Malware Analysis Report

2024-10-23 19:44

Sample ID 240429-e2hsysab77
Target gK5vkTm6WAcfbiz.exe
SHA256 0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6

Threat Level: Known bad

The file gK5vkTm6WAcfbiz.exe was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Checks computer location settings

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-29 04:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-29 04:26

Reported

2024-04-29 04:28

Platform

win7-20231129-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsv.exe" C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3040 set thread context of 2448 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\TCP Service\tcpsv.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A
File created C:\Program Files (x86)\TCP Service\tcpsv.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3040 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 3040 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 3040 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 3040 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 3040 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 3040 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 3040 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 3040 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 3040 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 3040 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 3040 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 3040 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 3040 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 2448 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 2448 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 2448 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 2448 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 2448 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 2448 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 2448 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 2448 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe

"C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZYoQJBONC.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZYoQJBONC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6AF3.tmp"

C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe

"C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6CC7.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "TCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6D45.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 december2nd.ddns.net udp
NL 91.92.245.231:64418 december2nd.ddns.net tcp
NL 91.92.245.231:64418 december2nd.ddns.net tcp
NL 91.92.245.231:64418 december2nd.ddns.net tcp
US 8.8.8.8:53 december2n.duckdns.org udp
US 8.8.8.8:53 december2n.duckdns.org udp
US 192.169.69.26:64418 december2n.duckdns.org tcp
US 192.169.69.26:64418 december2n.duckdns.org tcp
US 8.8.8.8:53 december2nd.ddns.net udp
NL 91.92.245.231:64418 december2nd.ddns.net tcp
NL 91.92.245.231:64418 december2nd.ddns.net tcp
NL 91.92.245.231:64418 december2nd.ddns.net tcp
US 8.8.8.8:53 december2n.duckdns.org udp
US 192.169.69.26:64418 december2n.duckdns.org tcp
US 192.169.69.26:64418 december2n.duckdns.org tcp

Files

memory/3040-0-0x0000000000830000-0x00000000008D4000-memory.dmp

memory/3040-1-0x0000000074BF0000-0x00000000752DE000-memory.dmp

memory/3040-2-0x0000000004A90000-0x0000000004AD0000-memory.dmp

memory/3040-3-0x0000000000330000-0x0000000000348000-memory.dmp

memory/3040-4-0x0000000000350000-0x000000000035E000-memory.dmp

memory/3040-5-0x0000000000360000-0x0000000000376000-memory.dmp

memory/3040-6-0x0000000004760000-0x00000000047DC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp6AF3.tmp

MD5 be13c83910daa3f8140ccaa37955ae09
SHA1 251722dee6e656c3619637c84534a478b26f63f9
SHA256 f470d74b713027aeed776d9f9b283908b997870bbe05a01b70a20a1adb436119
SHA512 ce5f42cc9c066efae25015ec6f5e3c749d1496d84dadfabb471ffd914879ffa42329585844ae84ab368adfd221287fd2076f4afaa0b3802b78236f8e01095312

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0BA9EGCNGG6II492GMWI.temp

MD5 d1d97985337c3a84ce28c7e4de794c0d
SHA1 59963536963da19f29a2ce9768ff0f6e31ca1f14
SHA256 2c5ed845d76bb9feaa50dc63d884ce090f5665b9b87bfa4566b3034df5d35784
SHA512 326bb1e077b910ddc4a854456f154fd5d7dd18b3fa7eb96d6ce50252b59082fac5df1c73700cc3949835b044ff8bb1ad5230ec6450fad46448dbbc064c471695

memory/2448-28-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2448-30-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2448-29-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2448-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2448-25-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2448-23-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2448-21-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2448-19-0x0000000000400000-0x000000000043A000-memory.dmp

memory/3040-31-0x0000000074BF0000-0x00000000752DE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp6CC7.tmp

MD5 d4561c71381b52aaedee04fb1dd48775
SHA1 c8c2ff059414c1e9fd75a6f4e69067de017f5358
SHA256 7a0ff9bd88d411effa13a431e003693a1a3e5b5f02d0b68a6f42db98cc214b09
SHA512 c1bd2bab168965624bcb758f360f87492a4dfadb11a95b6becc98b670f43aa49adc6cb1c93e4bbf44333993d59c697fd8450dc3ce7377a4ebdad3650684b962f

