Malware Analysis Report

2024-10-16 03:42

Sample ID 240509-nayjrshb53
Target red.zip
SHA256 45e94c10bbc148cc1f0e810ef4a64b3b2814960515bbe6c69d8570dde960e0b2
Tags
amadey healer redline krast dropper evasion infostealer persistence trojan masha smokeloader grom backdoor privateloader risepro loader stealer crazy zgrat discovery rat spyware paypal phishing themida lande kira lamp 5195552529
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

45e94c10bbc148cc1f0e810ef4a64b3b2814960515bbe6c69d8570dde960e0b2

Threat Level: Known bad

The file red.zip was found to be: Known bad.

Malicious Activity Summary

amadey healer redline krast dropper evasion infostealer persistence trojan masha smokeloader grom backdoor privateloader risepro loader stealer crazy zgrat discovery rat spyware paypal phishing themida lande kira lamp 5195552529

RedLine

ZGRat

Detects Healer an antivirus disabler dropper

RisePro

PrivateLoader

Amadey

Modifies Windows Defender Real-time Protection settings

SmokeLoader

RedLine payload

Detect ZGRat V1

Healer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Themida packer

Checks BIOS information in registry

Reads user/profile data of web browsers

Checks computer location settings

Drops startup file

Windows security modification

Executes dropped EXE

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Checks installed software on the system

Checks whether UAC is enabled

Adds Run key to start application

Detected potential entity reuse from brand paypal.

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

AutoIT Executable

Enumerates physical storage devices

Unsigned PE

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Enumerates system info in registry

Checks SCSI registry key(s)

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 11:12

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4340725.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5801744.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4520 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5801744.exe
PID 4520 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5801744.exe
PID 4520 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5801744.exe
PID 3560 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5801744.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe
PID 3560 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5801744.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe
PID 3560 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5801744.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4340725.exe
PID 3560 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5801744.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4340725.exe
PID 3560 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5801744.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4340725.exe
PID 2884 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4340725.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 2884 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4340725.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 2884 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4340725.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 4520 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t2543361.exe
PID 4520 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t2543361.exe
PID 4520 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t2543361.exe
PID 2064 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 2064 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 2064 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 2064 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 2064 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 2064 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 1040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 1040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 1040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 4732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3656 wrote to memory of 4732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3656 wrote to memory of 4732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3656 wrote to memory of 540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3656 wrote to memory of 540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3656 wrote to memory of 540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3656 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 2128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3656 wrote to memory of 2128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3656 wrote to memory of 2128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3656 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3656 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3656 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe

"C:\Users\Admin\AppData\Local\Temp\02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5801744.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5801744.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4340725.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4340725.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t2543361.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t2543361.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
BE 2.17.196.66:443 www.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 23.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 66.196.17.2.in-addr.arpa udp
BE 2.17.196.176:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 176.196.17.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
SE 5.42.92.67:80 tcp
FI 77.91.68.68:19071 tcp
SE 5.42.92.67:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
SE 5.42.92.67:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5801744.exe

MD5 5dd82db66268a4b0f22e71adeaac0f32
SHA1 0f7082e1d2f8a34e8113b9299a609b40d0adcd5c
SHA256 d4a2e3dd8a69ca77f27ddce69f4c791e7611eaa72ca3547c8498068877b70b20
SHA512 879997f6fcec3110186f069e29e3304ef0791358e28ced0ea01e55520eb6247ea2e4fd4daa8d29a8ee0ac678a7fcb3a59dc534e10a9df36eb8737fbf49c494cc

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe

MD5 dce80cd173227baec918467eb5fc866a
SHA1 a152c2a8b6937591b17992d076b9bd87d80bd476
SHA256 811e7f0dc3fafe8c8a1995e710e74afa46725bcdfd4ed2d54c8398149f4ff4ba
SHA512 8e1508e54cc5e876fabeeffe7a0ed06f4d681567bd66f68c0604db2ba5b49d01a7147dcd7c9b374e386f7878dea35efac613f3f2a5a77db9f4960b4a66dead43

memory/3876-15-0x00007FFE39533000-0x00007FFE39535000-memory.dmp

memory/3876-14-0x0000000000E30000-0x0000000000E3A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4340725.exe

MD5 75472cef98fac29032610df4207d9b57
SHA1 174e6cc639afd8d27d151ae40fdd4566526c2d39
SHA256 9b9a39321869cdfca455862b642ea93dc3e9e2b884989b375496470a46c26f8f
SHA512 e836f212da764abae287bc158644f947c2d777bef654e1338651e08bc074d99d26857b4db78abb49b87263847fcc02e9e7d780504b86b558ca26c7d7e387a295

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t2543361.exe

MD5 3f4816bf5f356599abe2c8d4de820c48
SHA1 ca653d885670c9e9c769feb6fa686521e0481cbb
SHA256 8841cea2635137048ccfb5be215d9ac8d538b2cd30710b1baccb67a83494c4b2
SHA512 b7c7b8d93cc0d74f6953ad5beccb2664c9c3dbdb7fca7f3aa8f4b05689bb4b95268685a102e38c6313a0d9400d9144aa90f0d8f3b4169f274a7be3ac216ce35e

memory/1472-33-0x0000000000550000-0x0000000000580000-memory.dmp

memory/1472-34-0x0000000000E50000-0x0000000000E56000-memory.dmp

memory/1472-35-0x0000000005560000-0x0000000005B78000-memory.dmp

memory/1472-36-0x0000000005050000-0x000000000515A000-memory.dmp

memory/1472-37-0x0000000004ED0000-0x0000000004EE2000-memory.dmp

memory/1472-38-0x0000000004F40000-0x0000000004F7C000-memory.dmp

memory/1472-39-0x0000000004F80000-0x0000000004FCC000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240508-en

Max time kernel

132s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\22f65486ce4ad040f9985202d9306069315f0db3b4c66e630e358d3e8275178c.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6997162.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6997162.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6997162.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4641227.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4641227.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4641227.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6997162.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6997162.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4641227.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4641227.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6997162.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4641227.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6997162.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6997162.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4641227.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\22f65486ce4ad040f9985202d9306069315f0db3b4c66e630e358d3e8275178c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0958649.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9044848.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9878724.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6997162.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4641227.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2372 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\22f65486ce4ad040f9985202d9306069315f0db3b4c66e630e358d3e8275178c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0958649.exe
PID 2372 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\22f65486ce4ad040f9985202d9306069315f0db3b4c66e630e358d3e8275178c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0958649.exe
PID 2372 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\22f65486ce4ad040f9985202d9306069315f0db3b4c66e630e358d3e8275178c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0958649.exe
PID 4672 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0958649.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9044848.exe
PID 4672 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0958649.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9044848.exe
PID 4672 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0958649.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9044848.exe
PID 4980 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9044848.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9878724.exe
PID 4980 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9044848.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9878724.exe
PID 4980 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9044848.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9878724.exe
PID 1520 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9878724.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6997162.exe
PID 1520 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9878724.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6997162.exe
PID 1520 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9878724.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6997162.exe
PID 1520 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9878724.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4641227.exe
PID 1520 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9878724.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4641227.exe
PID 4980 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9044848.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5850381.exe
PID 4980 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9044848.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5850381.exe
PID 4980 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9044848.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5850381.exe

Processes

C:\Users\Admin\AppData\Local\Temp\22f65486ce4ad040f9985202d9306069315f0db3b4c66e630e358d3e8275178c.exe

"C:\Users\Admin\AppData\Local\Temp\22f65486ce4ad040f9985202d9306069315f0db3b4c66e630e358d3e8275178c.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0958649.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0958649.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9044848.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9044848.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9878724.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9878724.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6997162.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6997162.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4641227.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4641227.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5850381.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5850381.exe

Network

Country Destination Domain Proto
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0958649.exe

MD5 d5234b1b06f679182e584fb90ab07f5f
SHA1 172ddddd3663d16fe7f84a516be9c2c007fe3164
SHA256 51a2a12e30660532d1900199113b6393952fdfff40ede8c47138aa19b28cb7d8
SHA512 8d8261956de8c7747e2343d0b82069297795e0da0f63d5f2798cce1ff1c43a28c5af5b12dfa9d586c2d73d599a0d7fbf3ad2e2ad2877d58055bd2208ad7dffab

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9044848.exe

MD5 f4493a26b4b10f53bba65a537a1ec087
SHA1 eb2c5b0cedab32ac585775afcc8bffdce667659c
SHA256 f7f1fd6d848ee41b65262c9a2f501eb7c40ec1fe2246cf21c802f96e10c33dc1
SHA512 2c08c13f1d8b725c6ae3a3592df769697ef0b502af808556440fef03093f87f3e0d5e5dc3f822e4ee5ebd76ce51aac0988e1f8c03091711434bdd69c79e3349f

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9878724.exe

MD5 0c5b92ca95c721f4da86a5a82f2e29c6
SHA1 1d19df0b01159fce0c4b9b649193faad02db809a
SHA256 e649d2fd56f4e1d06b2eab19e0b74693b4256117f17ee0dd2a73482d8b7f4056
SHA512 76eace14900a78f7ba3b2ae2d91a0d6bf6b6aaf8cd33ef1f7460a527d5a3c79678d133e7a3bd225a9b0bf30435f88bab9a5af4aeb10c9c2f8e2d1a013036ae1f

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6997162.exe

MD5 ee00df098d40cee95ceb67213b11b5b8
SHA1 d0025151437dc27fc26955d502d6740d19ec97ba
SHA256 7c9fbc3f7b5248fd4a18d30cbf7504f2521665b31c4ff3fb0b41105d15fe0ac6
SHA512 a19f3add5cc090dccc5699fb97070cb7cbae3c6d474159b82177a665a54bbafb480a24983e79d5aa799793e88eeaada4ccdc5147fb630e70c216fdd74577fa10

memory/4080-28-0x00000000004F0000-0x00000000004FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4641227.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2256-37-0x0000000000260000-0x000000000026A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5850381.exe

MD5 698d7de8bf63a96347de0a58d4558825
SHA1 3eb05fd2f7d39a84c2f5fc4f5b8d46f95e53d675
SHA256 38ef28d2ab78e4f8388653d130c6a2a3c6f66222699a30b5bec96e2e2f77aa10
SHA512 a8afe9c4aff2b7e618a0b8c8ee1d61d6f412fe83d0a0c0d549324343f81c80876b13a9d84b6cfe9516e3d2bac66881e49411bcdd58c96b810b24c212a611fe2b

memory/2588-42-0x0000000000440000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/2588-47-0x00000000021E0000-0x00000000021E6000-memory.dmp

memory/2588-48-0x000000000A4A0000-0x000000000AAB8000-memory.dmp

memory/2588-49-0x0000000009EE0000-0x0000000009FEA000-memory.dmp

memory/2588-50-0x000000000A020000-0x000000000A032000-memory.dmp

memory/2588-51-0x000000000A040000-0x000000000A07C000-memory.dmp

memory/2588-52-0x00000000043C0000-0x000000000440C000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240508-en

Max time kernel

126s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\afa70bcf383e33af9cbc128ccd361170f3a0ea3cd99315128edb8e1a80aad23a.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2553496.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5712082.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5712082.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2553496.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2553496.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2553496.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2553496.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2553496.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5712082.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5712082.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5712082.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5712082.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5712082.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2553496.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2553496.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\afa70bcf383e33af9cbc128ccd361170f3a0ea3cd99315128edb8e1a80aad23a.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8606143.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8447807.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8429534.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2553496.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5712082.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4740 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\afa70bcf383e33af9cbc128ccd361170f3a0ea3cd99315128edb8e1a80aad23a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8606143.exe
PID 4740 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\afa70bcf383e33af9cbc128ccd361170f3a0ea3cd99315128edb8e1a80aad23a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8606143.exe
PID 4740 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\afa70bcf383e33af9cbc128ccd361170f3a0ea3cd99315128edb8e1a80aad23a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8606143.exe
PID 4628 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8606143.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8447807.exe
PID 4628 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8606143.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8447807.exe
PID 4628 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8606143.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8447807.exe
PID 840 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8447807.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8429534.exe
PID 840 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8447807.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8429534.exe
PID 840 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8447807.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8429534.exe
PID 2280 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8429534.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2553496.exe
PID 2280 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8429534.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2553496.exe
PID 2280 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8429534.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2553496.exe
PID 2280 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8429534.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5712082.exe
PID 2280 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8429534.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5712082.exe
PID 840 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8447807.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7432514.exe
PID 840 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8447807.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7432514.exe
PID 840 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8447807.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7432514.exe

Processes

C:\Users\Admin\AppData\Local\Temp\afa70bcf383e33af9cbc128ccd361170f3a0ea3cd99315128edb8e1a80aad23a.exe

"C:\Users\Admin\AppData\Local\Temp\afa70bcf383e33af9cbc128ccd361170f3a0ea3cd99315128edb8e1a80aad23a.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8606143.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8606143.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8447807.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8447807.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8429534.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8429534.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2553496.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2553496.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5712082.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5712082.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7432514.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7432514.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.96:443 www.bing.com tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 96.196.17.2.in-addr.arpa udp
BE 2.17.196.96:443 www.bing.com tcp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8606143.exe

MD5 85a84ec8caf713bbf6d1194c73849518
SHA1 42365d5629741d2845f27fe694f1141bf3dbec2c
SHA256 c247556907e834a732d4138ae25fcb7ed4cc17aaedc05f7cc785b7cdcf409ff7
SHA512 03e9e9a337f52facb6efa91fb42e093555f856b923a0e786ac2352183f3da185f30e8980cbe2a5b90c560c06a6ad636234466e4ec325c74f6d82010059dc0ce9

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8447807.exe

MD5 ecbed37d9fde9b7919458f251e2a2f95
SHA1 9d3843ea35e446a3604ef14e4f9d55458d90f3ef
SHA256 63ac4cab84988253ecda3af804a8246350662fc316cd03de8874d56fea375722
SHA512 b42a65195d887ca2a268c5556de0743596d7e2b460bea32ed585e81628db4188132617a7160f213f33b2b722dd2a75c9ad0cc42bb4fc59fbab07fd7f948f6554

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8429534.exe

MD5 ff8e72adb03ec3be07668cf2a4fc9660
SHA1 8cfb7b2972d5b9d011aab516bb8d33de415a65f4
SHA256 f1306a5f8023a569894248c4ebca9e5ee12412cfe73ca27ada08d4692a02f10e
SHA512 7a5f81a9a7d3692d34a91dd649f4d55e77b8453319b7e73ca8ece4b76f549ff53dda9caa1b7611a82ac73bdea60233f1f7507d1fcccb7bea268c60554fba8f7d

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2553496.exe

MD5 106b018729981308bb250d0e8f846078
SHA1 9f6fddc22ce689b3a0b29883fac746e837e7509c
SHA256 98d9459cbade980062439f8a76d35c2aa512b83779900ed12f4960b2d75f6ac6
SHA512 98d0dd03399d3fe757c1e77d09b836edfbbd15afe79a77179bc2cd685dfadaf9e96280d392c39cda1e8d2d450f221357483bc9314312373510e14d2fa1093f8b

memory/3368-28-0x0000000000540000-0x000000000054A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5712082.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2620-37-0x00000000003E0000-0x00000000003EA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7432514.exe

