000000000E52000-memory.dmp

memory/1740-1-0x0000000074560000-0x0000000074C4E000-memory.dmp

memory/1740-2-0x00000000009D0000-0x0000000000A10000-memory.dmp

memory/1740-3-0x0000000000410000-0x0000000000430000-memory.dmp

memory/1740-4-0x0000000000440000-0x0000000000454000-memory.dmp

memory/1740-5-0x0000000000D60000-0x0000000000DB4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp514B.tmp

MD5 3adf1ac56cb8d53cdaecd008fe82f350
SHA1 51d510ab16295175a541f48c77fa1784f742ac41
SHA256 8586a150b543732ac2d648cb1578e74d81780b44929818eb839cc9e2a5a4a82a
SHA512 612392ba3fec5aa7d55069297eb74b78f25a8cc65e481a2a370b78c95b3d57950f3168b5b2a7f3bf7c63017e76deb30cf3503a633ae01c53dff926f89873eb77

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\71606N4WY8ULAKMIFROH.temp

MD5 17d8a3c6a3d61e3116c95e4efd707c3c
SHA1 e58358a7557b40b1c646ff2463286b3dedb27601
SHA256 bd2c268840bb5dcba7a69e0777a8bd6e47713908342540a239a5688bdf85e0ff
SHA512 48ca7c2d9563ce41ff25bde7442d7bce28b5859f9928aa6226b57e7c85a7131fd43936526be388881043b702a46f38e30a44a3d41d20b34f2305acd94df83c51

memory/2756-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2756-29-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2756-28-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2756-27-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2756-25-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2756-22-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2756-20-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2756-18-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1740-30-0x0000000074560000-0x0000000074C4E000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\explorer.exe

MD5 8d2faf1c3a857566f516c28da34b9479
SHA1 6151cc6fe9097e07676b8e7dca4057d4be292f44
SHA256 93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f
SHA512 42c3908b63b7b5960c53b11f34e8b42efa361107491236730d30dc258857006d0e7078d3c529fddbe2c44ffad1fc3ee181de01b51dc2e52e5fc38c43d6672420

memory/1712-59-0x0000000000F00000-0x0000000000FA2000-memory.dmp

memory/1712-60-0x00000000002C0000-0x00000000002D4000-memory.dmp

memory/1712-61-0x0000000004560000-0x00000000045B4000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 50789641722cbd1843bc70c3a6582679
SHA1 684007b3612ff62b5478a1cbf335caa322eb1ef5
SHA256 758dacc6fe16cfa6dec53a546c895db5f06c39c104b2a8ec8380586010bb855c
SHA512 90ac8d57d1764a28f0f36e5b5dce91b2ec468fae14608e6f50104eed3470357be6b67c9f84d0022a65b4c588c3e6c2b7522df65653b6a1c0e41ccc6eb4eb50a5

memory/1524-78-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2204-89-0x0000000000060000-0x0000000000102000-memory.dmp

memory/2756-90-0x0000000000C10000-0x0000000000C2E000-memory.dmp

memory/2756-91-0x0000000007A50000-0x0000000007AF2000-memory.dmp

memory/2756-92-0x00000000088A0000-0x0000000008BF0000-memory.dmp

memory/2932-114-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar64F.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\Local\Temp\tmpBD5.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmpBDB.tmp

MD5 18e04095708297d6889a6962f81e8d8f
SHA1 9a25645db1da0217092c06579599b04982192124
SHA256 4ed16c019fe50bb4ab1c9dcedf0e52f93454b5dbaf18615d60761e7927b69fb7
SHA512 45ec57bddeeb8bca05babcf8da83bf9db630819b23076a1cf79f2e54b3e88e14cd7db650332554026ab5e8634061dd699f322bcba6683765063e67ac47ea1caf

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-29 01:30

Reported

2024-04-29 01:32

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables using Telegram Chat Bot