C:\Users\Admin\AppData\Local\Temp\tmp6D45.tmp

MD5 93fc3117767507c9889abd12dc667d22
SHA1 1096e4cfa0c35756e3c3fb866c1e4c1e59115df9
SHA256 684997dd4ce15031cec8f2f93933b1d41d7bf5cbbff655dd64377b07055c449a
SHA512 e403348ee77bd3e7c45245dd5dae81c3ea130d5cf342f630982772ce5f75548b292013480e2831d68cf51349b64afde4589d4eec94b567d20f0a01e3b9549bdc

memory/2448-39-0x0000000000600000-0x000000000060A000-memory.dmp

memory/2448-40-0x0000000000610000-0x000000000061C000-memory.dmp

memory/2448-41-0x0000000000620000-0x000000000063E000-memory.dmp

memory/2448-42-0x0000000000690000-0x000000000069A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-29 04:26

Reported

2024-04-29 04:28

Platform

win10v2004-20240419-en

Max time kernel

140s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Service = "C:\\Program Files (x86)\\WPA Service\\wpasvc.exe" C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3708 set thread context of 4516 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\WPA Service\wpasvc.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A
File opened for modification C:\Program Files (x86)\WPA Service\wpasvc.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3708 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 3708 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 3708 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 3708 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 3708 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 3708 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 3708 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 3708 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 3708 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 3708 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 3708 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe
PID 4516 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 4516 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 4516 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 4516 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 4516 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe
PID 4516 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe

"C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZYoQJBONC.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZYoQJBONC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp97EA.tmp"

C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe

"C:\Users\Admin\AppData\Local\Temp\gK5vkTm6WAcfbiz.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "WPA Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9C9E.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "WPA Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9E93.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 december2nd.ddns.net udp
US 8.8.8.8:53 december2n.duckdns.org udp
US 8.8.8.8:53 december2nd.ddns.net udp
US 8.8.8.8:53 december2n.duckdns.org udp
US 8.8.8.8:53 december2n.duckdns.org udp
US 8.8.8.8:53 december2nd.ddns.net udp
US 8.8.8.8:53 december2nd.ddns.net udp
US 8.8.8.8:53 december2n.duckdns.org udp
US 8.8.8.8:53 december2n.duckdns.org udp
US 8.8.8.8:53 december2nd.ddns.net udp

Files

memory/3708-0-0x0000000000A40000-0x0000000000AE4000-memory.dmp

memory/3708-1-0x0000000074910000-0x00000000750C0000-memory.dmp

memory/3708-2-0x0000000005A00000-0x0000000005FA4000-memory.dmp

memory/3708-3-0x00000000054F0000-0x0000000005582000-memory.dmp

memory/3708-4-0x00000000056A0000-0x00000000056B0000-memory.dmp

memory/3708-5-0x00000000054E0000-0x00000000054EA000-memory.dmp

memory/3708-6-0x00000000059C0000-0x00000000059D8000-memory.dmp

memory/3708-7-0x00000000066B0000-0x00000000066BE000-memory.dmp

memory/3708-8-0x00000000066C0000-0x00000000066D6000-memory.dmp

memory/3708-9-0x0000000006740000-0x00000000067BC000-memory.dmp

memory/3708-10-0x0000000008ED0000-0x0000000008F6C000-memory.dmp

memory/3708-14-0x0000000074910000-0x00000000750C0000-memory.dmp

memory/2976-19-0x0000000004500000-0x0000000004510000-memory.dmp

memory/2976-18-0x0000000074910000-0x00000000750C0000-memory.dmp

memory/2976-17-0x0000000004510000-0x0000000004546000-memory.dmp

memory/2976-20-0x0000000004B80000-0x00000000051A8000-memory.dmp

memory/3708-16-0x00000000056A0000-0x00000000056B0000-memory.dmp

memory/3016-21-0x0000000074910000-0x00000000750C0000-memory.dmp

memory/3016-22-0x0000000002510000-0x0000000002520000-memory.dmp

memory/2976-24-0x0000000005320000-0x0000000005386000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp97EA.tmp