MD5 d85d317a46aed09b8146e252b7c8764d
SHA1 1ce5e60b21c26d2bbcdedbe97ba159b7358e7c79
SHA256 1db7f105be4b03d970a89606e06375cc8c1377dc21eeffccb8625ae70ee012b8
SHA512 c50af6060b55d216d31e9e101db26698e70c785035e864a9ecf36426ea639db15bfaa3f08fdf5c8843520221391f7cd5c32d2aa4303c276e1d2c7867ce7ed4e0

memory/1808-42-0x0000000000790000-0x00000000007C0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/1808-47-0x0000000002430000-0x0000000002436000-memory.dmp

memory/1808-48-0x0000000004A90000-0x00000000050A8000-memory.dmp

memory/1808-49-0x00000000050E0000-0x00000000051EA000-memory.dmp

memory/1808-50-0x0000000005220000-0x0000000005232000-memory.dmp

memory/1808-51-0x0000000005240000-0x000000000527C000-memory.dmp

memory/1808-52-0x00000000052E0000-0x000000000532C000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3417358.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7654671.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7654671.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7654671.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2400 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe
PID 2400 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe
PID 2400 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe
PID 3192 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe
PID 3192 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe
PID 3192 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe
PID 3196 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe
PID 3196 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe
PID 3196 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3417358.exe
PID 3196 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3417358.exe
PID 3196 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3417358.exe
PID 2220 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3417358.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2220 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3417358.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2220 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3417358.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3192 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7654671.exe
PID 3192 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7654671.exe
PID 3192 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7654671.exe
PID 4656 wrote to memory of 816 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4656 wrote to memory of 816 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4656 wrote to memory of 816 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4656 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4656 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4656 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3616 wrote to memory of 3596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3616 wrote to memory of 3596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3616 wrote to memory of 3596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3616 wrote to memory of 4016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3616 wrote to memory of 4016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3616 wrote to memory of 4016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3616 wrote to memory of 3944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3616 wrote to memory of 3944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3616 wrote to memory of 3944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3616 wrote to memory of 4596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3616 wrote to memory of 4596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3616 wrote to memory of 4596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3616 wrote to memory of 4188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3616 wrote to memory of 4188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3616 wrote to memory of 4188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3616 wrote to memory of 3464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3616 wrote to memory of 3464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3616 wrote to memory of 3464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2400 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3796674.exe
PID 2400 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3796674.exe
PID 2400 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3796674.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe

"C:\Users\Admin\AppData\Local\Temp\c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3417358.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3417358.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7654671.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7654671.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3796674.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3796674.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 200.79.70.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe

MD5 1acae507d505295617d1d9e35e7ff325
SHA1 5a51d767e542eb063cad3c1a1941eacd79c5615f
SHA256 9650beff753142aee81cebf4cea8713c3082ebadbc85da42918cbbef073a6100
SHA512 64d960be85e8cdee0f34a077fab0b1f30df25834a2bf95d746de407caa193fcaa1ad27582d64b9056c718da2f040b5ee4472d6be025db729b265eab9ca0153d3

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe

MD5 bbb9f75f658955c74b106491947e7515
SHA1 eb2095b2e7fe352c81bebf76163f338e729c4e7c
SHA256 1a64590efa05eaf5cdbf115ea5865adc8b36d3d7b190276dbf82f92fdb8c525d
SHA512 f2cd98b8e757b0f66ccbc09f6823f9b36ac03eb8539d78bbfb026d7f353eda55f8b8df6f64932b0a3b070705a1d9dec722b31caddaa942c107d810682b430053

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe

MD5 548c2b9bf640901f69dbebe16314c8e3
SHA1 117bb6831e7b0ccf87eb362839cc01edec17b0f9
SHA256 657b1e6fc8c9a038b6cfeea43a3fb4750850733150359938e410812b33d07bd1
SHA512 4e8198b8e48c589e81dd1d0f63639cf1b9a0e83ee52c707c4ed0ce068393f2e5386d82509cb306894c34ae5e4413e66886d09ca06c5e86ad5443f3e90fa523c9

memory/1456-21-0x00007FF9FF2E3000-0x00007FF9FF2E5000-memory.dmp

memory/1456-22-0x0000000000360000-0x000000000036A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3417358.exe

MD5 c57d8839d9005c5ee82c1c9423470c60
SHA1 5f5db7ad592e1e58af4a7cac6da93bcea6b782e6
SHA256 304e1585904538f133c315e7f96e2b47b018e8b3dc968d489a6abf1ff61de0ab
SHA512 84a7427b6ab249ec1a0075fb4c6251c4c37b408d528836b570c9199a32c0bf3769e3aab12833aef1e80af52e83ab06f2367ec7b44ad9f3f6bdf8d6d9c2ace0d5

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7654671.exe

MD5 de08a9da7e87ccd216528a8af6a17ae7
SHA1 acd05b906646ae038db6a14d161ea5944f0a7d74
SHA256 11fb638def845950f74c9ef33f6efc5c21e23523253641015cc9fb9fd9d51c01
SHA512 296f79f1a902fba21955d625e47a7d422a916b5511105c0e68e04f3917dc2d9939aceb0679b97ca0f89cd02154b441c240cca9f23927dc9f4e5b7bc9aa606892

memory/2840-40-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3796674.exe

MD5 8358cb2d3f34962fc91719d288c15e8b
SHA1 9c16e75f8f7ed88411166d0b2b8bb3449c29194f
SHA256 eeb937d59976fbd8e84eb2467d322cc7f7a023792d64d5efd9fd73f6f86d5579
SHA512 fcb8a872a7ec7deddcfd527736089a2b1d38199394eaa107d34ed95e8576d83f3baf000c355542e7f6433e903709fc7d70188ac96feac7bdfce348820efe45e8

memory/1376-44-0x0000000000FB0000-0x0000000000FE0000-memory.dmp

memory/1376-45-0x0000000003380000-0x0000000003386000-memory.dmp

memory/1376-46-0x000000000B490000-0x000000000BAA8000-memory.dmp

memory/1376-47-0x000000000AF80000-0x000000000B08A000-memory.dmp

memory/1376-48-0x000000000AEA0000-0x000000000AEB2000-memory.dmp

memory/1376-49-0x000000000AF00000-0x000000000AF3C000-memory.dmp

memory/1376-50-0x0000000003260000-0x00000000032AC000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d5755dadc9af9cde67934873a4cde67dc43f1cec089cfbeef71140b67d9912b2.exe"

Signatures

PrivateLoader

loader privateloader

RisePro

stealer risepro

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qe51ov4.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qe51ov4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\d5755dadc9af9cde67934873a4cde67dc43f1cec089cfbeef71140b67d9912b2.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gm8YK55.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oj6ab41.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ll7AZ90.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1328 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\d5755dadc9af9cde67934873a4cde67dc43f1cec089cfbeef71140b67d9912b2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gm8YK55.exe
PID 1328 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\d5755dadc9af9cde67934873a4cde67dc43f1cec089cfbeef71140b67d9912b2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gm8YK55.exe
PID 1328 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\d5755dadc9af9cde67934873a4cde67dc43f1cec089cfbeef71140b67d9912b2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gm8YK55.exe
PID 4172 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gm8YK55.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oj6ab41.exe
PID 4172 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gm8YK55.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oj6ab41.exe
PID 4172 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gm8YK55.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oj6ab41.exe
PID 1120 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oj6ab41.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ll7AZ90.exe
PID 1120 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oj6ab41.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ll7AZ90.exe
PID 1120 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oj6ab41.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ll7AZ90.exe
PID 3968 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ll7AZ90.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qe51ov4.exe
PID 3968 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ll7AZ90.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qe51ov4.exe
PID 3968 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ll7AZ90.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qe51ov4.exe
PID 1572 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qe51ov4.exe C:\Windows\SysWOW64\schtasks.exe
PID 1572 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qe51ov4.exe C:\Windows\SysWOW64\schtasks.exe
PID 1572 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qe51ov4.exe C:\Windows\SysWOW64\schtasks.exe
PID 1572 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qe51ov4.exe C:\Windows\SysWOW64\schtasks.exe
PID 1572 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qe51ov4.exe C:\Windows\SysWOW64\schtasks.exe
PID 1572 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qe51ov4.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d5755dadc9af9cde67934873a4cde67dc43f1cec089cfbeef71140b67d9912b2.exe

"C:\Users\Admin\AppData\Local\Temp\d5755dadc9af9cde67934873a4cde67dc43f1cec089cfbeef71140b67d9912b2.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gm8YK55.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gm8YK55.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oj6ab41.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oj6ab41.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ll7AZ90.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ll7AZ90.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qe51ov4.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qe51ov4.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

Network

Country Destination Domain Proto
NL 194.49.94.152:50500 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
NL 194.49.94.152:50500 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 194.49.94.152:50500 tcp
NL 194.49.94.152:50500 tcp
NL 194.49.94.152:50500 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
NL 194.49.94.152:50500 tcp
NL 194.49.94.152:50500 tcp
NL 194.49.94.152:50500 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gm8YK55.exe

MD5 db49775df584d04028c83082753a41e4
SHA1 4c5e66c25845497bbc4181dd5e601cf49ae54830
SHA256 0cc30df7f6ff94fab7858c7361a84798ffe5198fda1df8e7320f4e14124fd535
SHA512 93ddb8d4f97263fc55df13832695ba63692016c840db1bdd629aa0f463e46c97bbf88cdc471423875c87956ffa2b66d6653474970123822e4515f182ff586eaf

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oj6ab41.exe

MD5 4c57105730828c98c61e10949fc25950
SHA1 b018b8964a21ec971d7a8e3480ce28976012374c
SHA256 e3c9a1721d8f0eecf6a7e81b32b9823a4952d636d4930a9cdfae0876cf293d3b
SHA512 ead8b5fc20e1a9f2125f2f7338edc844f80415ef768f02753dcdc51140b811ae2fb60f0d77226418a433746a28c81296f1a8b41333eb6b7c59c9f52f82e1f378

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ll7AZ90.exe

MD5 80766f346a1033b1abfeeabc7180a880
SHA1 2568f835441d53bc785a4ddf8537814826e3d064
SHA256 86a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62
SHA512 029d53c19dd434b410eb61158e8a653c3d3725b50de9e5bb7dd766baed93a37574b3171509ee7e968d18158d89082029e74881630fb852c37b305053ec5c87aa

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qe51ov4.exe

MD5 2554335d1d5d65d601b4d45a6e8aced2
SHA1 db8d862c2eff246f13eb5a676fa15815f66673dd
SHA256 f94b4a944d16a12fe45ec0e2c779607c1418dd789462e40d83dcf190496d4f80
SHA512 a073dc2387ffd84143466136b0fd5c12ccd6a5d0bd67aa6d648d3f3790ee79028edd5d2ed8897437d794674dd46334d6cade72c91a0103d617285f5018c22fcb

Analysis: behavioral21

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:36

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2432 set thread context of 4644 N/A C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe

"C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2432 -ip 2432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 172.217.169.74:443 tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
RU 83.97.73.129:19068 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
RU 83.97.73.129:19068 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
RU 83.97.73.129:19068 tcp
RU 83.97.73.129:19068 tcp
US 8.8.8.8:53 154.141.79.40.in-addr.arpa udp
RU 83.97.73.129:19068 tcp

Files

memory/2432-0-0x00000000004A7000-0x00000000004A8000-memory.dmp

memory/4644-1-0x00000000005D0000-0x0000000000600000-memory.dmp

memory/4644-6-0x000000007441E000-0x000000007441F000-memory.dmp

memory/4644-7-0x0000000004CE0000-0x0000000004CE6000-memory.dmp

memory/4644-8-0x0000000005480000-0x0000000005A98000-memory.dmp

memory/4644-9-0x0000000004F90000-0x000000000509A000-memory.dmp

memory/4644-10-0x0000000004ED0000-0x0000000004EE2000-memory.dmp

memory/4644-11-0x0000000074410000-0x0000000074BC0000-memory.dmp

memory/4644-12-0x0000000004F30000-0x0000000004F6C000-memory.dmp

memory/4644-13-0x00000000050A0000-0x00000000050EC000-memory.dmp

memory/4644-14-0x000000007441E000-0x000000007441F000-memory.dmp

memory/4644-15-0x0000000074410000-0x0000000074BC0000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win7-20240221-en

Max time kernel

121s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe

"C:\Users\Admin\AppData\Local\Temp\00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 120

Network

N/A

Files

memory/2200-0-0x0000000000399000-0x000000000039A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240508-en

Max time kernel

93s

Max time network

98s

Command Line

"C:\Users\Admin\AppData\Local\Temp\00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

ZGRat

rat zgrat

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4772 set thread context of 1836 N/A C:\Users\Admin\AppData\Local\Temp\00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4772 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4772 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4772 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4772 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4772 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4772 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4772 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4772 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe

"C:\Users\Admin\AppData\Local\Temp\00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4772 -ip 4772

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 340

Network

Country Destination Domain Proto
RU 147.45.47.64:11837 tcp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 64.47.45.147.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/1836-0-0x0000000000400000-0x000000000044A000-memory.dmp

memory/4772-1-0x0000000000079000-0x000000000007A000-memory.dmp

memory/1836-2-0x0000000074A7E000-0x0000000074A7F000-memory.dmp

memory/1836-3-0x00000000058D0000-0x0000000005E74000-memory.dmp

memory/1836-4-0x00000000053C0000-0x0000000005452000-memory.dmp

memory/1836-5-0x0000000074A70000-0x0000000075220000-memory.dmp

memory/1836-6-0x0000000005340000-0x000000000534A000-memory.dmp

memory/1836-7-0x00000000069B0000-0x0000000006FC8000-memory.dmp

memory/1836-8-0x00000000064E0000-0x00000000065EA000-memory.dmp

memory/1836-9-0x00000000063F0000-0x0000000006402000-memory.dmp

memory/1836-10-0x0000000006450000-0x000000000648C000-memory.dmp

memory/1836-11-0x0000000006490000-0x00000000064DC000-memory.dmp

memory/1836-12-0x0000000006750000-0x00000000067B6000-memory.dmp

memory/1836-13-0x00000000070D0000-0x0000000007146000-memory.dmp

memory/1836-14-0x0000000006920000-0x000000000693E000-memory.dmp

memory/1836-15-0x00000000074E0000-0x00000000076A2000-memory.dmp

memory/1836-16-0x0000000008A90000-0x0000000008FBC000-memory.dmp

memory/1836-18-0x0000000074A70000-0x0000000075220000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3352e66593f9d652c7f760070d266d43ca2ba74eca75114c78a92c09c1a1c391.exe"

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4RW302QZ.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4RW302QZ.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4RW302QZ.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4RW302QZ.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4RW302QZ.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\3352e66593f9d652c7f760070d266d43ca2ba74eca75114c78a92c09c1a1c391.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4RW302QZ.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4RW302QZ.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Detected potential entity reuse from brand paypal.

