Malware Analysis Report

2024-10-19 07:12

Sample ID 240430-bcw3hafh8y
Target 0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
SHA256 0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6

Threat Level: Known bad

The file 0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Checks computer location settings

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-30 01:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-30 01:00

Reported

2024-04-30 01:03

Platform

win7-20240220-en

Max time kernel

117s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Subsystem = "C:\\Program Files (x86)\\TCP Subsystem\\tcpss.exe" C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\TCP Subsystem\tcpss.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
File opened for modification C:\Program Files (x86)\TCP Subsystem\tcpss.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2836 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2836 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2836 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2836 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2836 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2836 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2836 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2836 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2836 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 2836 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 2836 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 2836 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 2836 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 2836 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 2836 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 2836 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 2836 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 2836 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 2836 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 2836 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 2836 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 2580 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 2580 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 2580 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 2580 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 2580 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 2580 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 2580 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 2580 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe

"C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZYoQJBONC.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZYoQJBONC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp79F1.tmp"

C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe

"C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "TCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7B48.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "TCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7BA6.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 december2nd.ddns.net udp
NL 91.92.245.231:64418 december2nd.ddns.net tcp

Files

memory/2836-0-0x00000000011E0000-0x0000000001284000-memory.dmp

memory/2836-1-0x0000000074900000-0x0000000074FEE000-memory.dmp

memory/2836-2-0x0000000000A50000-0x0000000000A90000-memory.dmp

memory/2836-3-0x00000000004D0000-0x00000000004E8000-memory.dmp

memory/2836-4-0x0000000000500000-0x000000000050E000-memory.dmp

memory/2836-5-0x0000000000510000-0x0000000000526000-memory.dmp

memory/2836-6-0x0000000004EB0000-0x0000000004F2C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp79F1.tmp

MD5 613b011c75067da703b2ddbf3c4dc892
SHA1 94c3812e94160ef58f3a88d599ce35627a88ec28
SHA256 7566fe03dcf80ad2530c1522be01829eba0a2c66d59907578979f4114b6041ca
SHA512 f648a7300a43b5e3b9f7c97c70da7b14c708086bfedfbb7ca60609123315d8e056e0f730d942e7158fc92c06916d573bc8c4e2b3acc0b72b8081d640bd880c42

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BZ5GC7HE6WJY3MO3NSDH.temp

MD5 fdd055f1f64e497bf7348bfd7c3b76e9
SHA1 3e8f62e3531524d10db8000427dc79833c56c7c5
SHA256 0b808ac05a36fe294881eb49cef5deab500ba77bcffe19fba5f321f1a61a8b3f
SHA512 e67a33bde4f610408a294a3cfb04b3c408944160d1c829572e87acc2549f1582625ba099d89f6c0900a3ec4fbd0159e55d9451dcfb9c138ec1d5b0324174dab0

memory/2580-20-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2580-29-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2580-31-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2836-32-0x0000000074900000-0x0000000074FEE000-memory.dmp

memory/2580-28-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2580-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2580-25-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2580-23-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2580-21-0x0000000000400000-0x000000000043A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp7B48.tmp

MD5 9f0fc5e991293a3f4d76c1839717b75b
SHA1 6128cfbc8b03e0c0ef10d0c7ab514e1d14d0fb0b
SHA256 7decf25139166e6df06415a692e1c4efaa844ed4e57ec2b4fadbd614e6941945
SHA512 cdd1147c8dc64bf41a05b82e14ea537f32737ff744b624bfd4369d728d291e4014a2eeffa3676807598d0f7ff4e4f333d9f1b1e0c81624bd76a4dd2cd7a5c696

C:\Users\Admin\AppData\Local\Temp\tmp7BA6.tmp

MD5 4b7ef560289c0f62d0baf6f14f48a57a
SHA1 8331acb90dde588aa3196919f6e847f398fd06d1
SHA256 062844155306130d6fafc4fe10ac9e5ddd2ed462532b729c50cdc979c0d83207
SHA512 ecaa27c4b703d95f9f9b37d8c339982970482e7dab968c2010e0aa644bbfa31973111aafb827565af30c423d1d14e4ff997ec149614e713ff7ef3456894d02d8