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\explorer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\explorer.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe" C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1476 set thread context of 2928 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 4580 set thread context of 928 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 2316 set thread context of 3700 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1476 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1476 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1476 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1476 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1476 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1476 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1476 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\schtasks.exe
PID 1476 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\schtasks.exe
PID 1476 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\schtasks.exe
PID 1476 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1476 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1476 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1476 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1476 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1476 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1476 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 1476 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe
PID 2928 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\schtasks.exe
PID 2928 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\schtasks.exe
PID 2928 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe C:\Windows\SysWOW64\schtasks.exe
PID 4580 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 4580 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 4580 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 4580 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 4580 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 4580 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 4580 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 4580 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 4580 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 4580 wrote to memory of 928 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 4580 wrote to memory of 928 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 4580 wrote to memory of 928 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 4580 wrote to memory of 928 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 4580 wrote to memory of 928 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 4580 wrote to memory of 928 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 4580 wrote to memory of 928 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 4580 wrote to memory of 928 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Users\Admin\AppData\Roaming\explorer.exe
PID 2316 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2316 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2316 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2316 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2316 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2316 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2316 wrote to memory of 720 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 2316 wrote to memory of 720 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 2316 wrote to memory of 720 N/A C:\Users\Admin\AppData\Roaming\explorer.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe

"C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vKSqvdpkG.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vKSqvdpkG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp66D8.tmp"

C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe

"C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vKSqvdpkG.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vKSqvdpkG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2F97.tmp"

C:\Users\Admin\AppData\Roaming\explorer.exe

"C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Users\Admin\AppData\Roaming\explorer.exe

"C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Users\Admin\AppData\Roaming\explorer.exe

"C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vKSqvdpkG.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vKSqvdpkG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp15E0.tmp"

C:\Users\Admin\AppData\Roaming\explorer.exe

"C:\Users\Admin\AppData\Roaming\explorer.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 134.190.18.2.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 133.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
EG 41.199.23.195:7000 tcp
N/A 127.0.0.1:7000 tcp
EG 41.199.23.195:7000 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
NL 91.92.252.220:7000 tcp
N/A 127.0.0.1:7000 tcp
N/A 127.0.0.1:7000 tcp
N/A 127.0.0.1:7000 tcp
US 8.8.8.8:53 udp

Files

memory/1476-0-0x0000000000110000-0x00000000001B2000-memory.dmp

memory/1476-1-0x0000000074920000-0x00000000750D0000-memory.dmp

memory/1476-2-0x0000000006E90000-0x0000000006EA0000-memory.dmp

memory/1476-3-0x0000000007650000-0x0000000007BF4000-memory.dmp

memory/1476-4-0x00000000072C0000-0x0000000007352000-memory.dmp

memory/1476-5-0x0000000004460000-0x000000000446A000-memory.dmp

memory/1476-6-0x00000000087A0000-0x000000000883C000-memory.dmp

memory/1476-7-0x0000000007620000-0x0000000007640000-memory.dmp

memory/1476-8-0x0000000007D00000-0x0000000007D14000-memory.dmp

memory/1476-9-0x0000000004CC0000-0x0000000004D14000-memory.dmp

memory/1972-14-0x0000000002F50000-0x0000000002F86000-memory.dmp

memory/1972-17-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

memory/1972-16-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

memory/1972-15-0x0000000074920000-0x00000000750D0000-memory.dmp

memory/1972-18-0x0000000005B10000-0x0000000006138000-memory.dmp

memory/1948-19-0x0000000074920000-0x00000000750D0000-memory.dmp

memory/1972-20-0x00000000058A0000-0x00000000058C2000-memory.dmp

memory/1972-22-0x0000000006140000-0x00000000061A6000-memory.dmp

memory/1972-21-0x0000000005940000-0x00000000059A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vvigcueq.pbg.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\tmp66D8.tmp