phishing paypal

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4RW302QZ.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2804150937-2146708401-419095071-1000\{CEB73C56-42BF-4892-9284-9B048B3723A8} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4RW302QZ.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2124 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\3352e66593f9d652c7f760070d266d43ca2ba74eca75114c78a92c09c1a1c391.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe
PID 2124 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\3352e66593f9d652c7f760070d266d43ca2ba74eca75114c78a92c09c1a1c391.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe
PID 2124 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\3352e66593f9d652c7f760070d266d43ca2ba74eca75114c78a92c09c1a1c391.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe
PID 3476 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3476 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3476 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3476 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4520 wrote to memory of 2108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4520 wrote to memory of 2108 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 1556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 1556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3476 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3476 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4976 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4976 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3476 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3476 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3424 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3424 wrote to memory of 2780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3476 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3476 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 624 wrote to memory of 1416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 624 wrote to memory of 1416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3476 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3476 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1532 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1532 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4356 wrote to memory of 3292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3352e66593f9d652c7f760070d266d43ca2ba74eca75114c78a92c09c1a1c391.exe

"C:\Users\Admin\AppData\Local\Temp\3352e66593f9d652c7f760070d266d43ca2ba74eca75114c78a92c09c1a1c391.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ff8158a46f8,0x7ff8158a4708,0x7ff8158a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff8158a46f8,0x7ff8158a4708,0x7ff8158a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff8158a46f8,0x7ff8158a4708,0x7ff8158a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff8158a46f8,0x7ff8158a4708,0x7ff8158a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff8158a46f8,0x7ff8158a4708,0x7ff8158a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff8158a46f8,0x7ff8158a4708,0x7ff8158a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,2324685745492812289,13397812097380634376,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,2324685745492812289,13397812097380634376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff8158a46f8,0x7ff8158a4708,0x7ff8158a4718

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,15657674903220835292,18321805140949659594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,8752252705668802705,8006243621725047067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff8158a46f8,0x7ff8158a4708,0x7ff8158a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1980 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff8158a46f8,0x7ff8158a4708,0x7ff8158a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4RW302QZ.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4RW302QZ.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5960 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4804 /prefetch:8

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7196 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7196 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7408 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7328 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7796 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7989842082571147534,5890851418705836945,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5160 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 steamcommunity.com udp
FR 185.60.219.35:443 www.facebook.com tcp
US 8.8.8.8:53 accounts.google.com udp
BE 104.68.92.92:443 steamcommunity.com tcp
US 8.8.8.8:53 www.epicgames.com udp
IE 209.85.203.84:443 accounts.google.com tcp
US 8.8.8.8:53 store.steampowered.com udp
US 104.18.20.94:443 www.epicgames.com tcp
US 8.8.8.8:53 www.paypal.com udp
BE 2.21.16.71:443 store.steampowered.com tcp
US 8.8.8.8:53 twitter.com udp
US 151.101.1.21:443 www.paypal.com tcp
US 104.244.42.129:443 twitter.com tcp
US 8.8.8.8:53 www.youtube.com udp
GB 172.217.16.238:443 www.youtube.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 2.18.190.81:80 apps.identrust.com tcp
US 8.8.8.8:53 35.219.60.185.in-addr.arpa udp
US 8.8.8.8:53 92.92.68.104.in-addr.arpa udp
US 8.8.8.8:53 84.203.85.209.in-addr.arpa udp
US 8.8.8.8:53 94.20.18.104.in-addr.arpa udp
US 8.8.8.8:53 71.16.21.2.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 129.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 www.linkedin.com udp
GB 172.217.16.238:443 www.youtube.com tcp
IE 209.85.203.84:443 accounts.google.com udp
US 13.107.42.14:443 www.linkedin.com tcp
US 8.8.8.8:53 static.licdn.com udp
FR 152.199.21.118:443 static.licdn.com tcp
FR 152.199.21.118:443 static.licdn.com tcp
FR 152.199.21.118:443 static.licdn.com tcp
FR 152.199.21.118:443 static.licdn.com tcp
FR 152.199.21.118:443 static.licdn.com tcp
FR 152.199.21.118:443 static.licdn.com tcp
US 8.8.8.8:53 81.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 14.42.107.13.in-addr.arpa udp
US 8.8.8.8:53 118.21.199.152.in-addr.arpa udp
GB 172.217.16.238:443 www.youtube.com udp
US 8.8.8.8:53 abs.twimg.com udp
US 8.8.8.8:53 api.twitter.com udp
US 152.199.21.141:443 abs.twimg.com tcp
US 104.244.42.130:443 api.twitter.com tcp
US 8.8.8.8:53 pbs.twimg.com udp
US 8.8.8.8:53 api.x.com udp
US 8.8.8.8:53 t.co udp
US 152.199.21.141:443 abs.twimg.com tcp
US 104.244.42.69:443 t.co tcp
US 8.8.8.8:53 video.twimg.com udp
US 104.244.42.2:443 api.x.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 i.ytimg.com udp
NL 192.229.233.50:443 pbs.twimg.com tcp
GB 172.217.169.22:443 i.ytimg.com tcp
SE 192.229.220.133:443 video.twimg.com tcp
US 8.8.8.8:53 ponf.linkedin.com udp
US 144.2.9.1:443 ponf.linkedin.com tcp
US 8.8.8.8:53 platform.linkedin.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 stun.l.google.com udp
US 152.199.22.144:443 platform.linkedin.com tcp
US 74.125.250.129:19302 stun.l.google.com udp
US 74.125.250.129:19302 stun.l.google.com udp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 130.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 69.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 2.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 50.233.229.192.in-addr.arpa udp
US 8.8.8.8:53 22.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 133.220.229.192.in-addr.arpa udp
US 8.8.8.8:53 1.9.2.144.in-addr.arpa udp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 144.22.199.152.in-addr.arpa udp
NL 91.92.249.253:50500 tcp
US 8.8.8.8:53 community.cloudflare.steamstatic.com udp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 8.8.8.8:53 store.cloudflare.steamstatic.com udp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
AT 13.32.110.116:443 static-assets-prod.unrealengine.com tcp
AT 13.32.110.116:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 151.145.64.172.in-addr.arpa udp
US 8.8.8.8:53 69.110.32.13.in-addr.arpa udp
US 8.8.8.8:53 116.110.32.13.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 tracking.epicgames.com udp
GB 142.250.187.206:443 play.google.com tcp
US 3.209.28.102:443 tracking.epicgames.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
GB 142.250.187.206:443 play.google.com udp
US 8.8.8.8:53 www.paypalobjects.com udp
SE 192.229.221.25:443 www.paypalobjects.com tcp
SE 192.229.221.25:443 www.paypalobjects.com tcp
SE 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 206.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 102.28.209.3.in-addr.arpa udp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
SE 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 facebook.com udp
GB 163.70.151.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
GB 163.70.151.35:443 fbcdn.net tcp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 www.recaptcha.net udp
GB 142.250.178.3:443 www.recaptcha.net tcp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 c.paypal.com udp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
GB 142.250.178.3:443 www.recaptcha.net udp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 t.paypal.com udp
US 151.101.1.35:443 t.paypal.com tcp
US 8.8.8.8:53 3.178.250.142.in-addr.arpa udp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 b.stats.paypal.com udp
US 8.8.8.8:53 c6.paypal.com udp
GB 34.147.177.40:443 b.stats.paypal.com tcp
US 8.8.8.8:53 lhr.stats.paypal.com udp
GB 34.147.177.40:443 lhr.stats.paypal.com tcp
GB 142.250.178.4:443 www.google.com udp
US 8.8.8.8:53 35.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 40.177.147.34.in-addr.arpa udp
US 8.8.8.8:53 login.steampowered.com udp
BE 104.68.92.92:443 login.steampowered.com tcp
US 8.8.8.8:53 api.steampowered.com udp
BE 104.68.92.92:443 api.steampowered.com tcp
US 8.8.8.8:53 sentry.io udp
US 35.186.247.156:443 sentry.io tcp
US 104.244.42.130:443 api.twitter.com tcp
US 8.8.8.8:53 156.247.186.35.in-addr.arpa udp
AT 13.32.110.116:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 talon-website-prod.ecosec.on.epicgames.com udp
US 104.18.22.33:443 talon-website-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 talon-service-prod.ecosec.on.epicgames.com udp
US 104.18.22.33:443 talon-service-prod.ecosec.on.epicgames.com tcp
GB 142.250.187.206:443 play.google.com udp
US 104.18.22.33:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 33.22.18.104.in-addr.arpa udp
US 8.8.8.8:53 js.hcaptcha.com udp
US 104.18.124.91:443 js.hcaptcha.com tcp
US 8.8.8.8:53 newassets.hcaptcha.com udp
US 8.8.8.8:53 91.124.18.104.in-addr.arpa udp
US 8.8.8.8:53 api2.hcaptcha.com udp
US 35.186.247.156:443 sentry.io udp
GB 142.250.178.4:443 www.google.com udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
GB 142.250.187.206:443 play.google.com udp
US 8.8.8.8:53 youtube.com udp
GB 216.58.204.78:443 youtube.com tcp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 172.217.169.10:443 jnn-pa.googleapis.com tcp
GB 172.217.169.10:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 10.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
GB 142.250.187.206:443 play.google.com udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gF56yj1.exe

MD5 844cb574f00d9650743fe152f15bdda4
SHA1 0f886091e071224f6d116d18e56b6d6a62c7c37c
SHA256 b17a4d8942992601fc3dd38d19809bc4513dde714ba8e5583940186befdc7dd0
SHA512 54d71e57a8b09a951f3871410decd7dd7087fb94f38023343a5e677cf46f9c240fad79bd3f4034f3653cc5a8d6c2306c2f89f8767a414c02a1cb3f259412357c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

\??\pipe\LOCAL\crashpad_4356_KGSVWVHKRLTXQJKI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4799f9739469d27d67154d84ed90e902
SHA1 d502b4da5a45930b36f541cd09287a0fdf3b7178
SHA256 4828e15fef373b76fd0ff95f959ef3dad6d116902d75baee852e181fddd396db
SHA512 c876f020fdda714aa303f1092b84e242782925868663c9b37fb190e7b23102122819122253755d34711d5d5b9b5454a6dd39fc00409cc5b9674dc194fc5855a4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5e41c3264f665653f7ae198b23d84e4b
SHA1 e2f8ee7258b836d8a337115bdaf31d75fab4135b
SHA256 e7a283ab36c164705dd7d85842dcc8d919c50267733ce9ec2b2dbd804d10acf2
SHA512 9f66e423ecabd96ef8bc6f523de42b8b02d13cbb76d5acac28a47fac6aafcdd893dc4dec9f1104038a4b8e6b5a510855716898ba2dc4ee5c33917738cfd33f94

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4RW302QZ.exe

MD5 da044811ca4ac1cc04b14153dccbbf37
SHA1 6495d9b495010f8c79116e519a8784e342141b8a
SHA256 7c31979024f0d5873af50e66b541135b095a0958d7c0203e01f366cfb2a8d1b8
SHA512 0352129b629768f0192f58e43ac097758f3aae0236de363638ce14a994bdb0f17e31882f6ae7a93643222f542ffb21cf492d3c18dbaf6ec5822c45a8c2ce33d5

memory/5896-117-0x0000000000450000-0x0000000000B2A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 fdfa7f54a482c30f99c179dd7b454cb9
SHA1 02bb7a7180d0e134f724863be6e565ffcb7e3974
SHA256 db304cb5dc6b4ef059df746f5777e855db56c9316508372d47d31a74791fdce1
SHA512 e9fe3cf2ab82b64cc323b217283f107c764a1a7f2dceb62a1cc90d957c287bb8b99de9385cb147732604ebd6b16e5ee83d4701bb0bb5c21a11a6eec40d597483

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 90b015301ef1a0ec9c986c32755cbe85
SHA1 8aec88bfb78976c08cf00bd9f781b05c52cc6f85
SHA256 70cfe2af597be851d0cc7b066525765be0c13bbcc5756302d768130dbc063060
SHA512 17d1cb0fccda311c4ccb36cc11bf1ab7573438f7b45c3160d5886cfd6fabfa490fa19657ab2f7b22d9efc8eb5990d7f9f43e71a3827112b36cdc34ca06af2c6e

memory/5896-141-0x0000000000450000-0x0000000000B2A000-memory.dmp

memory/5896-162-0x00000000078D0000-0x0000000007946000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 65c8674119610285ea1b1b64a2bea040
SHA1 a8b8894e12b6773753aa80e31e50fc0b7743cb7b
SHA256 915c993794ec853de6d0688464600305ac2ebaf93e8245d73bbb547e4d69fd34
SHA512 ddf3ac332d6e30d078e49849bc0b9fba2755e246a57c2f84e6b83c4abc3953a8ce54b9ad6e3c05082bb81e3b827aaef60a2c6bf7b33a50ebd811043df16b35ce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

MD5 585ac11a4e8628c13c32de68f89f98d6
SHA1 bcea01f9deb8d6711088cb5c344ebd57997839db
SHA256 d692f27c385520c3b4078c35d78cdf154c424d09421dece6de73708659c7e2a6
SHA512 76d2ed3f41df567fe4d04060d9871684244764fc59b81cd574a521bb013a6d61955a6aedf390a1701e3bfc24f82d92fd062ca9e461086f762a3087c142211c19

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0e2a6c6d67841156ea031e161203d9a3
SHA1 ea6d6e19f585f2818046adbe7daaec8fd2b85157
SHA256 7c23a003f117f78828e1bf9290af8538c5273b93db1fbe80f062c2e71e4fc224
SHA512 e221ade6b180b34dd63f2ab33055f2d938e93830f1d80de4beb7cbc9d2606ce695342e906dfd259bda32788ee4f3d67ba81cee0939de0eee72a950b3e2c96304

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\MANIFEST-000001

MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_twitter.com_0.indexeddb.leveldb\000001.dbtmp

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe57825f.TMP

MD5 20bda6bbdb6898ead610af616e314988
SHA1 a0aa5bb8fea2288321fe16a21e9a747ff2fa46c1
SHA256 554f7bca0a9ec0711ff91541120718f424bcef8c42e2194a51101a671499463a
SHA512 d02dc2c18ea875e8a528648d049f329bf4349d1b9a5b6e5d1d6b74ee0bbd1f51d0654650a6eb9f6b7857a5942076fea11e44579446568956064594bd5b33a3bf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 83ac0f12e8e428535efe6ea774b8601b
SHA1 3221165c38790508dcaf7326977d4b7c52417e89
SHA256 57ba9dd94eceedac4f5f4e2ee5073251435fb9e65aac27316e416a14fe74ea8e
SHA512 e62c4b0aeef047db7ee7653e62ffdb81a0065c724dac07690a0470f06bb986bc23695a9eadd30fb2520a9cd7d39d46d5e0616373910987117f39d8ba4f2861a9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 d5fe793b27aeb9fd546007e12da481bb
SHA1 d83ea25e2621c3b11bf7f9232ed586ea2a8c8a8a
SHA256 225cc304a664ded225ca500e943d30d30dbe9d6a614b7a4b8c840ab826e7f793
SHA512 f9f69d2125cf7fa5c29cf4756e253ced9b1bb55be4d1e090422ac3353edb122eb1647405c99297e39b4c5d8a50118d9057f600bafbea30bab3d722549aea27a8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 a0768a37277e731958eb2249e29af429
SHA1 afb5aae331e20122e7731a7680b0b11fe4bbf580
SHA256 b84d961a1114ea4e71d16b675e7c36c773ae40c8e3af94f31370be143b3213aa
SHA512 bbc1489ab8bc915df9633623f1cedadb3b226ec61a281bfbb7838884e3227747f405f8e4e305bfb7783e74af913384f2ea481c85b7325bf8d6670791a84f06b1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 706aaa9cee34ead7df97364e33f09f47
SHA1 ac2dca7eeaf4a0f3d0ff941134449765edadb93d
SHA256 013752440755780681707f632214563d01e4b52fe0d2500fb3c9569648001042
SHA512 d5a960ea23b988ebfefebc7771bf9328574585e7898b808596ece3d30c344288e422e62b7a214a3bef270ed62455ccd950c668557c761c5e83877411cb29346e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 5321f4a17af48deae4c11b15941ff15d
SHA1 e1ab5245d1a11889d0445536e7c042d80c22c90e
SHA256 5370ea584a5b094e65f1a285c43d8446865af159f9cb191c0474ae8be16901d9
SHA512 a0e6c8bfdd031fe53d816e41e7455518693edccd66b65a7c1896fd0c5118b711a38058243f209b4b1a9d6d4d9fba227a56b05a62a532476ac575f1df97aeb6cd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 0ebe7291954c375a0bd728b76e06a77a
SHA1 84c918ba0fb000a152f1795d230b324724fe675b
SHA256 e30e91dc396e51235b0a0d9566e5afddd6c0cb449b80770954fcb80755522021
SHA512 b2cff1b4cdcdc099792e70faf80332701b963891b3bcdfffde578f1f5663fe6b75e7d02b93101be9b03930ca2cc8edef9bc8911d68776efcac5d4cd5581bebaf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579dc6.TMP