MD5 9ec38e48b712924ff7cd816fdb815153
SHA1 7312e5fc4c74c72d5fc30c2f8e38c756bff8cc44
SHA256 dbff0822c990b1865514c7c99ffd57ed387e8d5c9ad3871b92ebe8f8dbcd24d3
SHA512 ad93e5b8a480080b0c2327226e5344362beca7326eada3b88e3178a53d604be5e665064bed41149532e65dd277ae41fdd39ccf1057a52eb6ffe64a6e80e297f1

memory/2976-25-0x0000000005390000-0x00000000053F6000-memory.dmp

memory/2976-23-0x0000000004AF0000-0x0000000004B12000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cfcxwefq.by3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2976-41-0x0000000005480000-0x00000000057D4000-memory.dmp

memory/4516-46-0x0000000000400000-0x000000000043A000-memory.dmp

memory/3708-48-0x0000000074910000-0x00000000750C0000-memory.dmp

memory/3016-49-0x0000000005BA0000-0x0000000005BBE000-memory.dmp

memory/3016-50-0x0000000005C50000-0x0000000005C9C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp9C9E.tmp

MD5 d4561c71381b52aaedee04fb1dd48775
SHA1 c8c2ff059414c1e9fd75a6f4e69067de017f5358
SHA256 7a0ff9bd88d411effa13a431e003693a1a3e5b5f02d0b68a6f42db98cc214b09
SHA512 c1bd2bab168965624bcb758f360f87492a4dfadb11a95b6becc98b670f43aa49adc6cb1c93e4bbf44333993d59c697fd8450dc3ce7377a4ebdad3650684b962f

C:\Users\Admin\AppData\Local\Temp\tmp9E93.tmp

MD5 1c18d34e4c00b9a6b81126a2f10bbb74
SHA1 9c975e7627bdb8d7af3615684d59fa02c3b81902
SHA256 ee68aecf2917fd9ddd167e6403d3149ac3dd7f346f3c9c66b6d75620b0ccd621
SHA512 75a3ecebd55c8e433199122925c7c612fe3ea23a93fbca10ed83c80f11396da428581e36c42e98a0eef5210630cea040ed0da076bfcb620ddb38dee7152b816d

memory/4516-58-0x00000000050B0000-0x00000000050BA000-memory.dmp

memory/4516-60-0x0000000005440000-0x000000000545E000-memory.dmp

memory/4516-59-0x00000000050C0000-0x00000000050CC000-memory.dmp

memory/4516-61-0x0000000006160000-0x000000000616A000-memory.dmp

memory/3016-62-0x0000000006B50000-0x0000000006B82000-memory.dmp

memory/3016-64-0x00000000751C0000-0x000000007520C000-memory.dmp

memory/2976-74-0x0000000005FE0000-0x0000000005FFE000-memory.dmp

memory/2976-63-0x00000000751C0000-0x000000007520C000-memory.dmp

memory/2976-84-0x0000000006AF0000-0x0000000006B93000-memory.dmp

memory/3016-85-0x0000000007530000-0x0000000007BAA000-memory.dmp

memory/2976-86-0x0000000006E00000-0x0000000006E1A000-memory.dmp

memory/2976-87-0x0000000006E70000-0x0000000006E7A000-memory.dmp

memory/3016-88-0x0000000007170000-0x0000000007206000-memory.dmp

memory/3016-89-0x00000000070F0000-0x0000000007101000-memory.dmp

memory/2976-90-0x0000000007030000-0x000000000703E000-memory.dmp

memory/2976-91-0x0000000007040000-0x0000000007054000-memory.dmp

memory/3016-92-0x0000000007230000-0x000000000724A000-memory.dmp

memory/2976-93-0x0000000007120000-0x0000000007128000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d9056b96ab2f59a53cb585f5526f40e8
SHA1 2b199b3e6b66c4ad57feeb4697228c68bec00bd9
SHA256 2bf64781c458232e50e15cb7abc08ae9ebf428eb69f9f6ffb981086fe1b76473
SHA512 5a084cc62171b3a214549b642f67afca916e8176b2b4756e341cbf30a552a973729f3143100fc4a950a2ede8cf721694be8dbb50224c9cced0bf7da2a2c45f97

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/3016-100-0x0000000074910000-0x00000000750C0000-memory.dmp

memory/2976-99-0x0000000074910000-0x00000000750C0000-memory.dmp