Malware Analysis Report

2024-10-23 22:21

Sample ID 240508-jepp7sca83
Target LS24SDE.exe
SHA256 0445cc730c308b40378c9133d394004d55dfdcb03db7d26485736471af6ba41e
Tags
formbook jn17 execution rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0445cc730c308b40378c9133d394004d55dfdcb03db7d26485736471af6ba41e

Threat Level: Known bad

The file LS24SDE.exe was found to be: Known bad.

Malicious Activity Summary

formbook jn17 execution rat spyware stealer trojan

Formbook

Formbook payload

Command and Scripting Interpreter: PowerShell

Deletes itself

Checks computer location settings

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Gathers network information

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-08 07:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-08 07:35

Reported

2024-05-08 07:37

Platform

win7-20240221-en

Max time kernel

148s

Max time network

122s

Command Line

C:\Windows\Explorer.EXE

Signatures

Formbook

trojan spyware stealer formbook

Formbook payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 360 set thread context of 2796 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 2796 set thread context of 1204 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\Explorer.EXE
PID 2796 set thread context of 1204 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\Explorer.EXE
PID 2440 set thread context of 1204 N/A C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\Explorer.EXE

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 360 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 360 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 360 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 360 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 360 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\schtasks.exe
PID 360 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\schtasks.exe
PID 360 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\schtasks.exe
PID 360 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\schtasks.exe
PID 360 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 360 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 360 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 360 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 360 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 360 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 360 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 360 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 360 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 360 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 360 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 1204 wrote to memory of 2440 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\NETSTAT.EXE
PID 1204 wrote to memory of 2440 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\NETSTAT.EXE
PID 1204 wrote to memory of 2440 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\NETSTAT.EXE
PID 1204 wrote to memory of 2440 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\NETSTAT.EXE
PID 2440 wrote to memory of 2544 N/A C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\cmd.exe
PID 2440 wrote to memory of 2544 N/A C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\cmd.exe
PID 2440 wrote to memory of 2544 N/A C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\cmd.exe
PID 2440 wrote to memory of 2544 N/A C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\cmd.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe

"C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mIsRPVu.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mIsRPVu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp46C0.tmp"

C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe

"C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe"

C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe

"C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe"

C:\Windows\SysWOW64\NETSTAT.EXE

"C:\Windows\SysWOW64\NETSTAT.EXE"

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe"

Network

N/A

Files

memory/360-0-0x000000007464E000-0x000000007464F000-memory.dmp

memory/360-1-0x0000000000240000-0x00000000002E4000-memory.dmp

memory/360-2-0x0000000074640000-0x0000000074D2E000-memory.dmp

memory/360-3-0x00000000005A0000-0x00000000005BE000-memory.dmp

memory/360-4-0x0000000000620000-0x0000000000630000-memory.dmp

memory/360-5-0x0000000000630000-0x0000000000646000-memory.dmp

memory/360-6-0x00000000044B0000-0x0000000004526000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp46C0.tmp

MD5 d776dea239552a86c07ad817ec58ff1c
SHA1 cf6df5153866408bd0fa1cd5a0713ccfe275eece
SHA256 e3e2b3dbe46478a2cb9f444eec26c877b8b0db9819765222c7618f5397820926
SHA512 cde1002007b77ef809b361cd6e67c3f055eaec08c8145f734d5311896aaf3bf6c37757c1f8b35851624c6cc664fc51d3a6a7cb59d9d3b122ffd64fa586aa7f7b

memory/2796-14-0x0000000000400000-0x000000000042F000-memory.dmp

memory/2796-16-0x0000000000400000-0x000000000042F000-memory.dmp

memory/2796-19-0x0000000000400000-0x000000000042F000-memory.dmp

memory/2796-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/360-20-0x0000000074640000-0x0000000074D2E000-memory.dmp

memory/2796-22-0x0000000000400000-0x000000000042F000-memory.dmp

memory/1204-23-0x00000000064F0000-0x00000000065DE000-memory.dmp

memory/2440-24-0x0000000000E40000-0x0000000000E49000-memory.dmp

memory/2440-25-0x0000000000080000-0x00000000000AF000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-08 07:35

Reported

2024-05-08 07:37

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

141s

Command Line

C:\Windows\Explorer.EXE

Signatures

Formbook

trojan spyware stealer formbook

Formbook payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4120 set thread context of 1492 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 1492 set thread context of 3520 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\Explorer.EXE
PID 1492 set thread context of 3520 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\Explorer.EXE
PID 2780 set thread context of 3520 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\Explorer.EXE

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\Explorer.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\wscript.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wscript.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4120 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4120 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4120 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4120 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\schtasks.exe
PID 4120 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\schtasks.exe
PID 4120 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\schtasks.exe
PID 4120 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 4120 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 4120 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 4120 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 4120 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 4120 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
PID 1492 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\wscript.exe
PID 1492 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\wscript.exe
PID 1492 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe C:\Windows\SysWOW64\wscript.exe
PID 2780 wrote to memory of 1688 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2780 wrote to memory of 1688 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2780 wrote to memory of 1688 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe

"C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mIsRPVu.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mIsRPVu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp613A.tmp"

C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe

"C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe"

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\SysWOW64\wscript.exe"