MD5 97b72a19af696c6fc6fd29599e277321
SHA1 308ea5711900c4e0f030ba178b3a71e98ad85767
SHA256 c7a8b846186e9307afe7ee88cae85c03f2faeea42c588da7e2fb63ebf17c30d6
SHA512 3ddcb7f78a4c39032cca6375a3be710a2a8039760eda014198af2c708f958a76acd75774583239cc9abd051aad958e89a02797eaeaf0d04d1bc8c8f877a3f56f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 e2a4612a4e98c69ebcd35b2199ed1909
SHA1 ee5549d3e695f421e07f68558742a781e1538b5a
SHA256 3c5b1f92bb40348df8f1b2a5499559eccba4082f526be650fb4995e23334ef65
SHA512 cec1360521d7bf6aa2b3233aa4884831144acc11db17b294f25dc26d2ee956fcedbd6eefd4d5fc253c13bb8133466853cbaa530bca9694ed2587c288dae5782f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 605d95ada17e0e4e859151e75e809f83
SHA1 24ba4759fda5cd2f36142e54cee7dcbcb8a6c3a5
SHA256 9769f23c33df2a05a34af0090bafd67e6b6288ee4ccfcda371c56ede38998861
SHA512 653fa5b264cb554d25be9eebf774eed16cf642075708cf0becbc690408a245659deb9c0f142f7709aba9e6241a6e4233c8b476f2770630d36bce3049448c65a9

memory/5896-778-0x0000000000450000-0x0000000000B2A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 23f9c51cc529e3aaa52f42fde3b2072e
SHA1 c7f28eb1c8259cb52cf7ff6e883fe9369e685797
SHA256 8c250be46770d26748c758bd890415b59c7f36e0b22d5c5183b8c6a06641bd78
SHA512 3b0010a1ae6c72114209cf0654f80cf783a29f0a0018752c08e7fd6d138b9aa2a8b18b19e2fa4f0b56903ca8caa6c150c65e9c97833267a1542dd51c19431207

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 88a5cf3652d33c3cc50c8009b262551a
SHA1 fdca8dd9eb4ca33beccfc285193e175116acc4f6
SHA256 757762321c1c52aa2fb0a8e5705c40828d69fa64805c22f24fa7052160595e68
SHA512 e074a8e109a3efa25b760b862749edcb499176cae7118c824c59a8ad52fb96805fe7ee5c68a9d44d6e64ba44505c87a2d35099ff02f6678c556cbed3503adf1c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 9b5078f16e7180f51e6057afb17abaf0
SHA1 f5f3469c4f81abf1fb7a071aaa84ee75906b89c3
SHA256 77055b05081ae32b557bfd3b4ac2ddaaa4c3145d1db7dc6bc19a243ad887740a
SHA512 5fd8b2094531a3e811beb912149e3a6751ab56f2914a270fc5248d17a283a346a5714774f962cf5c7c004bd5fa00d4a65215af386ec8ce1badef463755eacfdd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 39ee354717eb24cdfb91e0bb43805f58
SHA1 2ccd5f11322f61a60cf847950dda49c8c0184135
SHA256 d184240d4dcce0da714306db0d74dde53d18c126034df2339bc7820281e305be
SHA512 a0a7bda6b9de9331b78a8b81c7b9aa3f1d97c5a95bd6e549599e2a0d09ea6873f48837a7798980f945c749048cf5e98f5eacfe56361260315ef048cb327bcf1d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 1069fd308151c925c1339b232a7f0b78
SHA1 0d994360e325e7de492b85b7edd9478d96d5505c
SHA256 351290248fd979f0b3e4cf7d203922507bc22dc6fe2fbf174ab4211185b71f53
SHA512 e51df0f3af517ef206c48fbe85f6ae9d9d45dec670e87f42e4ee2f37b9093aafd669314c1080559d1055540acc7e16865948bad708dad0330cd8d84077e7f384

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 99ed4b210c65c5d79c0723ee1e5c357c
SHA1 70a69e19cba93a0cc2f70f4cf31e43df53981d63
SHA256 c306397c3b51fb5102ca1850aa1dfb0f8b937cd84e9cb5b06da0d5367ac9e7b4
SHA512 a8ed4146eb0afe66549faa0da30987f33244963ead2c763d8df2fc90b5e2c1a106df843d592738678368b352b010a39fffa793688cb981a210b3d15872d44b11

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 dec2e5fafc01dd11a42f109fbb45d340
SHA1 6d07a8fd88129b993e1fa3611176bd830f7f4363
SHA256 066b5df9bc424758fe31fa3b13d216945a29569e4fb85ea32087d9899aa39c1f
SHA512 138cc6410aef673e83471e9daba6c122082c2772c2550a48e86dd99f4b6eafc3c7cb1e96f8218060ed80dd6b779c6e6561289276c8cab8fe8311657457fa11e2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57fbb5.TMP

MD5 6274e8a1a040cc89d471c1e7d3803db6
SHA1 97431ea4244cd64fc40de1467d7916682374be2d
SHA256 f114fda237eff3773801cf2f394be1214387d836fb71844905759ec1b8b591e1
SHA512 079acffeb05f5019628673b5c9f6f88adf9880eeb495f44b37e3a78bad8087588bc7cd20940da8cc1e42df069ffa5e48b3d3dea560cc7214ac81266dda4beefd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 3c7900af436dbf2cb81bbf6143d21bba
SHA1 555e3d7c7b9342281a0ac1c767f68a5aeae7a7da
SHA256 7a19b2aeedec869e4c8ce2a92ae6dcf33dee130394e7dc530a3450e640fa7521
SHA512 037262f2faed6e0a89c6f56889492946054154ea0ebade29c93467f0365d50ed483a7073ae40a64bec3239613fbfbfb98a1ff0969951ecefe0f61f13aafa518c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 5e74ec963a8d6b3c47937af32485a7c1
SHA1 c8b5c5fc03d43afcc6816665948bd611d32d550b
SHA256 ec1a3585f0d061b8edd8d3514abd15558cb7fa3abf40bbc304808dc7fe46e6f2
SHA512 06d6a2427c5ecc6431c72dc9ad72d1c2169b66750cdc24102b13e4ff81bec69a543e0356d1c77b1862653d7e39308c17bb1db9516ae297457146e3481f36c1c4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 3e24b0f123ef1c2099952cd477e9e638
SHA1 1863c73dea36921fa0c6144545bc8152d908583c
SHA256 f7863cbfcf777735345211f3e4ff1d12c1b816bbb0840332f5b9722f6310670c
SHA512 129cafa8491f13be6d8a991db3a094a153f004b3cfc212b99d1ca3edf4136f0bbe6c05438b0044317550382a1691549b3dcc682d3126764320d62e2db3b87cbf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 8390a7652750fd7728da964c97182eb7
SHA1 d1c1de6eef3d265670c54b8390a239e65d661b86
SHA256 283e9add6e335ed307bb2998fc0595385e4795075b92b6d5fc51e0b77aa06251
SHA512 08c2c7a9e58b63bcb4b503085c6907f594cdf6bf62982f31b49961b124123734c696a58c1e5054acb9ca9a0f1156e659ddbaaa9273153e62b010baa73ef7f474

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 40e93e84ce0695749e584cb3c2f2297d
SHA1 7e65484d3b40d3bfaa6f81f6e8b06942cd5bafa2
SHA256 8ff3183ab8149dcdb09c17b8148db11f3b410361d7e7c6ee7885d42940a38aa6
SHA512 84b7bca540ff90d5af0fd8b79d026d91992bc371d2c6b614281d5185cd182baf83057e0ea65d04664bd09010cbc5cfc267285aee217fcd84748b412fab873ac3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 2ac65ede2ea0d900d8bbc6c4371f426c
SHA1 a1e15237069fb5aa090e9ba57e5c1965a86c571f
SHA256 d5759d1d1626efe5108c1ffd4f5f469656d64384a14ba39b083197909c6f216c
SHA512 dc7a81fb122ab25926f83548a13ac591370dae0a1274ea6d2278b8e4a1a60b08660d7b7a265a6ab523bb0691865b6cf1ed2e0c2bcffb773a22a5f446a8302e77

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 6e6b132f494664cf5f92d3a72eb19bd5
SHA1 06a9e185c26b8af2944f423d81eb278df1fe3581
SHA256 53aacea47a3b8c1ded6f40db5cbde2e8092383a09c3c9e3f57748dc6368d01f5
SHA512 466add7db4de969cb91d391b902d075878ec6c3039082f5ac74a42d89c5a40ca215519f11045ee1b68bfbc2b193b5c4f95581aa619990c4762fa76fb5271b0b5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 d72b639cf523081eac91cf7bd7a6f0f0
SHA1 c7286592aaf96a0d3fbe8ba49e603c18e549776e
SHA256 ce241204a8245e97cd13e166bd79fded01970819a22c5b274e0a2b3a77e0b833
SHA512 164ac22bd6841972dc3cc652f4a7858dcf1771b629ec29eef57a7bf71d93f22bfa3f6cf8c038982a05eaa5dca48a64e646c68d8c72696c78ff153889398fad5a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 376d29f7ccbf7b7bd2abcc2f8aba0fde
SHA1 3644fc0ec38fe6e825bd74a077e68b5508738811
SHA256 bd9323d3044946fefdcf0751b45f76353dbe159b42e35c61d59ccfe705560ef7
SHA512 153ff9ad83c6c2b484cb21133462b7e614c1bf67c8ee6d2a19fce8799491ca1b5c1eb0f704efcba1af7223d6281121e169e21e1d43e4e6fc57e1c4c4b6fbaf32

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 258132cdb0fb76be1b6971747d41d28d
SHA1 1ce769ab2142b46511ac7cb19adaff9c2c7e10cf
SHA256 8e9777e2de577eef1db50e55f2b4a41767a8e407216af7c06b532e4a36164da2
SHA512 ad5f6e78457b98590c739d9889a9944c4660fddb29232ff077ac7e8eebbdce1215460b519b0ef8399b291e3aa7bf7aff26ef48a6ea15d3d96edd39d3c22efef4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 e57fe178fe4b7734cc621d647f52b774
SHA1 c11b774c015ccb562d2038dfec90bc29e8842eee
SHA256 68cc4209323904f71814fbd04e73432d4466534a3eba99db31fdb6830a84a696
SHA512 50af6745d084d95657e81d91a1b84dc929463e284ce011e1f419b033c49b05082bf5d81dc457704f2cfe4736f529d107347ed517a152aa53a8e937c77c77f419

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9e5d38e2fdd0ec9159ac727445db853b
SHA1 2ec855d86f2fa549bd71106ce17e20fa1d41206b
SHA256 c7173d70aa1d6855c6da9f3fca14126153f4efd5da51963a066130dc3b92e30c
SHA512 babe9277192c1cacd9e4062eb9e1d2368723a25f140a23c3a568cb37a5402b36e4628488bc068baf691775c556bc958281ba5405cd22d6af9ef43e0aa43853d6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 4bd9e79ec556cf4fa50ed96de4f303a2
SHA1 2ad9df85d224b5e37a8eff151736a13d29765811
SHA256 9389b547bae0ab044003b40be11d752f64b11e3e2af0026c377ce3465e3a28de
SHA512 f50ba5245029e604b9c03cd01ab2acd0a2f10c4643d741424b247a2ee8af80c885ba3bfba7e5d306cace7422e6940d53916af5f6cc37fb96aa8720a41e4d1d3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 64ee16a47d313b0e257fbe0d27c239a3
SHA1 dc5019f9ece0b674df9a7eff48f7b9944160636e
SHA256 e85e25250bef265c09633ef8aeac27ebb1d73402106f56e2a8356e325c6e0832
SHA512 063537782d5b2db247a89a35c6290c64aa4fbb563fe45c6ed77cc1a7edade849b8d813b39045994180213ca5091f56178bc76856efde5541eafe0864d6b3db2c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 b7c244ff4c7e74687175fde97bc2c7b6
SHA1 6d89c75a8dbe5ab2c44ce0a03aa8cccdad767dc4
SHA256 c79dd131117a45352c5e279bd32a37650359c60fa060be32d6b652a11f5ab7f2
SHA512 a8674daa6b3de86e7aa481002d1061740f330a06224354fe2e944ed3c2c7d81825775e19854dbf54353fba85c3d887b764d4d2000c672de77ca9c323bb74a206

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 958063724fc6a8758c5a420f655ace3c
SHA1 e2f0f275e4e77e6ea53125a8efe16974fbae3906
SHA256 77aeb263a8da6095d817a441babf07f432386915d6324901bf5dff874d4a37c0
SHA512 ae0687a6742b8c8c9e69d15c80d95ee133f8147c5014077cd3ab81633aa0f374df36d96f24e1a99317c77d7dfd20878dfa5360b1e57aaa8facd515cd8aeea24c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 5553e463166be4a8e37e84552d8121df
SHA1 5a0c769a82c3d27a49c5ffc82cdd90b68038d38a
SHA256 f0a8795c9ee1046b46ace093f4e25234ded9765e1472782056ca6d069414a799
SHA512 30bee3d0215489b53d344151458d6f9e472cd8284d1a9242d2f36f098b1b29205ac8e9ee111f5d8cdf43eef53c7be620d070f90a77a2e72ae4f7da847827cd9d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 83223a0dc6dbc18f373d46bcb86322f9
SHA1 3e84249594e300cee43b5ec54bc8c1d7d1a22c5f
SHA256 916aa9878bf7f52571732296f35e8d0f9fdba5d36d8946395622136b1168ac05
SHA512 e58cc5c2e7287cb3b78ca4b421d96baad4c67af856ccf0702317d68fdf12d874334e2a9c2ce6b2ecef974343e9a0327618f63b604a60ac598dd9a0391d19733b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 1769e9e24550dd71b34aa4b4a375e265
SHA1 15d80ae19b3d94e8a9fba297efe0d794e0a04401
SHA256 d9d6fb8fe6ac0500387b6bd79b716df9e299779aa9f46cf2f1a8caac89522913
SHA512 47303cd135237150e07a5c7019f9d259c659459de62bc0697179e4e9b9b23c77a3090cb27764b6166b9539cc72ee8fedd70295c658cb14834d6e7b5ee4e2ef44