MD5 95d91c33ce1df2ffa4f53c0566803660
SHA1 bc28c263adc46b0f54c9ee09852495f2be4bb4c5
SHA256 4537a214661e94dc6ea9af0d36b2c83014bfcc70795b6a481fa5995a0ec69db6
SHA512 702d18fef69c70705f48e75a407108f16ac5dfa2793f6891545c5ad3e5e26dff4dacbc4a024fddde6032d2b844373cdee29f7d2e4596d80ac380b9f42d231e70

memory/1948-37-0x0000000005850000-0x0000000005BA4000-memory.dmp

memory/2928-43-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1476-45-0x0000000074920000-0x00000000750D0000-memory.dmp

memory/1948-46-0x0000000005DF0000-0x0000000005E0E000-memory.dmp

memory/1948-47-0x0000000005E80000-0x0000000005ECC000-memory.dmp

memory/1972-60-0x00000000751D0000-0x000000007521C000-memory.dmp

memory/1948-59-0x00000000063A0000-0x00000000063BE000-memory.dmp

memory/1948-49-0x00000000751D0000-0x000000007521C000-memory.dmp

memory/1948-48-0x00000000063C0000-0x00000000063F2000-memory.dmp

memory/1948-70-0x0000000006FF0000-0x0000000007093000-memory.dmp

memory/1948-71-0x0000000007750000-0x0000000007DCA000-memory.dmp

memory/1972-72-0x0000000007B90000-0x0000000007BAA000-memory.dmp

memory/1948-73-0x0000000007180000-0x000000000718A000-memory.dmp

memory/1972-74-0x0000000007E10000-0x0000000007EA6000-memory.dmp

memory/1972-75-0x0000000007D90000-0x0000000007DA1000-memory.dmp

memory/1948-76-0x0000000007340000-0x000000000734E000-memory.dmp

memory/1948-77-0x0000000007350000-0x0000000007364000-memory.dmp

memory/1948-78-0x0000000007450000-0x000000000746A000-memory.dmp

memory/1972-79-0x0000000007EB0000-0x0000000007EB8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/1948-86-0x0000000074920000-0x00000000750D0000-memory.dmp

memory/1972-85-0x0000000074920000-0x00000000750D0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 280ef540a83d5df489665265d85bfa0b
SHA1 6188602d8c7eeb9f78e91ecce7c616abc4061583
SHA256 3d553a7c5b73eda27b50ace6991e09c8f40ff2eeb6ca4f03463452d28c158c5d
SHA512 450122ef213775614054538a7f18b39409738dfb0beff6ef46826ebb0a9940a1eb7dd54d8fcbee1f4519fc3bdcab83b4b7ec599e158412d68ce19361aeb232de

memory/452-94-0x0000000005430000-0x0000000005784000-memory.dmp

memory/452-98-0x0000000005AF0000-0x0000000005B3C000-memory.dmp

memory/452-99-0x000000006F9A0000-0x000000006F9EC000-memory.dmp

memory/452-109-0x0000000006C60000-0x0000000006D03000-memory.dmp

memory/452-110-0x0000000006FE0000-0x0000000006FF1000-memory.dmp

memory/452-111-0x0000000007010000-0x0000000007024000-memory.dmp

memory/1696-122-0x0000000006370000-0x00000000066C4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7391ffffc74d76935c1a612f8bcd56a8
SHA1 d302c30ec49f6f429dc3ec8b8111c41b63c07f0c
SHA256 28fc1d8b9dd6bfc2e30bdea05f3373c8f97c5b3cdb41e5443ebccdb96381b302
SHA512 bb9a45ca5673d1d900981c775cf1292b74f7aa566d367e0a9da9852ef164101308a656732f7e95684ebe851390cf563b73ea627bc993a62fc427f0a5487c0250

memory/1696-124-0x000000006F9A0000-0x000000006F9EC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6a2902d09cc9b0d7a010f0a1ec6638f4
SHA1 de3adb3a642fad0ead7234be2759154f84e40ca1
SHA256 e3eb837210d064220e5d5c4596131b7b6c83baed70ea71cb3434225bcef6f071
SHA512 2a524a0d1fe1e795d8b82e31668851834278fa94c0c5db476f723f75978fab17c4a7ba0f375c45214d60693bb4c9b796958e15dac4dc10b85440761efc867edf

memory/4528-145-0x000000006F9A0000-0x000000006F9EC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 49aa99b629f047f0b4e83b2093cf3afb
SHA1 d367a4622d859f921379ab604089e840acff4580
SHA256 c65ad69198c649ea883f472ba04894e99da5ad3b96e3ab024df7275346555bcb
SHA512 4c279efdd85d8f85f3bb975975318e9258a35380e93836587c0c9a1c6e85da104fab62387d10d09020978d1350fad76a106f1a69e39f9c41938ec572ed9d31fb

