Malware Analysis Report

2024-10-23 19:44

Sample ID 240429-cc4ysaeh94
Target c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36
SHA256 c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36
Tags
nanocore evasion keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36

Threat Level: Known bad

The file c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger spyware stealer trojan

NanoCore

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Checks whether UAC is enabled

AutoIT Executable

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-29 01:56

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-29 01:56

Reported

2024-04-29 01:59

Platform

win10v2004-20240419-en

Max time kernel

148s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\Users\Admin\WinSAT\igfxEM.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\Users\Admin\WinSAT\igfxEM.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\WinSAT\igfxEM.exe N/A
N/A N/A C:\Users\Admin\WinSAT\igfxEM.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1096 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1096 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1096 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1096 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1096 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4044 wrote to memory of 4896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 4044 wrote to memory of 4896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 4044 wrote to memory of 4896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 1096 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\SysWOW64\schtasks.exe
PID 1096 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\SysWOW64\schtasks.exe
PID 1096 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\SysWOW64\schtasks.exe
PID 2732 wrote to memory of 2196 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2732 wrote to memory of 2196 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2732 wrote to memory of 2196 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2732 wrote to memory of 2196 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2732 wrote to memory of 2196 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2732 wrote to memory of 3460 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\SysWOW64\schtasks.exe
PID 2732 wrote to memory of 3460 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\SysWOW64\schtasks.exe
PID 2732 wrote to memory of 3460 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\SysWOW64\schtasks.exe
PID 2628 wrote to memory of 4476 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2628 wrote to memory of 4476 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2628 wrote to memory of 4476 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2628 wrote to memory of 4476 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2628 wrote to memory of 4476 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2628 wrote to memory of 3076 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\SysWOW64\schtasks.exe
PID 2628 wrote to memory of 3076 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\SysWOW64\schtasks.exe
PID 2628 wrote to memory of 3076 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe

"C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DSL Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4277.tmp"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn azroles /tr "C:\Users\Admin\WinSAT\igfxEM.exe" /sc minute /mo 1 /F

C:\Users\Admin\WinSAT\igfxEM.exe

C:\Users\Admin\WinSAT\igfxEM.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn azroles /tr "C:\Users\Admin\WinSAT\igfxEM.exe" /sc minute /mo 1 /F

C:\Users\Admin\WinSAT\igfxEM.exe

C:\Users\Admin\WinSAT\igfxEM.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn azroles /tr "C:\Users\Admin\WinSAT\igfxEM.exe" /sc minute /mo 1 /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 bnow.duckdns.org udp
US 8.8.4.4:53 bnow.duckdns.org udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 bnow.duckdns.org udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 bnow.duckdns.org udp
US 8.8.4.4:53 bnow.duckdns.org udp
US 8.8.8.8:53 bnow.duckdns.org udp
US 8.8.8.8:53 bnow.duckdns.org udp
US 8.8.4.4:53 bnow.duckdns.org udp
US 8.8.8.8:53 bnow.duckdns.org udp
US 8.8.8.8:53 bnow.duckdns.org udp
US 8.8.4.4:53 bnow.duckdns.org udp
US 8.8.8.8:53 bnow.duckdns.org udp
US 8.8.8.8:53 bnow.duckdns.org udp

Files

memory/1096-0-0x0000000003D00000-0x0000000003D01000-memory.dmp

memory/4044-2-0x00000000001B0000-0x00000000001E8000-memory.dmp

memory/4044-6-0x0000000073D40000-0x00000000742F1000-memory.dmp

memory/4044-8-0x00000000020E0000-0x00000000020F0000-memory.dmp

memory/4044-7-0x0000000073D40000-0x00000000742F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp4277.tmp

MD5 c6f0625bf4c1cdfb699980c9243d3b22
SHA1 43de1fe580576935516327f17b5da0c656c72851
SHA256 8dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA512 9ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969

memory/4044-16-0x0000000073D40000-0x00000000742F1000-memory.dmp

memory/4044-17-0x0000000073D40000-0x00000000742F1000-memory.dmp

memory/4044-18-0x00000000020E0000-0x00000000020F0000-memory.dmp

C:\Users\Admin\WinSAT\igfxEM.exe

MD5 2a09f22796068af9f846064ad8a324d1
SHA1 a768619316f896a719d144ad6ab7069baf8bdc59
SHA256 3a33402f4eabcb2475e86ee1041af49e9d1fd69f95ea2229d8af3726b316ddea
SHA512 e104ccdec7ad6f709cfb1908b1b18bca60784bffada78efb242f18a848fa4abb071d5e9c0061a46cc65e0e9f81c971314f18236f5db234ff13f16c3d2c9fe656

memory/2196-21-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\azroles.lnk

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/4476-30-0x0000000000590000-0x00000000005C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegAsm.exe.log

MD5 5b4789d01bb4d7483b71e1a35bce6a8b
SHA1 de083f2131c9a763c0d1810c97a38732146cffbf
SHA256 e248cef9500ed6e0c9f99d72a2a6a36955a5f0cfc0725748ef25a733cc8282f6
SHA512 357e18ef30430e4b9cc4f2569b9735b1cd12f934c83162e4de78ac29ba9703b63ddb624ccc22afd5a5868f6e9d91a3c64581846abac22e9625f5b2e3d80b3ede