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 514f14d7c81f259872e3dda3405a67a8
SHA1 f3460c74ae7bce838603718aa1265ea24c047137
SHA256 accbc0bae5da8cbf8bdca3fdc89c827ea4773de3c213f669275b2ae47c431d4a
SHA512 f550b768a16e4ac8f6309046d5316b46f347c568177e4c4c51007694909b3ffe4dfcbaa3fbf25f4c47ec1c58e55ef376adf9cb706c0a866b1678c2919e17f602

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 d519ba62cf899a1a223fc892989df8fe
SHA1 810cb911eb6ee1c538e4529a0a4dfab4242c80cb
SHA256 5bcb5219a6e4f136effb29811b06acef5b3c5832d05c67aad64c348ba6118b9f
SHA512 108c2e516833464b6e2b800e54bae880726de81d0826ec24c2672929d18d523fee7e26499a842d9d46d0b2bfcde01457077d152e7c27a9c38a8690c1fa9bd06a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 c5514289b97882590a9d302ebb673640
SHA1 003278002a94b5e49b3d42a5b82b9d39757b98af
SHA256 208101721fa42365c26a9783bff4d97e95e9a7f396d7efeced25550054ae6d5d
SHA512 ec68181b267fd85030a88f4ddc50bf10f45f31aa7e6507342b0c62139087e56be1036fc615596cefa1584a679abc5e204048a34d6447afaa24b81ee01c361b45

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 710df6fe3917ca27ca4ebe4ad500e638
SHA1 9c7d1c515294eb06e5b0a66f4bc2e44b1c2fe876
SHA256 e7add9fb7c38e83e2019f9ff259b04a1537ef474c1634fd14e0bae8a3a991ccb
SHA512 47ef8e6a12bad9b78f0579c30cd7eaefcbf4259c18591bfa402984cf60f050fa3c9587b8b58690378a6efec0f7b7b96a598910e48cc3cafa365c29496bad74cf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 f58629a49b8d52933b2a336c5d7c75fc
SHA1 5d154a812128139089b3b0c844fa846402c051ef
SHA256 53bcb766980130adc99a74db9b4f3e5f1524e7da5e2122996109153ca283e311
SHA512 0973eed00d68b215646bc108caca11e6da03b5298c20a0713f56d707e2f3f5549967c5938ccc440cf972482db3e2f122415de91c78fd75d76a10061cbfe0f759

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 55c1ff055f4b9b9181df4d79747d86eb
SHA1 1d01d8f154317c293f7374e7b79b8a3dd46aad54
SHA256 5aa22aa54267db685d1d9e98fc745404b54e7373ecab51aff2f9434e321e06dd
SHA512 7aa9c77cb8c8eedffcc48a43919f7cab93b100c40f2b656c399432bcbad46bb0e02b1e5c7a9cf10a576b1434077a8e4d5e5d8bff4cd82e8f21f8b6ff59075a69

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 c46d54bb2336195b6f053cda8c328618
SHA1 6f566ee3d54f47e0360582c1ee20d22e2c136019
SHA256 205865f3fc8e33abb6842743084bd8ea94837ac91e312fd233e777d9d545d8f9
SHA512 91906eed0cac8c99b9d8471309c65cded3015b8aff8f8d3227ccc19e1294f3b518342280c11a0da7eaff04d8e3e2bea84c0b1e5837cd7a03627aae324ed97e5f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 980c115cc4f4479b491ce7403ca4de81
SHA1 dba5cf5b93b7f3ceca2ee750ab48ba55c0d096ce
SHA256 b5eb4dabbf928d4f866f1ded8b5d4339ad07276532aea1766b93771420528895
SHA512 1cc2b703c6013fa85cce62689f82d92c88abeb52c9bda1c72deccfdd970f58db85dc99fe42e19bb89208cb37b5901d13d2f953ef010ba74b685c96a413f112f8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG

MD5 1662b9abf3c725c8eed28b6142850fa0
SHA1 a74ffbae502eaf546cbb2212f8a29817cd3640d9
SHA256 152dbe488b86aa08aa6f0057326d37d214698deb6e7352be784ecfd805605816
SHA512 aafd4f65c14715782d452e98ad65ee324f64005887eaca13a030130af3d4b987dadcd8c690aadaff90ca6cd2cc3f8d40eb74482f9bbd3c7faed03819ad55f076

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG

MD5 628163c102651506bbdf60486ec22efa
SHA1 7ed760a8dc18418bb44eee6231fe94870c9fe866
SHA256 f5e8d8cb7e69a35e0c1f19f4dcfd4fb80d8d39988c4c945ab09a121f622ad826
SHA512 9024015ec953890de5700db2912b38d0ced83317aca6423d079f64c39315c21a7754921ab0334b54d06133bbf6dd9b7ea1dffc74b1fdf3ca03e44ec53786903a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 9a1b7984225de6c1d57ad821183b1e04
SHA1 b337ba17cb45e557748bca5dcb1261bb8b44976c
SHA256 17695ebfaef25901287a5355af8268dfe1fb26f056179871763b9284d1e215b7
SHA512 bbc90082de6563d61c42a95c8e10053f53e0af999863ba62bbda6ea2a70a063b9923c2eb3d912c528ef2c2c2c53397a73a817ab21b6417f76bf91e74f422f3e8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a04485e89b798b6f473c2816b1614342
SHA1 f6ea130f64d1af3171b83cc6c490b86225161511
SHA256 8cd791f096d3372091f32e6d3dfbbaf58e40ef63efa6d77b99f8aa515b7e36e9
SHA512 30eead41363e1039124ab89edd453616812808dfcbcb3c35bef4de5612f1022322da2ca505964e7974dc5aced1dfcac3080aec5545a44d34cc6d067e96b6f0d0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 faa2c31f51c35303b3945201b650457d
SHA1 6ab7a22704a7ea07c4a3e20908b5d745be5a8fe2
SHA256 7c5bad6d491391ac6cdc7d2052add4604036664a6279e5aa705d12a6e1a11542
SHA512 7d50e0cc8cab6502eb7fd68c2ff9714e9b37e48ec0183cab5daff575837425047d70105da2af6ef9455a5c3b04b276d04dd8bd947cf407d43df7ce03d02e4b6c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 c40a005f38c64541291c33ac23456615
SHA1 53c8b46cfc11bc9f1e032fc595746b21e291e2dd
SHA256 c9fbf94d090cb431bf7b931a70925d824d5d80a128b7a015be80cf4d44f78831
SHA512 289a661b5a1cc3688c658656cae0368781fe6e0874a3d775e78937557bfc60edbb3bb325eb2c4ae03af61839cc65f24802648027cc7f0ebe9f75c159c43ac9fc

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240426-en

Max time kernel

142s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5c4e8c59ce4b4f21acc7d26ba988d8f069d256569e9565b33d865a9859a5ba96.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1631989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1631989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1631989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1631989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1631989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1631989.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0751866.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1631989.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\5c4e8c59ce4b4f21acc7d26ba988d8f069d256569e9565b33d865a9859a5ba96.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2999802.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1631989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1631989.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1631989.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4112 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\5c4e8c59ce4b4f21acc7d26ba988d8f069d256569e9565b33d865a9859a5ba96.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2999802.exe
PID 4112 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\5c4e8c59ce4b4f21acc7d26ba988d8f069d256569e9565b33d865a9859a5ba96.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2999802.exe
PID 4112 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\5c4e8c59ce4b4f21acc7d26ba988d8f069d256569e9565b33d865a9859a5ba96.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2999802.exe
PID 1580 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2999802.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1631989.exe
PID 1580 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2999802.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1631989.exe
PID 1580 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2999802.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0751866.exe
PID 1580 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2999802.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0751866.exe
PID 1580 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2999802.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0751866.exe
PID 4560 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0751866.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4560 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0751866.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4560 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0751866.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4112 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\5c4e8c59ce4b4f21acc7d26ba988d8f069d256569e9565b33d865a9859a5ba96.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1385211.exe
PID 4112 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\5c4e8c59ce4b4f21acc7d26ba988d8f069d256569e9565b33d865a9859a5ba96.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1385211.exe
PID 4112 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\5c4e8c59ce4b4f21acc7d26ba988d8f069d256569e9565b33d865a9859a5ba96.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1385211.exe
PID 4568 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4568 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4568 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4568 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4568 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4568 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4744 wrote to memory of 684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4744 wrote to memory of 684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4744 wrote to memory of 684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4744 wrote to memory of 4664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4744 wrote to memory of 4664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4744 wrote to memory of 4664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4744 wrote to memory of 3400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4744 wrote to memory of 3400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4744 wrote to memory of 3400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4744 wrote to memory of 5036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4744 wrote to memory of 5036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4744 wrote to memory of 5036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4744 wrote to memory of 3504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4744 wrote to memory of 3504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4744 wrote to memory of 3504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4744 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4744 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4744 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5c4e8c59ce4b4f21acc7d26ba988d8f069d256569e9565b33d865a9859a5ba96.exe

"C:\Users\Admin\AppData\Local\Temp\5c4e8c59ce4b4f21acc7d26ba988d8f069d256569e9565b33d865a9859a5ba96.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2999802.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2999802.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1631989.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1631989.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0751866.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0751866.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1385211.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1385211.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
BE 2.17.196.115:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 115.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2999802.exe

MD5 181f28ca51cec64d244483a30ad224a1
SHA1 d060f38e2298a2565e2481bbf9885fdd6b268a06
SHA256 bb79ea162bdd5e8e455b8805263a66413b03209103b940fdcd409b60094b5cc8
SHA512 cfa38408686f001cfbb028a195763ef85f9ac0d57239c660639240534775c514f2320e7fa94b95a1d96c47dcd07e4dbb85c5cb3bcb9da238309760539835e6cb

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1631989.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/516-14-0x0000000000910000-0x000000000091A000-memory.dmp

memory/516-15-0x00007FFE4ACA3000-0x00007FFE4ACA5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0751866.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1385211.exe

MD5 888401a31ac4a1ce85c8b14baa01f09f
SHA1 3b69feb049b56320ed598fc485ce9fc783756898
SHA256 fc90287e22e33b7a0739fc30ee8d51ab6c7b3c31af5596fbc4ae59dbe7675da4
SHA512 3b34f4b7d35892a09bc96aba5f5ccb51c2d19432e5c548339028ce797f2d14ef9febc6d9c3528395974ff5b2f33e9eb6fbc35c7769b2ec2e05d9f33011dbf2e3

memory/3644-33-0x0000000000540000-0x0000000000570000-memory.dmp

memory/3644-34-0x0000000002730000-0x0000000002736000-memory.dmp

memory/3644-35-0x0000000005560000-0x0000000005B78000-memory.dmp

memory/3644-36-0x0000000005050000-0x000000000515A000-memory.dmp

memory/3644-37-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

memory/3644-38-0x0000000004F40000-0x0000000004F7C000-memory.dmp

memory/3644-39-0x0000000004F80000-0x0000000004FCC000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab1944db7df59717e8b318a32f59870d54e081f919a261fe3ba94f98287e65fc.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\ab1944db7df59717e8b318a32f59870d54e081f919a261fe3ba94f98287e65fc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5615045.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1772 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\ab1944db7df59717e8b318a32f59870d54e081f919a261fe3ba94f98287e65fc.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5615045.exe
PID 1772 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\ab1944db7df59717e8b318a32f59870d54e081f919a261fe3ba94f98287e65fc.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5615045.exe
PID 1772 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\ab1944db7df59717e8b318a32f59870d54e081f919a261fe3ba94f98287e65fc.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5615045.exe
PID 60 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5615045.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe
PID 60 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5615045.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe
PID 60 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5615045.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe
PID 60 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5615045.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6404013.exe
PID 60 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5615045.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6404013.exe
PID 60 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5615045.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6404013.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ab1944db7df59717e8b318a32f59870d54e081f919a261fe3ba94f98287e65fc.exe

"C:\Users\Admin\AppData\Local\Temp\ab1944db7df59717e8b318a32f59870d54e081f919a261fe3ba94f98287e65fc.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5615045.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5615045.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4224,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6404013.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6404013.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.176:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 176.196.17.2.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 192.98.74.40.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5615045.exe

MD5 970daa7c12af3771c4198db2c1540f9b
SHA1 c121ce7f78dcffa3f9685371d5cec9b752147d4c
SHA256 1e52cce284dd0d357b0e59c03540eeeae8d3640cff7dd0486e577088af344288
SHA512 e18d0fea2c28c32ce9108b65e6fd1cb2674b19de7cd8f8128ceef7f4191e855709d6e7676acdefaf398369a4aef48a38335884e9bee86c45a075dd6b8c77fecb

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2137346.exe

MD5 109963d0c4cca44ae7c3836f2864ed68
SHA1 49b63ad4a47c4d4fc3b0bdf93cac89e53603f95a
SHA256 73da900de8c9aa6086d7005e2168f53b428e6682fe916412ebf9dc1a6deedc7e
SHA512 ae6d9f4f478dc686a4cfef8036cdcecafb4152c79b19f40993713c2075719ee244cdf749fd2822a402fc3780da49661b5ba5c5b0ac58c989bc0d217ff48e7323

memory/1508-14-0x0000000000401000-0x0000000000402000-memory.dmp

memory/1508-15-0x00000000004F0000-0x00000000004FA000-memory.dmp

memory/1508-19-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6404013.exe

MD5 71d342f971de908d1f5e9f5e13709d7c
SHA1 46655f7428b46f49b437e28b2b4e0528f24ebe6c
SHA256 2f6723f3ca763621df4ed5bc7dc3663d4b45ae2e69a8ac5f2bfc1e20ab677335
SHA512 9de5d14d7664a5ab8dd9eb476dfaf6c3a49e12a2a862bba825009d29319c4cbfb9a790129e82fc817d0c7cecdfe760778a56449c71026f1860a0d2f2bc22cf88

memory/3776-25-0x0000000000520000-0x0000000000550000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/3776-30-0x00000000008C0000-0x00000000008C6000-memory.dmp

memory/3776-31-0x0000000005110000-0x0000000005728000-memory.dmp

memory/3776-32-0x0000000004AF0000-0x0000000004BFA000-memory.dmp

memory/3776-33-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/3776-34-0x0000000004C20000-0x0000000004C5C000-memory.dmp

memory/3776-35-0x0000000004CC0000-0x0000000004D0C000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fa130ffbae77f393b8c3761880769505ffbb2fe708e7fc375f0bf42732542b7e.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\fa130ffbae77f393b8c3761880769505ffbb2fe708e7fc375f0bf42732542b7e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HX6eg45.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Aq8fa68.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aF72hB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aF72hB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aF72hB0.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aF72hB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aF72hB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aF72hB0.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 232 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\fa130ffbae77f393b8c3761880769505ffbb2fe708e7fc375f0bf42732542b7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HX6eg45.exe
PID 232 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\fa130ffbae77f393b8c3761880769505ffbb2fe708e7fc375f0bf42732542b7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HX6eg45.exe
PID 232 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\fa130ffbae77f393b8c3761880769505ffbb2fe708e7fc375f0bf42732542b7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HX6eg45.exe
PID 3688 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HX6eg45.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Aq8fa68.exe
PID 3688 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HX6eg45.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Aq8fa68.exe
PID 3688 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HX6eg45.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Aq8fa68.exe
PID 4012 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Aq8fa68.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aF72hB0.exe
PID 4012 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Aq8fa68.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aF72hB0.exe
PID 4012 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Aq8fa68.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aF72hB0.exe
PID 2296 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aF72hB0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2296 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aF72hB0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4012 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Aq8fa68.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe
PID 4012 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Aq8fa68.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe
PID 4012 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Aq8fa68.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 2568 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 2568 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4592 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4592 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4592 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4592 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4592 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4592 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fa130ffbae77f393b8c3761880769505ffbb2fe708e7fc375f0bf42732542b7e.exe