memory/4392-166-0x000000006F9A0000-0x000000006F9EC000-memory.dmp

C:\Users\Admin\AppData\Roaming\explorer.exe

MD5 8d2faf1c3a857566f516c28da34b9479
SHA1 6151cc6fe9097e07676b8e7dca4057d4be292f44
SHA256 93f357d221fc7f72bec7195e11c8a00b9e128448850a88ca66c8cc95fa47272f
SHA512 42c3908b63b7b5960c53b11f34e8b42efa361107491236730d30dc258857006d0e7078d3c529fddbe2c44ffad1fc3ee181de01b51dc2e52e5fc38c43d6672420

memory/4580-183-0x0000000008230000-0x0000000008244000-memory.dmp

memory/4144-194-0x0000000005BB0000-0x0000000005F04000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 525bc51efea49d463b4fe78437e6f27b
SHA1 bbfb8adf0e1cb4ea13646c20b65448c104c03c5b
SHA256 333aa4e9e9e8ebb1c5732600077cb96384b5436b61daf0ea8706eda6022ca25a
SHA512 9e4bca08a996318dda9c60d773d9d782c8f14667ada3205aa4278e8a94a93e71063fbb08889e20cdcd6fb4049c809f02a890fe60cce98fd6ab6b6fb04546b383

memory/4144-211-0x00000000060D0000-0x000000000611C000-memory.dmp

memory/4144-212-0x000000006F880000-0x000000006F8CC000-memory.dmp

memory/4144-222-0x0000000007280000-0x0000000007323000-memory.dmp

memory/4916-223-0x000000006F880000-0x000000006F8CC000-memory.dmp

memory/4144-233-0x0000000007590000-0x00000000075A1000-memory.dmp

memory/4916-234-0x0000000007830000-0x0000000007844000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e0c5b57dd507b85c0ef47b9477737a44
SHA1 cc20711c0604c92658f34db5d5080639171766c1
SHA256 a92e84103b12afa4b5b45f0446014cfc1122d3cc9779083b08a574619386e45e
SHA512 9db2004755bc828998a20b570f4f7e93c4ea9ab59a1b6e49cf453c1d5ce8befa3caac0a08e5713b1aefff6477fab346fe584f21d490ab3eddaa24248149da6f7

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\explorer.exe.log

MD5 400f1cc1a0a0ce1cdabda365ab3368ce
SHA1 1ecf683f14271d84f3b6063493dce00ff5f42075
SHA256 c8fa64f4b69df13ed6408fd4a204f318a36c2f38c85d4a4d42adfc9173f73765
SHA512 14c8cfd58d097e5e89c8cabe1e665173f1ccf604a9ef70cdcb84116e265f90819c19c891be408e0ad7e29086a5c2ea2883b7a7d1184878dbbac63e2cabcd1c45

memory/1196-242-0x00000000060A0000-0x00000000063F4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cb28446735e7fd3112ec9928b99de60a
SHA1 5842695fc274915796884c259f7651453b1c39e0
SHA256 238c353b0a21ef4f541c187d13ae482b85ff041be2f9a0137c36dc450ef74593
SHA512 1a2e51b651b60029f8444c737e0ec27efe5ccf84349f3ddb0c07d26e42eb56f42d07f23ce47563d39b77bc486f459ffccc5bfc7ff0c16c182d8f345b315e83d5

memory/1196-265-0x000000006F880000-0x000000006F8CC000-memory.dmp

memory/4844-275-0x000000006F880000-0x000000006F8CC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 f4ed4a3d9bbf71ba7e0dc0b784de86da
SHA1 c732791b1c9fbb6f52cdb10c287f761d02316969
SHA256 e32a136769e90f926fba5c45e1b3d6db87094f6214fb93a51bd9f22f0c31fded
SHA512 f07a15b407e44a724d56c869dc062156e891c73f9189747814385444295f8bfd1b7db0cd7176677cea5472c45f328cf302aa49774c9a17e81d3fd6001e4b4b45