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-29 01:56

Reported

2024-04-29 01:59

Platform

win7-20240220-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\WinSAT\igfxEM.exe N/A
N/A N/A C:\Users\Admin\WinSAT\igfxEM.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\WinSAT\igfxEM.exe N/A
N/A N/A C:\Users\Admin\WinSAT\igfxEM.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2356 wrote to memory of 2592 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2356 wrote to memory of 2592 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2356 wrote to memory of 2592 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2356 wrote to memory of 2592 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 1724 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\SysWOW64\schtasks.exe
PID 1724 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\SysWOW64\schtasks.exe
PID 1724 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\SysWOW64\schtasks.exe
PID 1724 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe C:\Windows\SysWOW64\schtasks.exe
PID 2736 wrote to memory of 2008 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\WinSAT\igfxEM.exe
PID 2736 wrote to memory of 2008 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\WinSAT\igfxEM.exe
PID 2736 wrote to memory of 2008 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\WinSAT\igfxEM.exe
PID 2736 wrote to memory of 2008 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\WinSAT\igfxEM.exe
PID 2008 wrote to memory of 2004 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2008 wrote to memory of 2004 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2008 wrote to memory of 2004 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2008 wrote to memory of 2004 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2008 wrote to memory of 2004 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2008 wrote to memory of 2004 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2008 wrote to memory of 2004 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2008 wrote to memory of 2004 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2008 wrote to memory of 2004 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2008 wrote to memory of 1848 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\SysWOW64\schtasks.exe
PID 2008 wrote to memory of 1848 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\SysWOW64\schtasks.exe
PID 2008 wrote to memory of 1848 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\SysWOW64\schtasks.exe
PID 2008 wrote to memory of 1848 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\SysWOW64\schtasks.exe
PID 2736 wrote to memory of 1268 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\WinSAT\igfxEM.exe
PID 2736 wrote to memory of 1268 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\WinSAT\igfxEM.exe
PID 2736 wrote to memory of 1268 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\WinSAT\igfxEM.exe
PID 2736 wrote to memory of 1268 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\WinSAT\igfxEM.exe
PID 1268 wrote to memory of 324 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1268 wrote to memory of 324 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1268 wrote to memory of 324 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1268 wrote to memory of 324 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1268 wrote to memory of 324 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1268 wrote to memory of 324 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1268 wrote to memory of 324 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1268 wrote to memory of 324 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1268 wrote to memory of 324 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1268 wrote to memory of 112 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\SysWOW64\schtasks.exe
PID 1268 wrote to memory of 112 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\SysWOW64\schtasks.exe
PID 1268 wrote to memory of 112 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\SysWOW64\schtasks.exe
PID 1268 wrote to memory of 112 N/A C:\Users\Admin\WinSAT\igfxEM.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe

"C:\Users\Admin\AppData\Local\Temp\c3a4207fc483b8954711b149904c1c92e9b19648f7b00462a4e01a041d172f36.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "TCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1065.tmp"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn azroles /tr "C:\Users\Admin\WinSAT\igfxEM.exe" /sc minute /mo 1 /F

C:\Windows\system32\taskeng.exe

taskeng.exe {FD5543E9-8149-401B-B93A-B42AF358045A} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]

C:\Users\Admin\WinSAT\igfxEM.exe

C:\Users\Admin\WinSAT\igfxEM.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn azroles /tr "C:\Users\Admin\WinSAT\igfxEM.exe" /sc minute /mo 1 /F

C:\Users\Admin\WinSAT\igfxEM.exe

C:\Users\Admin\WinSAT\igfxEM.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn azroles /tr "C:\Users\Admin\WinSAT\igfxEM.exe" /sc minute /mo 1 /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp
US 8.8.8.8:53 bnow.duckdns.org udp
US 192.169.69.26:4156 bnow.duckdns.org tcp

Files

memory/1724-0-0x00000000001A0000-0x00000000001A1000-memory.dmp

memory/2356-1-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2356-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2356-9-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2356-8-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2356-2-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2356-10-0x00000000748E0000-0x0000000074E8B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1065.tmp

MD5 c6f0625bf4c1cdfb699980c9243d3b22
SHA1 43de1fe580576935516327f17b5da0c656c72851
SHA256 8dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA512 9ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969

memory/2356-15-0x00000000009A0000-0x00000000009E0000-memory.dmp

memory/2356-19-0x00000000748E0000-0x0000000074E8B000-memory.dmp

memory/2356-20-0x00000000009A0000-0x00000000009E0000-memory.dmp

C:\Users\Admin\WinSAT\igfxEM.exe

MD5 2a09f22796068af9f846064ad8a324d1
SHA1 a768619316f896a719d144ad6ab7069baf8bdc59
SHA256 3a33402f4eabcb2475e86ee1041af49e9d1fd69f95ea2229d8af3726b316ddea
SHA512 e104ccdec7ad6f709cfb1908b1b18bca60784bffada78efb242f18a848fa4abb071d5e9c0061a46cc65e0e9f81c971314f18236f5db234ff13f16c3d2c9fe656

C:\Users\Admin\azroles.lnk

MD5 9bbfaae8d2d3cfee3543797706b51998
SHA1 14fff96bb34825cdcaf6e18d3a01479002eb5837
SHA256 0df33e3f1c2305fc9d0fa00fc00102c4ceef9d733a15786010321897aadf9441
SHA512 a443fef84c86e75d3b5e5f31e915373966d4b1265debfdfcf7627199dcb8d9049cfce36f4af808f68dea6e1a324dbcb8cccdb1b8a2250c1e3d2571f47ad37ac9

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e