"C:\Users\Admin\AppData\Local\Temp\fa130ffbae77f393b8c3761880769505ffbb2fe708e7fc375f0bf42732542b7e.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HX6eg45.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HX6eg45.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Aq8fa68.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Aq8fa68.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aF72hB0.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aF72hB0.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff8010846f8,0x7ff801084708,0x7ff801084718

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2300 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-MpPreference -verbose

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5048 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4b0 0x4e8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5116 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2276,4021898524866477019,1358262625016604057,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
GB 172.217.16.238:443 www.youtube.com tcp
GB 172.217.16.238:443 www.youtube.com tcp
GB 172.217.16.238:443 www.youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
GB 172.217.169.22:443 i.ytimg.com tcp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 22.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
IE 209.85.203.84:443 accounts.google.com tcp
IE 209.85.203.84:443 accounts.google.com udp
US 8.8.8.8:53 84.203.85.209.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 216.58.212.202:443 jnn-pa.googleapis.com tcp
GB 216.58.212.202:443 jnn-pa.googleapis.com udp
RU 193.233.132.62:50500 tcp
US 8.8.8.8:53 202.212.58.216.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 youtube.com udp
GB 216.58.204.78:443 youtube.com tcp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.187.206:443 play.google.com tcp
GB 142.250.187.206:443 play.google.com udp
GB 172.217.16.238:443 www.youtube.com udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 8.167.79.40.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HX6eg45.exe

MD5 b56c9c48c9be9fe4136433ba42ff386b
SHA1 ca41a545b363d093d54478164341a674d14fc20e
SHA256 6547f1c95bc0b060cd5e5f6b8e5e968b730cd21f758f6dd5371e802b13a5a1de
SHA512 cd0d1d2515ddfa2f82c0a231ac628087ec07e12ae18f16725c8c00f143e42babbdf6fdaa364c3a73995b11c500229ed2b80fb0b49ee9c053b27d00c0318b30f4

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Aq8fa68.exe

MD5 e1ca89e321f8198d4253c9178eb523ff
SHA1 fe072ee589998082c37b054c4d8e4f0a6aa4eeb7
SHA256 3e36cb02ee15f0803929c4cc4ae0639ce652b40ae83519e020dc3e5273dde39a
SHA512 af0d2629e4fce28b141f77762d351ff64c64fc965b9fd51bad073948841c6ea19655e34a7d1aed30837c67cac6e0e5f8af52e9eca07d58a77fdf3d213cd59f2d

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aF72hB0.exe

MD5 3e82adb682d9d441331dde8a3c888f6e
SHA1 6dc1fe6731402b85d721946e65559a375878a3e1
SHA256 4b87018ae58796055ba9ae76bc21519c1e51f7dcfa79344b27047efec6d9d666
SHA512 f346d6eea780ae0cf5faf8fcbb7815a0c461de710a013ac5106c9eaad31dd778765c8709550911921653a13c3e94e5d860b472a671944b51edfa840c019ccca7

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Xd7831.exe

MD5 fb69bac77dd5e98885e6caea73271736
SHA1 51ad255e0b6ffe879375c4cda30f8791a13e1c55
SHA256 302f18643a0476b96ae334230de72d315f753902124fbb9b97d73d73941eed7e
SHA512 3558688f41a573793d4d717316b1243d1371bb02f7f2c41a5156c60fdbc66a38ab36ce0f3c57f6fb4f4da5b546b6f18eff663d5647829432c02ce2693f856716

memory/2996-24-0x0000000000A30000-0x0000000000E9C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

memory/2996-31-0x0000000000A30000-0x0000000000E9C000-memory.dmp

\??\pipe\LOCAL\crashpad_1488_VWMXLCDGCZGPMBOP

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

memory/2996-48-0x0000000009340000-0x00000000093B6000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6b3e064f8c663c0597127030e4c372a5
SHA1 fc4a8ba37dd76269eaccd5a30c921d2ec75739bf
SHA256 49d847dccdb37cc5ca22774ea8281c91e861d875dbffdf94aab21a08cc8c175d
SHA512 b51ab572af3d9db1a0c8ea33ebaadcc4226f24480643ff0781c58087ad018a3bbff81a5b167c162ff59f32447d851e18b6c09ed54f7c8f3c200a50162c7756ff

memory/3988-58-0x0000000004B00000-0x0000000004B36000-memory.dmp

memory/3988-63-0x00000000051A0000-0x00000000057C8000-memory.dmp

memory/3988-66-0x0000000005110000-0x0000000005132000-memory.dmp

memory/3988-68-0x0000000005AE0000-0x0000000005B46000-memory.dmp

memory/3988-67-0x0000000005A00000-0x0000000005A66000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n3krry3c.g5m.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3988-78-0x0000000005B50000-0x0000000005EA4000-memory.dmp

memory/3988-81-0x00000000060E0000-0x00000000060FE000-memory.dmp

memory/3988-82-0x0000000006110000-0x000000000615C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 0a552f6b2052d0e1bade235d99b2cfb2
SHA1 523b7723311d1f2e87d50dcc66d4029d33755329
SHA256 061484a6a304951cf10c4b7ab9672f78afd924b5520ae17800b2504d5c325a3a
SHA512 60012f47bbe33e68efe42a0dd33bb3818d08590b124200664446e0c0805d3cbd9177458d709f603ccac113c25c8ede821787529dd553c95798773fd30dd2ddee

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 ffccd2434f9be5aab91acd67ca9cf0cb
SHA1 7262eb7689b4019b28de1370987323edf28112d8
SHA256 5f7126226df59d71958beccba2c58fad4f4a2d747d103affb89232d3670e1b24
SHA512 e8febd149fd5129f92570287ca8a5cb847e66f39d124811aa45015df2e2aa5110558c90f86d5273abc336cfbd32c4356c40637e339804939acb51b0779647d24

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 71d467f64ef167feb9dc4bdde009b7bc
SHA1 8a05a21b096658a0bea704c0b91965566eba87b0
SHA256 1919a7430e9dd412138c42f59fcfd8afd9d870154f3a23bb83c79148ff51be50
SHA512 496c55874d7e8089aa474354cc840ccd5779a70daf32e0d8337cca125c22f68a3b9b8c942fdac1662ec287af057cb742c360c2c89e5e69ca159b8f59e1536e66

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/3988-128-0x000000006FFA0000-0x000000006FFEC000-memory.dmp

memory/3988-127-0x00000000072E0000-0x0000000007312000-memory.dmp

memory/3988-138-0x0000000006690000-0x00000000066AE000-memory.dmp

memory/3988-139-0x0000000007320000-0x00000000073C3000-memory.dmp

memory/3988-147-0x0000000007400000-0x000000000741A000-memory.dmp

memory/3988-146-0x0000000007A50000-0x00000000080CA000-memory.dmp

memory/3988-151-0x0000000007470000-0x000000000747A000-memory.dmp

memory/3988-155-0x0000000007680000-0x0000000007716000-memory.dmp

memory/3988-159-0x0000000007600000-0x0000000007611000-memory.dmp

memory/3988-196-0x0000000007630000-0x000000000763E000-memory.dmp

memory/3988-205-0x0000000007640000-0x0000000007654000-memory.dmp

memory/3988-220-0x0000000007740000-0x000000000775A000-memory.dmp

memory/3988-226-0x0000000007720000-0x0000000007728000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

memory/2996-305-0x0000000000A30000-0x0000000000E9C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6123b3690a8f871194675947b959ed87
SHA1 f3120d960dc9b678de26a5e5701b47d8fd9adfeb
SHA256 75e09c52d674f2a2476cf632082bb7dbdbc8a8970a0b0ff0e4c0037e69718489
SHA512 dc0b4e01b57b98c28fd27a7d1f8cabd2e7ca47298f5ce106c79bc2a8441530ea5a9d89e268567f6b982822b8e8576ae585c7e7a5cbe1a2e03a5e51e4718beb71

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ea783f3789d6c138c849d89653a9ad09
SHA1 46a413323531e29de75a6bd2819365ac8e67bda6
SHA256 f580a59ff32ba1660fa5d423ba5bfad0442125d86ca9893c39ebbed8bedf8623
SHA512 e79d7f0af4e18af98defca0f0d1b9ea6deb1ac5c17e43d17eef5676e5e2a623ad494e0196e660b36c0b1beba36c8c9da0ba50658a9e6e4aa2b7eb18a041f891e

memory/2996-337-0x0000000000A30000-0x0000000000E9C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 38b59f30c113404d10fb96b3ab31f653
SHA1 31edbeb617f7dbeff5291301ba879f50da758218
SHA256 e9036c153781908534d65d65fca41badc90fb2376a13a79b0513ba9805168456
SHA512 9113582f55e5d7f324b59ef52a0d7ac4f8cca8bc48d69f1b1c3ef837224a4358d611dc664fc40749c57d2c1c272909aa17fc27388644feb5b06c9b23103a2ad2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f25f.TMP

MD5 aa170863c16fef2570dbbc906dde6989
SHA1 5558f8e9e103a542cef901c0bc50171c1edc5472
SHA256 2a196af3bde8503ef08f496c3d8322c7c84e827201761755d94f5342cfe287d6
SHA512 a709b89e025e1bf80934b323b5eb05a3d548b6d8d44430303e1f1dd426e6c704632e6287318a3e8452090be395de2c0a09b51316f59968d30a86cf56997e929e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\bbdf822e-6ed9-408f-8397-f9638f9aa3c1\index-dir\the-real-index~RFe57fa9c.TMP

MD5 d93263f812f1b69161262b940c7f2a06
SHA1 c975fa9d9b2e01dc874c44a623f4a52fb6cf8ff0
SHA256 c43455ba9bade7a894a7d740080f1700a7fbc3cca106ea1f7bc731d83dce60ed
SHA512 61c87e3c97a89a819f885ab70ed2099459b712c8f166631572f1174982dcdaa23251de28eba76a77357772a71c3be50cc50de66f6e5075c07d012c8747e2bd33

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\bbdf822e-6ed9-408f-8397-f9638f9aa3c1\index-dir\the-real-index

MD5 1ab11333eb86029af3958e15f5cd86f0
SHA1 b6f8f8a8ad23ddba9b5a43cf1336bd55f599c77b
SHA256 f8233c330ef6692eab8f884339ef4db9295901eef705b4d6e18ba8567952de2b
SHA512 8166300e80861e221061dc550df1c28e915118cc0c50e49f66ec73ba6f0e06f0c897b71deb5e4a79de2349362be9a3ca03edeabb8012c6f8851c0407a0907c4f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp

MD5 446720866ecec7e418e2ce567b964e53
SHA1 6ebbb095599501c566acec932c07df3b5833d213
SHA256 3ebf394dad1ff7d14c2f7bd1eec9ae03142475718b240e2294935e68873c00ef
SHA512 4be2e43e41cb7b4aae540d07733bd5bb7dc37275b1e97a02e1dcf9feac47d299ee135e645055f3f15c95d8d2b44c1d989588c2021e2f4c38a290e7ff545e71f5

memory/2996-365-0x0000000000A30000-0x0000000000E9C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 b91a34754c6eb2bcf05082ad26d59d57
SHA1 2def95f0a7dea73c0f4ff26d21b9a5f3b44cecff
SHA256 7bd35c3c2b0f4b4baee393f94658734a19e3931db14c5781d00efaa248373384
SHA512 6d6d9995167260fc8a0dc894e047492b114b3e4e2d70da3705e9b10147ce1dc93cebed24569bd3458a9b396c842a4cc08fa18b87977a81eb4cce17f789fdad77

memory/2996-371-0x0000000000A30000-0x0000000000E9C000-memory.dmp

memory/2996-372-0x0000000000A30000-0x0000000000E9C000-memory.dmp

memory/2996-382-0x0000000000A30000-0x0000000000E9C000-memory.dmp

memory/2996-388-0x0000000000A30000-0x0000000000E9C000-memory.dmp

memory/2996-393-0x0000000000A30000-0x0000000000E9C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 a4fff246d407da7969c8808fa685e931
SHA1 c009da58c98ccc7231038153453019fab8a91e4a
SHA256 ccf6c7116227a7fa22ff65c61ae615df7d60a3874c94117ec23aa180c4de62a5
SHA512 4e766aa62ec2f2f4f32c475a7da817dc17ecea6f7c8b84a140663e946515097224b9bff61c1cfaf7fb46628ab948daf1bc813e5d543bb36cd9b7bd0ad72aca87

memory/2996-417-0x0000000000A30000-0x0000000000E9C000-memory.dmp

memory/2996-418-0x0000000000A30000-0x0000000000E9C000-memory.dmp

memory/2996-419-0x0000000000A30000-0x0000000000E9C000-memory.dmp

memory/2996-420-0x0000000000A30000-0x0000000000E9C000-memory.dmp

memory/2996-423-0x0000000000A30000-0x0000000000E9C000-memory.dmp

memory/2996-424-0x0000000000A30000-0x0000000000E9C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 c03c87a2a4e65de604e2e4e68ddbf028
SHA1 d5905cd7cd0114d4dbd6b09cd09418a03338e702
SHA256 0e41078f47717a9abf71bde51c7b1eb9e6d68285a86a45348150f9fe415be07d
SHA512 09c43477316b95502125d45bbd077f07d18bfdd273bd6db19cf23776a42438eacf20a31413b36e7abbcea9d44709b17481fba6866dc834aa96a3b7d74e233e93

memory/2996-436-0x0000000000A30000-0x0000000000E9C000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1186983.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2757613.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5164567.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3956 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1186983.exe
PID 3956 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1186983.exe
PID 3956 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1186983.exe
PID 4796 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1186983.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2757613.exe
PID 4796 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1186983.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2757613.exe
PID 4796 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1186983.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2757613.exe
PID 1664 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2757613.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe
PID 1664 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2757613.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe
PID 1664 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2757613.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe
PID 5020 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5164567.exe
PID 5020 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5164567.exe
PID 5020 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5164567.exe
PID 2084 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5164567.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe
PID 2084 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5164567.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe
PID 2084 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5164567.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe
PID 2084 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5164567.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe
PID 2084 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5164567.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe
PID 5020 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c9378338.exe
PID 5020 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c9378338.exe
PID 5020 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c9378338.exe

Processes

C:\Users\Admin\AppData\Local\Temp\21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32.exe