memory/2580-40-0x0000000000630000-0x000000000063A000-memory.dmp

memory/2580-41-0x0000000000640000-0x000000000064C000-memory.dmp

memory/2580-42-0x0000000000720000-0x000000000073E000-memory.dmp

memory/2580-43-0x0000000000AB0000-0x0000000000ABA000-memory.dmp

memory/2580-46-0x0000000000BD0000-0x0000000000BE2000-memory.dmp

memory/2580-47-0x0000000000D60000-0x0000000000D7A000-memory.dmp

memory/2580-48-0x0000000000D80000-0x0000000000D8E000-memory.dmp

memory/2580-49-0x0000000001170000-0x0000000001182000-memory.dmp

memory/2580-50-0x0000000001180000-0x000000000118E000-memory.dmp

memory/2580-51-0x00000000011D0000-0x00000000011DC000-memory.dmp

memory/2580-52-0x0000000004A50000-0x0000000004A64000-memory.dmp

memory/2580-53-0x0000000004A60000-0x0000000004A70000-memory.dmp

memory/2580-54-0x0000000004A70000-0x0000000004A84000-memory.dmp

memory/2580-55-0x0000000004BD0000-0x0000000004BDE000-memory.dmp

memory/2580-56-0x0000000004BE0000-0x0000000004C0E000-memory.dmp

memory/2580-57-0x0000000005240000-0x0000000005254000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-30 01:00

Reported

2024-04-30 01:03

Platform

win10v2004-20240419-en

Max time kernel

145s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DSL Host = "C:\\Program Files (x86)\\DSL Host\\dslhost.exe" C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\DSL Host\dslhost.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
File created C:\Program Files (x86)\DSL Host\dslhost.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3020 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3020 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3020 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3020 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3020 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3020 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3020 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 3020 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 3020 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 3020 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 3020 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 3020 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 3020 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 3020 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 3020 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 3020 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 3020 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe
PID 1884 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 1884 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 1884 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 1884 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 1884 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe
PID 1884 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe

"C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZYoQJBONC.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZYoQJBONC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8925.tmp"

C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe

"C:\Users\Admin\AppData\Local\Temp\0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DSL Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp90E6.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DSL Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp927D.tmp"

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 december2nd.ddns.net udp
US 8.8.8.8:53 december2n.duckdns.org udp
US 8.8.8.8:53 december2n.duckdns.org udp
US 8.8.8.8:53 december2nd.ddns.net udp
US 8.8.8.8:53 december2nd.ddns.net udp
US 8.8.8.8:53 december2n.duckdns.org udp
US 8.8.8.8:53 december2n.duckdns.org udp
US 8.8.8.8:53 december2nd.ddns.net udp
US 8.8.8.8:53 december2nd.ddns.net udp

Files

memory/3020-0-0x0000000000190000-0x0000000000234000-memory.dmp

memory/3020-1-0x0000000074820000-0x0000000074FD0000-memory.dmp

memory/3020-2-0x0000000005070000-0x0000000005614000-memory.dmp

memory/3020-3-0x0000000004B60000-0x0000000004BF2000-memory.dmp

memory/3020-4-0x0000000004AF0000-0x0000000004AFA000-memory.dmp

memory/3020-5-0x0000000004B40000-0x0000000004B50000-memory.dmp

memory/3020-6-0x0000000004DC0000-0x0000000004DD8000-memory.dmp

memory/3020-7-0x0000000004FE0000-0x0000000004FEE000-memory.dmp

memory/3020-8-0x0000000005000000-0x0000000005016000-memory.dmp

memory/3020-9-0x0000000005E50000-0x0000000005ECC000-memory.dmp

memory/3020-10-0x00000000084F0000-0x000000000858C000-memory.dmp

memory/644-15-0x00000000048E0000-0x0000000004916000-memory.dmp

memory/644-16-0x0000000005030000-0x0000000005658000-memory.dmp

memory/3020-17-0x0000000074820000-0x0000000074FD0000-memory.dmp

memory/3980-22-0x0000000002820000-0x0000000002830000-memory.dmp

memory/3980-21-0x0000000002820000-0x0000000002830000-memory.dmp

memory/644-20-0x00000000049F0000-0x0000000004A00000-memory.dmp

memory/644-19-0x00000000049F0000-0x0000000004A00000-memory.dmp

memory/644-18-0x0000000074820000-0x0000000074FD0000-memory.dmp

memory/3020-24-0x0000000004B40000-0x0000000004B50000-memory.dmp

memory/3980-23-0x0000000074820000-0x0000000074FD0000-memory.dmp

memory/644-26-0x00000000056D0000-0x0000000005736000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8925.tmp