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 44.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 www.ptt-gov.art udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.120:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 120.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 www.vedicloud.com udp
US 3.19.116.195:80 www.vedicloud.com tcp
US 8.8.8.8:53 195.116.19.3.in-addr.arpa udp
US 8.8.8.8:53 www.mthfrgeneawareness.xyz udp
US 3.33.130.190:80 www.mthfrgeneawareness.xyz tcp
US 8.8.8.8:53 190.130.33.3.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 www.hhhky.top udp
US 8.8.8.8:53 www.postds.buzz udp

Files

memory/4120-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

memory/4120-1-0x0000000000E00000-0x0000000000EA4000-memory.dmp

memory/4120-2-0x0000000005EF0000-0x0000000006494000-memory.dmp

memory/4120-3-0x0000000005880000-0x0000000005912000-memory.dmp

memory/4120-4-0x0000000005950000-0x000000000595A000-memory.dmp

memory/4120-5-0x0000000074BA0000-0x0000000075350000-memory.dmp

memory/4120-6-0x0000000005AA0000-0x0000000005ABE000-memory.dmp

memory/4120-7-0x0000000005EE0000-0x0000000005EF0000-memory.dmp

memory/4120-8-0x0000000006BD0000-0x0000000006BE6000-memory.dmp

memory/4120-9-0x00000000072F0000-0x0000000007366000-memory.dmp

memory/4120-10-0x0000000009950000-0x00000000099EC000-memory.dmp

memory/2444-15-0x0000000002960000-0x0000000002996000-memory.dmp

memory/2444-16-0x0000000074BA0000-0x0000000075350000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp613A.tmp

MD5 045fc609cbb3250b4b3ee5f66db9e6de
SHA1 2feaf1ed19330dce7166712de26bfc2d8737ecee
SHA256 b1195c55170e4a49c01da7f9b10e3d6d16d350e41a5446141c336cd4be971b1f
SHA512 f76b52a33d8b6b0c16674659c0d6814ad036e8ad22316764a41814d57ba45bfc2e9f3c6f11f75587ebc64a3263cd129b833954c9427842454f2b2c5f589893d7

memory/2444-18-0x0000000074BA0000-0x0000000075350000-memory.dmp

memory/2444-19-0x00000000054C0000-0x0000000005AE8000-memory.dmp

memory/2444-20-0x0000000074BA0000-0x0000000075350000-memory.dmp

memory/1492-21-0x0000000000400000-0x000000000042F000-memory.dmp

memory/4120-23-0x0000000074BA0000-0x0000000075350000-memory.dmp

memory/2444-24-0x0000000005390000-0x00000000053B2000-memory.dmp

memory/2444-26-0x0000000005BD0000-0x0000000005C36000-memory.dmp

memory/2444-25-0x0000000005B60000-0x0000000005BC6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lpkwlosb.0hf.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2444-36-0x0000000005C50000-0x0000000005FA4000-memory.dmp

memory/1492-37-0x0000000001060000-0x00000000013AA000-memory.dmp

memory/1492-40-0x0000000000F60000-0x0000000000F75000-memory.dmp

memory/1492-39-0x0000000000400000-0x000000000042F000-memory.dmp

memory/3520-41-0x0000000008AF0000-0x0000000008C94000-memory.dmp

memory/2444-42-0x0000000006250000-0x000000000626E000-memory.dmp

memory/2444-43-0x00000000062A0000-0x00000000062EC000-memory.dmp

memory/2444-44-0x000000007FD60000-0x000000007FD70000-memory.dmp

memory/2444-45-0x0000000006830000-0x0000000006862000-memory.dmp

memory/2444-46-0x0000000071460000-0x00000000714AC000-memory.dmp

memory/2444-58-0x0000000002930000-0x0000000002940000-memory.dmp

memory/2444-57-0x0000000002930000-0x0000000002940000-memory.dmp

memory/2444-56-0x0000000007450000-0x000000000746E000-memory.dmp

memory/2444-59-0x0000000007470000-0x0000000007513000-memory.dmp

memory/2444-60-0x0000000007BC0000-0x000000000823A000-memory.dmp

memory/2444-61-0x0000000007580000-0x000000000759A000-memory.dmp

memory/2444-62-0x00000000075F0000-0x00000000075FA000-memory.dmp

memory/2444-63-0x0000000007800000-0x0000000007896000-memory.dmp

memory/2444-64-0x0000000007780000-0x0000000007791000-memory.dmp

memory/2444-65-0x00000000077B0000-0x00000000077BE000-memory.dmp

memory/2444-66-0x00000000077C0000-0x00000000077D4000-memory.dmp

memory/2444-67-0x00000000078C0000-0x00000000078DA000-memory.dmp

memory/2444-68-0x00000000078A0000-0x00000000078A8000-memory.dmp

memory/2444-71-0x0000000074BA0000-0x0000000075350000-memory.dmp

memory/2780-73-0x00000000009F0000-0x0000000000A17000-memory.dmp

memory/1492-74-0x0000000000400000-0x000000000042F000-memory.dmp

memory/2780-75-0x0000000001130000-0x000000000115F000-memory.dmp

memory/3520-78-0x0000000008CA0000-0x0000000008D96000-memory.dmp