"C:\Users\Admin\AppData\Local\Temp\21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1186983.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1186983.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2757613.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2757613.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5164567.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5164567.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c9378338.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c9378338.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.179:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
BE 2.17.196.179:443 www.bing.com tcp
US 8.8.8.8:53 179.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 121.150.79.40.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1186983.exe

MD5 a958b8f529f8714ab8f649accc09d9f9
SHA1 8ec0f0c1dddaed3b89fdd493d43949bb35b6d19c
SHA256 3bccd82842a40854bdc9bfc3fd8dc5b93707f759c1938f2e0174165af52ba8b1
SHA512 b4346955ea9e979e59ca6857df7ccf52e5a60cec74ddeac38dfd2d604e74a7b82f61adee9453693697f5d97e434937f895776b39797c95aa7c47c2eaae8d99ea

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2757613.exe

MD5 7fcac3187ef0a3ae980b457751d7ed0b
SHA1 b1e9d35b1d9164b28ed5f99398308f32a332dcaf
SHA256 afd1d16929b077f25b929310df449fd8772f653027596fa55ad4da17983df2ce
SHA512 46227177614ab96a48f3cf811d61a15eac2b58b7eade042f0f5e50544e21abfda13af520e3d19ad9b162d0a1e3e918a6240d1f88a657bda7c5b6654864380642

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe

MD5 e99aa1030c7a763e8bb5ddc13a871fc3
SHA1 63925d0f25f3dc55a0dad0397741001098712ff8
SHA256 7d9e8e6a8fbf325966e5cad26f6bc2daf9fcb9bb3ea399dfb48eaf0c0e5328e2
SHA512 1d650cfc66f4e028986dc4b0fc6d1e64ddc923656bb08a701a4cf4c9df994d8380cc57d36b6fda3635b0f9e9de4ff5a7ba9fd3fd7dd41643a0b20d83e5ccd0ff

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5164567.exe

MD5 f001ba8d5cc9b4cdc2c6497b35d24389
SHA1 adf5afbe53307a4cbce6f61eb41a5f8b392bd1ba
SHA256 76a6001a778dd220a1bac72a373be37cffa37128e87f0ee2191af1ea0edd989b
SHA512 fcd79f323497c2ccbc1e25eeab1e739041c2fe0c0303e09cb9f37545db947415bdd3df81a8f249414a5fd6b731f1ce855fc3ee7fd3f4fd96827f698538b1233c

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe

MD5 fd699b4ed20dc242c93c08fd0e200e56
SHA1 8744ac80d4cba3be5c2a6df20895af9a7c3f204d
SHA256 276677627decf1682d9cb3545327eaaec22fe5e36fff15b57f1614b21022a092
SHA512 3b5e4a05286d12e7c9c8bfe587e80deacdd44c2b9832370eb45765623703335ef5cd216aaea0cd61bb5cbb55584dad0793faab3c1aa85cad644358238e28ab19

memory/1172-35-0x0000000000690000-0x00000000006CE000-memory.dmp

memory/1172-41-0x0000000000690000-0x00000000006CE000-memory.dmp

memory/1172-42-0x0000000002480000-0x0000000002481000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe

MD5 e14ac2d9095b9b27f28389369cc810f3
SHA1 d59499d0beae0be39746cc389ee2cd0d7b90672b
SHA256 a2f4bacc055531ada6d5fce84091eabde8bc920c5ac8b2f3026cb21948b6c915
SHA512 9de2f8665c58eb5c552d5cbce27c5a9748b591954e028d9029742cc68f55379490e0c379ff64508036be481fa45a6c91db20b803c38b0ab3588107b9003da17d

memory/3288-48-0x0000000000350000-0x000000000035A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c9378338.exe

MD5 644fd9967279d0b37d985915fe87f280
SHA1 fd78c2dd18e32d4f9b35023c4fae6a8e60e2669a
SHA256 6b2f8a6639b2f6e13d4bab219c1513284203270411bccfafe0b323031133e3c4
SHA512 72cfeb5e13f35f3cbf538cf3b37478275e6aaed9169e8518e6bf68f8b873c1bf096d11a6a06f6c507722db29031a6b0de14bbf9dc705514bc7277f78749f7ef8

memory/3036-53-0x0000000001FF0000-0x000000000207C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/3036-60-0x0000000001FF0000-0x000000000207C000-memory.dmp

memory/3036-62-0x0000000002280000-0x0000000002286000-memory.dmp

memory/3036-63-0x0000000007390000-0x00000000079A8000-memory.dmp

memory/3036-64-0x0000000006D70000-0x0000000006E7A000-memory.dmp

memory/3036-65-0x0000000006CF0000-0x0000000006D02000-memory.dmp

memory/3036-66-0x0000000006D10000-0x0000000006D4C000-memory.dmp

memory/3036-67-0x0000000005A00000-0x0000000005A4C000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\230ec3f2c3ef81a9a14c2fc686c0aa21d93d3cca8dca04a8ecb90dd3c54c0f5e.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5905076.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5905076.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5905076.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5905076.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5905076.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5905076.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6148278.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5905076.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\230ec3f2c3ef81a9a14c2fc686c0aa21d93d3cca8dca04a8ecb90dd3c54c0f5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0732024.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5905076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5905076.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5905076.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4496 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\230ec3f2c3ef81a9a14c2fc686c0aa21d93d3cca8dca04a8ecb90dd3c54c0f5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0732024.exe
PID 4496 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\230ec3f2c3ef81a9a14c2fc686c0aa21d93d3cca8dca04a8ecb90dd3c54c0f5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0732024.exe
PID 4496 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\230ec3f2c3ef81a9a14c2fc686c0aa21d93d3cca8dca04a8ecb90dd3c54c0f5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0732024.exe
PID 3416 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0732024.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6148278.exe
PID 3416 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0732024.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6148278.exe
PID 3416 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0732024.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6148278.exe
PID 3508 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6148278.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3508 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6148278.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3508 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6148278.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3416 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0732024.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5905076.exe
PID 3416 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0732024.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5905076.exe
PID 2280 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2280 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2280 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2280 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2280 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2280 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 4980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1652 wrote to memory of 4980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1652 wrote to memory of 4980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1652 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1652 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1652 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1652 wrote to memory of 3896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 3896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 3896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 8 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1652 wrote to memory of 8 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1652 wrote to memory of 8 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1652 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1652 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1652 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4496 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\230ec3f2c3ef81a9a14c2fc686c0aa21d93d3cca8dca04a8ecb90dd3c54c0f5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8960951.exe
PID 4496 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\230ec3f2c3ef81a9a14c2fc686c0aa21d93d3cca8dca04a8ecb90dd3c54c0f5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8960951.exe
PID 4496 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\230ec3f2c3ef81a9a14c2fc686c0aa21d93d3cca8dca04a8ecb90dd3c54c0f5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8960951.exe

Processes

C:\Users\Admin\AppData\Local\Temp\230ec3f2c3ef81a9a14c2fc686c0aa21d93d3cca8dca04a8ecb90dd3c54c0f5e.exe

"C:\Users\Admin\AppData\Local\Temp\230ec3f2c3ef81a9a14c2fc686c0aa21d93d3cca8dca04a8ecb90dd3c54c0f5e.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0732024.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0732024.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6148278.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6148278.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5905076.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5905076.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4324,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=1324 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8960951.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8960951.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0732024.exe

MD5 17aa0bb9c1aa1a9bf1c36e044c826a5f
SHA1 dbe36f97fecafcea350686dece9e9938e03a16f0
SHA256 5a35dd9b813ac7c1d179d9faff5d3beebc7a51c1a73bfaafb65ac07be526a270
SHA512 ff1b72cdfb3654df57e0ea3796b81f6a4d12507dda05e194e6e0cbd65ffcbc8347dca2221132edc2447ed3060b45bec67018ef03f240c43ed6f5da738e807a58

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6148278.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5905076.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2316-27-0x0000000000650000-0x000000000065A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8960951.exe

MD5 0fde42662f781c4943d021ea71c344da
SHA1 d1aa8bab8076570249bb9cbad222cbca24e66a3f
SHA256 25027efa89f2d79bcf5a7f102a0d2209c77848f8fe2c0fa366b514273cb0c184
SHA512 d44bde1c115d497292c58b73d4afdd498126b12fc6ce19de2f70a548fb800355ba12dd352d9465f17819cb0e73d3c7e3db90bd938736ceed6a519f110c9a8892

memory/2860-32-0x0000000000E70000-0x0000000000EA0000-memory.dmp

memory/2860-33-0x0000000001760000-0x0000000001766000-memory.dmp

memory/2860-34-0x000000000B2C0000-0x000000000B8D8000-memory.dmp

memory/2860-35-0x000000000AE20000-0x000000000AF2A000-memory.dmp

memory/2860-36-0x000000000AD60000-0x000000000AD72000-memory.dmp

memory/2860-37-0x000000000ADC0000-0x000000000ADFC000-memory.dmp

memory/2860-38-0x0000000005260000-0x00000000052AC000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win7-20240221-en

Max time kernel

120s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe

"C:\Users\Admin\AppData\Local\Temp\55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 120

Network

N/A

Files

memory/2172-0-0x0000000000D01000-0x0000000000D02000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240426-en

Max time kernel

142s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9eded57acff39eca8ffe9167fa52ac5a352e13a9ce3d0f0696a5a69bf589b794.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0162850.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0162850.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0162850.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0162850.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0162850.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0162850.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0164671.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0162850.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\9eded57acff39eca8ffe9167fa52ac5a352e13a9ce3d0f0696a5a69bf589b794.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7165419.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0162850.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0162850.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0162850.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4648 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\9eded57acff39eca8ffe9167fa52ac5a352e13a9ce3d0f0696a5a69bf589b794.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7165419.exe
PID 4648 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\9eded57acff39eca8ffe9167fa52ac5a352e13a9ce3d0f0696a5a69bf589b794.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7165419.exe
PID 4648 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\9eded57acff39eca8ffe9167fa52ac5a352e13a9ce3d0f0696a5a69bf589b794.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7165419.exe
PID 3592 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7165419.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0164671.exe
PID 3592 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7165419.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0164671.exe
PID 3592 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7165419.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0164671.exe
PID 744 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0164671.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 744 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0164671.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 744 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0164671.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3592 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7165419.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0162850.exe
PID 3592 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7165419.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0162850.exe
PID 2768 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2768 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2768 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2768 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2768 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2768 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 5052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 5052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 5052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2112 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2112 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2112 wrote to memory of 4024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2112 wrote to memory of 4024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2112 wrote to memory of 4024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2112 wrote to memory of 4044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 4044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 4044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 4552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2112 wrote to memory of 4552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2112 wrote to memory of 4552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2112 wrote to memory of 1196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2112 wrote to memory of 1196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2112 wrote to memory of 1196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4648 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\9eded57acff39eca8ffe9167fa52ac5a352e13a9ce3d0f0696a5a69bf589b794.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0248954.exe
PID 4648 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\9eded57acff39eca8ffe9167fa52ac5a352e13a9ce3d0f0696a5a69bf589b794.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0248954.exe
PID 4648 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\9eded57acff39eca8ffe9167fa52ac5a352e13a9ce3d0f0696a5a69bf589b794.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0248954.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9eded57acff39eca8ffe9167fa52ac5a352e13a9ce3d0f0696a5a69bf589b794.exe

"C:\Users\Admin\AppData\Local\Temp\9eded57acff39eca8ffe9167fa52ac5a352e13a9ce3d0f0696a5a69bf589b794.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7165419.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7165419.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0164671.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0164671.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0162850.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0162850.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0248954.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0248954.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
FI 77.91.68.61:80 tcp
BE 2.17.196.82:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 82.196.17.2.in-addr.arpa udp
BE 2.17.196.82:443 www.bing.com tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7165419.exe

MD5 d60ceb0d453dbdccc5d6d5915c267175
SHA1 39dea3367af3d4aa41c5638d97571a401c628ba6
SHA256 aaae358e392fdefd2fc1d28c2535d3512189ec6c5552036795c920d9246e6005
SHA512 8206fdc47aa0dd2c0681c92e99995fe803b4062013c9d9e2bed64f1a1edbe9a9d8b8fa882c4997b9e2227887896c8d65c6a7e81d7c99ccbba4d02e2c4ff43c8e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0164671.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0162850.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/936-27-0x0000000000CC0000-0x0000000000CCA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0248954.exe

MD5 2b9fe575c90f5534f580a17ec14b5942
SHA1 9ef3c05dc677950b38643af7fa2020ba587495d2
SHA256 73e38ed750acbe90ef83251b925afe0d6918542e05dd9dc0dc1df699a273cb63
SHA512 9f4814b4c439acf503b2d79e9041e252ba616340e2ad81dd9291942fe3769fe50bb180ca423aefc29b04d1d660002ba79ed0275c274b5d617b1fbebc8f80b004

memory/1240-32-0x0000000000AA0000-0x0000000000AD0000-memory.dmp

memory/1240-33-0x0000000005400000-0x0000000005406000-memory.dmp

memory/1240-34-0x000000000AF20000-0x000000000B538000-memory.dmp

memory/1240-35-0x000000000AA50000-0x000000000AB5A000-memory.dmp

memory/1240-36-0x000000000A990000-0x000000000A9A2000-memory.dmp

memory/1240-37-0x000000000A9F0000-0x000000000AA2C000-memory.dmp

memory/1240-38-0x0000000002DA0000-0x0000000002DEC000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c648954590b2b993dd0ec5a577cba1b52011aa076b30819cd9c278d54c229da2.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1097541.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1097541.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9639557.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9639557.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9639557.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9639557.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1097541.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1097541.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9639557.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9639557.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1097541.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1097541.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1097541.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1097541.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9639557.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\c648954590b2b993dd0ec5a577cba1b52011aa076b30819cd9c278d54c229da2.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3488982.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9692876.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4993504.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6610272.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1097541.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9639557.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1636 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\c648954590b2b993dd0ec5a577cba1b52011aa076b30819cd9c278d54c229da2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3488982.exe
PID 1636 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\c648954590b2b993dd0ec5a577cba1b52011aa076b30819cd9c278d54c229da2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3488982.exe
PID 1636 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\c648954590b2b993dd0ec5a577cba1b52011aa076b30819cd9c278d54c229da2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3488982.exe
PID 1892 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3488982.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9692876.exe
PID 1892 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3488982.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9692876.exe
PID 1892 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3488982.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9692876.exe
PID 1444 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9692876.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4993504.exe
PID 1444 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9692876.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4993504.exe
PID 1444 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9692876.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4993504.exe
PID 3880 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4993504.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6610272.exe
PID 3880 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4993504.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6610272.exe
PID 3880 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4993504.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6610272.exe
PID 2436 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6610272.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1097541.exe
PID 2436 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6610272.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1097541.exe
PID 2436 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6610272.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1097541.exe
PID 2436 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6610272.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9639557.exe
PID 2436 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6610272.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9639557.exe
PID 3880 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4993504.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c3816723.exe
PID 3880 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4993504.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c3816723.exe
PID 3880 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4993504.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c3816723.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c648954590b2b993dd0ec5a577cba1b52011aa076b30819cd9c278d54c229da2.exe