MD5 8e0f41de76b09a0187dc6a48836b825d
SHA1 d3e19dd4fb0e48a5ff469de0aac88f05a03a7ff9
SHA256 d192815c222f677e47ffcf21202224186409fd1e34a6c1907972627d5e07e380
SHA512 c8eab44c1a25104f87cb946b94db13cf9c613033e490e652dfa151d0caa1344a200af049e92798440061985769f0ed71c265ea812c85896297fa09c53fa03508

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_knh20whq.35s.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/644-27-0x0000000005740000-0x00000000057A6000-memory.dmp

memory/644-25-0x0000000004EE0000-0x0000000004F02000-memory.dmp

memory/3980-47-0x0000000005B10000-0x0000000005E64000-memory.dmp

memory/1884-48-0x0000000000400000-0x000000000043A000-memory.dmp

memory/3020-50-0x0000000074820000-0x0000000074FD0000-memory.dmp

memory/644-51-0x0000000005E90000-0x0000000005EAE000-memory.dmp

memory/644-52-0x0000000006340000-0x000000000638C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp90E6.tmp

MD5 9f0fc5e991293a3f4d76c1839717b75b
SHA1 6128cfbc8b03e0c0ef10d0c7ab514e1d14d0fb0b
SHA256 7decf25139166e6df06415a692e1c4efaa844ed4e57ec2b4fadbd614e6941945
SHA512 cdd1147c8dc64bf41a05b82e14ea537f32737ff744b624bfd4369d728d291e4014a2eeffa3676807598d0f7ff4e4f333d9f1b1e0c81624bd76a4dd2cd7a5c696

C:\Users\Admin\AppData\Local\Temp\tmp927D.tmp

MD5 93ce4074fc5eb179781efe164156eb91
SHA1 244d5d799f3de4f3de3be7ec6aa139d413efe0e6
SHA256 8de986511fc41fa28d7609844b2b41d496813a6814d43652cd99b280aa266da5
SHA512 7edf4f70158e51719f7d4804ba69256ed6fdd8514b51fd937be3ee6cc1ea9e2760671c11ffe9b551d25db484dcc3683fa6cd3836cb4033ecb8fb6baa76df3e0c

memory/1884-62-0x0000000005B50000-0x0000000005B6E000-memory.dmp

memory/1884-61-0x0000000005AB0000-0x0000000005ABC000-memory.dmp

memory/1884-60-0x0000000005AA0000-0x0000000005AAA000-memory.dmp

memory/1884-63-0x00000000068C0000-0x00000000068CA000-memory.dmp

memory/644-75-0x0000000071010000-0x000000007105C000-memory.dmp

memory/3980-65-0x0000000071010000-0x000000007105C000-memory.dmp

memory/3980-77-0x0000000006720000-0x000000000673E000-memory.dmp

memory/3980-64-0x0000000006760000-0x0000000006792000-memory.dmp

memory/644-86-0x0000000006EB0000-0x0000000006F53000-memory.dmp

memory/3980-87-0x0000000007AB0000-0x000000000812A000-memory.dmp

memory/3980-88-0x0000000007470000-0x000000000748A000-memory.dmp

memory/644-89-0x0000000007250000-0x000000000725A000-memory.dmp

memory/644-90-0x0000000007460000-0x00000000074F6000-memory.dmp

memory/3980-91-0x0000000007670000-0x0000000007681000-memory.dmp

memory/3980-92-0x00000000076A0000-0x00000000076AE000-memory.dmp

memory/3980-93-0x00000000076B0000-0x00000000076C4000-memory.dmp

memory/3980-94-0x00000000077B0000-0x00000000077CA000-memory.dmp

memory/3980-95-0x0000000007790000-0x0000000007798000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 fa472e0cb84f5878665b7c2265880e8a
SHA1 5548e1075d3d37c7b4ac18034c3980aa1be0e2f1
SHA256 97e8f177cea2c03843db4623b6c42e3ae157051ea1d93fdc300b894c73ae3aa1
SHA512 3b26a57103d17a2935c91fff9d0e2e35f1378bb5bebec99d467e0de032bc50f356522c0031071352f49ce75a84a71001ca37298dc3e9562f319d75d9a158d6d4

memory/3980-101-0x0000000074820000-0x0000000074FD0000-memory.dmp

memory/644-102-0x0000000074820000-0x0000000074FD0000-memory.dmp