"C:\Users\Admin\AppData\Local\Temp\c648954590b2b993dd0ec5a577cba1b52011aa076b30819cd9c278d54c229da2.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3488982.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3488982.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9692876.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9692876.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4993504.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4993504.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6610272.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6610272.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1097541.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1097541.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9639557.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9639557.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c3816723.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c3816723.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.66:443 www.bing.com tcp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 66.196.17.2.in-addr.arpa udp
BE 2.17.196.66:443 www.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 210.143.182.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9692876.exe

MD5 af4b6ee32e905833f52664447255cebe
SHA1 c73084cf15ca24c4332c028cd33fd129606a947f
SHA256 02a217269c36a6055324a25f694e6712a03cb700003cc5e07b06213573974496
SHA512 41b8275fbe2168b40c60a891bc98fafc42b5bab4997cc8e0851fef01f5df9733737d258e207071bd4dd88b9f348ccd730fe9c11214841fb7468d6baa51f29b68

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1097541.exe

MD5 ce1702e57be93eedfc26ee915494f665
SHA1 47455dace1b826c1d1de4bd9eb1eae45d085fe94
SHA256 076eac6ce7b2d0d9d9db1a2cb2daa3e7371a72c2f3ba69659ab2b4ec6c484119
SHA512 5e20b1866b481e3181d327b7ca63c29e1c5a59a8584c084fddbe8aa0b508e5b0ee6ed3e2a71406b66cbda3694b563f5cdb479dac196409d9f32b0f19cf1eb049

memory/4920-35-0x0000000000690000-0x00000000006CE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6610272.exe

MD5 e7d041c38e3ee39c96aa00d019a84fbf
SHA1 0665bdcf3cdd3c2961e921198157e3b24909b203
SHA256 7e313e4487ab9f86dc94ca65c26f3654fd5c4dbfcc856458832ba8b4dc5db578
SHA512 75d2b9b4e562ff284051834655e580cad62075c987e7ceb1a3a46faafd24a6abd817c2631d64cb6bd121a7abda2a8c8eade5240d42ead98a31a7354907797469

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4993504.exe

MD5 e4bc1e3a7d5c0707cb7a51bc0885bac8
SHA1 8841aa32e81d48e6f132fcb478cc56eaccf54bc5
SHA256 802bd1694645ebe47bc74d9b805cdfb0d654c4c545b7217d9cbca53595442db2
SHA512 0007f204656b06eed59fb33ea974eef5aca74bf7851a70bb7f2e565b95df11dddc67e0aea4613a0e5fbb5f60db9eadb367d17f4ad00084939a6cbb640a9d914b

memory/4920-42-0x0000000004470000-0x0000000004471000-memory.dmp

memory/4920-41-0x0000000000690000-0x00000000006CE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3488982.exe

MD5 d243a6511f0d3e68f5aa8d43f3dd7f3b
SHA1 7d1534ed0cbe345621ece012d7087b09f26894cf
SHA256 ad64d7e5f0015bc591333da061c261a7a7a21941cf89d2840156c7b16fe13348
SHA512 d12a0304c25ef0367f8aa937c8f062b585e35d7f10f5e3e726b4c42dfe0c7922fb25df146a4b940dd6874b99080b5c30910777faf4c3feae17cc82e8f1763e92

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9639557.exe

MD5 704e5df0fc4e88fa277b3168658091cd
SHA1 ae5853a4834b8d791e4f3f7df21fdd38f8fac531
SHA256 1b7df6d5f6eebeed6911fa4520e730bd3906e492fcc3c236d3315433e8bd320c
SHA512 462aa658bec6cff61ad79b8cd6df8ae587556b2b9fae156808c447cf76d8f1f74151c6ad2120967f7cf851c1f8b067b68387f04509656fbfd0b656c4e394acde

memory/5056-48-0x0000000000430000-0x000000000043A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c3816723.exe

MD5 755410f0aa46758c9f0214567e2029a1
SHA1 a78cbd39742a653ec83688b318d97bd159659455
SHA256 d8ba2a469d8e17d26166218994479f49e939c8cf18edaa6379e9b750b5e00026
SHA512 37e78c8211be1ac8893c2ac36239793c6701e0e7aec071cac737a72a1575f565f47662200c7efb7635d11bf5ceb3847145d2d1dd4e34840f8ab3bd2bceaa8044

memory/556-53-0x0000000002060000-0x00000000020EC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/556-60-0x0000000002060000-0x00000000020EC000-memory.dmp

memory/556-62-0x0000000002400000-0x0000000002406000-memory.dmp

memory/556-63-0x000000000A030000-0x000000000A648000-memory.dmp

memory/556-64-0x000000000A6B0000-0x000000000A7BA000-memory.dmp

memory/556-65-0x000000000A7E0000-0x000000000A7F2000-memory.dmp

memory/556-66-0x000000000A800000-0x000000000A83C000-memory.dmp

memory/556-67-0x0000000006A00000-0x0000000006A4C000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win7-20240221-en

Max time kernel

131s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2128 set thread context of 1704 N/A C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2128 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2128 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2128 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2128 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2128 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2128 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2128 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2128 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2128 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe

"C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"

Network

Country Destination Domain Proto
RU 83.97.73.129:19068 tcp
RU 83.97.73.129:19068 tcp
RU 83.97.73.129:19068 tcp
RU 83.97.73.129:19068 tcp
RU 83.97.73.129:19068 tcp
RU 83.97.73.129:19068 tcp

Files

memory/2128-0-0x0000000000A27000-0x0000000000A28000-memory.dmp

memory/1704-9-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1704-8-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1704-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1704-2-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1704-1-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1704-10-0x00000000746BE000-0x00000000746BF000-memory.dmp

memory/1704-11-0x0000000000440000-0x0000000000446000-memory.dmp

memory/1704-12-0x00000000746B0000-0x0000000074D9E000-memory.dmp

memory/1704-13-0x00000000746BE000-0x00000000746BF000-memory.dmp

memory/1704-14-0x00000000746B0000-0x0000000074D9E000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ffca01eab57ad303c53af864d96d53e1fe5339d089ece9c9288d685395588b09.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0552834.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5553196.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\ffca01eab57ad303c53af864d96d53e1fe5339d089ece9c9288d685395588b09.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2360 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\ffca01eab57ad303c53af864d96d53e1fe5339d089ece9c9288d685395588b09.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0552834.exe
PID 2360 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\ffca01eab57ad303c53af864d96d53e1fe5339d089ece9c9288d685395588b09.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0552834.exe
PID 2360 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\ffca01eab57ad303c53af864d96d53e1fe5339d089ece9c9288d685395588b09.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0552834.exe
PID 2460 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0552834.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5553196.exe
PID 2460 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0552834.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5553196.exe
PID 2460 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0552834.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5553196.exe
PID 1968 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5553196.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g7001085.exe
PID 1968 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5553196.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g7001085.exe
PID 1968 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5553196.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g7001085.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ffca01eab57ad303c53af864d96d53e1fe5339d089ece9c9288d685395588b09.exe

"C:\Users\Admin\AppData\Local\Temp\ffca01eab57ad303c53af864d96d53e1fe5339d089ece9c9288d685395588b09.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0552834.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0552834.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5553196.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5553196.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g7001085.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g7001085.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.96:443 www.bing.com tcp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 96.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
BE 2.17.196.96:443 www.bing.com tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 24.73.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0552834.exe

MD5 3212a7b9507efaf1ccec34710828bc95
SHA1 e34a13af94b3d4574b18d72ba610663e8ce4141e
SHA256 28c46720aebd12e25ba56f969c8122d653499523318ac5ad6a0a498ca8671c4e
SHA512 752b5d8dcb01869a5b06877c01276936a39581629022b8200a00a3a71a616bf38dc16a60bf3d640ae42e4ae19f18daabfdaa915e74766bec8718f83a133a3915

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5553196.exe

MD5 f67e7a52656d409b8f8d8fc455806615
SHA1 0875151c252084b81c49636397ceb30c965e5f29
SHA256 73a00aa402abe61449146a11ca364d0684c23ec2b221cfcc449c596f573680ca
SHA512 7acd1b664bc4e7024234efa27709e7f88a62653376a8abcd8027692f6992fc7f1256026522b45109cb856c8d139ce8004b85115226364509f142c5c3e7818054

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g7001085.exe

MD5 92afdf44d1c33960ab452a8c274282db
SHA1 60c7376a52f74f0799ee2a574782e9855af28efe
SHA256 e12a3d43b1f8a35e75f3bf09ea5422ef10bccfa19a8b2e131259f7b4be5333d2
SHA512 31ee981dd21ffe2498d74cf7713df410d55b6a9f9894c571b6d05bd372402362f051b0f87cbcb62d9723c145593eb53dd8c04cdb72836adf9c71b82170a83e1f

memory/3980-22-0x0000000001FB0000-0x000000000203C000-memory.dmp

memory/3980-27-0x0000000000401000-0x0000000000404000-memory.dmp

memory/3980-29-0x0000000004500000-0x0000000004501000-memory.dmp

memory/3980-28-0x0000000001FB0000-0x000000000203C000-memory.dmp

memory/3980-30-0x0000000004510000-0x0000000004516000-memory.dmp

memory/3980-31-0x000000000B050000-0x000000000B668000-memory.dmp

memory/3980-32-0x000000000B6B0000-0x000000000B7BA000-memory.dmp

memory/3980-33-0x000000000B7E0000-0x000000000B7F2000-memory.dmp

memory/3980-34-0x000000000B800000-0x000000000B83C000-memory.dmp

memory/3980-35-0x00000000069F0000-0x0000000006A3C000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2ea5e26c1500a47dc848fdffa31210f94311df256bb6bd7b359e4af6894023e7.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4426601.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4426601.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4426601.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4426601.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4426601.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4426601.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8095379.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4426601.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7811642.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1955735.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\2ea5e26c1500a47dc848fdffa31210f94311df256bb6bd7b359e4af6894023e7.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5089515.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5089515.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5089515.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4426601.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4426601.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4426601.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4460 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\2ea5e26c1500a47dc848fdffa31210f94311df256bb6bd7b359e4af6894023e7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7811642.exe
PID 4460 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\2ea5e26c1500a47dc848fdffa31210f94311df256bb6bd7b359e4af6894023e7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7811642.exe
PID 4460 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\2ea5e26c1500a47dc848fdffa31210f94311df256bb6bd7b359e4af6894023e7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7811642.exe
PID 3796 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7811642.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1955735.exe
PID 3796 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7811642.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1955735.exe
PID 3796 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7811642.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1955735.exe
PID 2128 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1955735.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4426601.exe
PID 2128 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1955735.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4426601.exe
PID 2128 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1955735.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8095379.exe
PID 2128 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1955735.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8095379.exe
PID 2128 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1955735.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8095379.exe
PID 4980 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8095379.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4980 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8095379.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4980 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8095379.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3796 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7811642.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5089515.exe
PID 3796 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7811642.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5089515.exe
PID 3796 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7811642.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5089515.exe
PID 4460 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\2ea5e26c1500a47dc848fdffa31210f94311df256bb6bd7b359e4af6894023e7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2061509.exe
PID 4460 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\2ea5e26c1500a47dc848fdffa31210f94311df256bb6bd7b359e4af6894023e7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2061509.exe
PID 4460 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\2ea5e26c1500a47dc848fdffa31210f94311df256bb6bd7b359e4af6894023e7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2061509.exe
PID 4476 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4476 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4476 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4476 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4076 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4076 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4076 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4076 wrote to memory of 3328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4076 wrote to memory of 3328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4076 wrote to memory of 3328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4076 wrote to memory of 2296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4076 wrote to memory of 2296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4076 wrote to memory of 2296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4076 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4076 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4076 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4076 wrote to memory of 728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4076 wrote to memory of 728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4076 wrote to memory of 728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4076 wrote to memory of 2352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4076 wrote to memory of 2352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4076 wrote to memory of 2352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2ea5e26c1500a47dc848fdffa31210f94311df256bb6bd7b359e4af6894023e7.exe

"C:\Users\Admin\AppData\Local\Temp\2ea5e26c1500a47dc848fdffa31210f94311df256bb6bd7b359e4af6894023e7.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7811642.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7811642.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1955735.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1955735.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4426601.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4426601.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8095379.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8095379.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5089515.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5089515.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2061509.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2061509.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.120:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 120.196.17.2.in-addr.arpa udp
BE 2.17.196.120:443 www.bing.com tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4426601.exe

MD5 4a52f5ac63c258eb43a31d19c1ef0f10
SHA1 e234ac66b801fe1be51c144206a811809b2b53ef
SHA256 45c201511196955b077ff6d298ab9d6f10cc394dfa6f91a746d10246db41ab00
SHA512 15c2c18b9b19fdbd6744b81687f92263114a363b1cc32af2483676ab465c4a9f4eac35553212f331808744c7abb159b25b521556ec5a5b766b468f93d6fbcbc7

memory/1776-22-0x0000000000CA0000-0x0000000000CAA000-memory.dmp

memory/1776-21-0x00007FFE3E773000-0x00007FFE3E775000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1955735.exe

MD5 fc78db6faef23ec53cf6d28a8d2413e5
SHA1 909012f46132d8e495fbb87aa929a34896e0abff
SHA256 f64c365cf9ebf6b3d3c2c5fa5d606e6108cb7cbdca2d3c5a584265cdfe86af19
SHA512 94da1949fb511f63aecb67cd890c6da681df8d7e8cf363547ae789c092209cb1c6f93b3f2880beca3d76b8b9ce4da397c0fd8edf1476ea4b163cfd3915e7b560

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7811642.exe

MD5 1b5c60006cf65f19efde04faf393ff26
SHA1 79b21b5c269f61e83bded7046cac7a74c8d03a26
SHA256 5d444bb020b097b1a1601470bff8ed4f721ca9833ed2645d13e7bb941f933c92
SHA512 761a77a6ff1f8eda021d9827eb1a7af15d51ff792f1d34af0d965701e1eb756e148ace1f294cc753d1cc8469c0350b942cae76fccde6c206f5e574b22dd6662d

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8095379.exe

MD5 6ea3f44322a07b398f06762b5a7e09a1
SHA1 af77a595623910bf513a34e8308ea69efb9a2a91
SHA256 2ad18f623171a8873c4d292125e8b1d2421172d6ba472d49f1d2988872b87266
SHA512 a4edbb71f501caa94c48c7a1c0e0766eb693e138e47aad8b59a695f313cb5322dda91d95225a1034db386c186103dbfe28f3a27e9c3d40c86a2721f33a04121a

memory/2600-41-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1512-48-0x000000000A000000-0x000000000A10A000-memory.dmp

memory/1512-47-0x000000000A510000-0x000000000AB28000-memory.dmp

memory/1512-46-0x0000000004970000-0x0000000004976000-memory.dmp

memory/1512-49-0x0000000009F40000-0x0000000009F52000-memory.dmp

memory/1512-45-0x0000000000190000-0x00000000001C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2061509.exe

MD5 f3d4c9732520988f37640af8592b4d4f
SHA1 439c8330fafbb18ca5bfb910ba6072b0d6c344ea
SHA256 5308702f0f353193c42c209eb946a64d65aafb3b8543cfed37ef8b79a9477c11
SHA512 67d76224af187bbe39a9c7a3b6cea6becc77d887cc3ac89513d006f8331ce60506d783b2034a8a2083bda1767ea1fa9dbcc9a52a7f1fc554065ca2f1927bd2d9

memory/1512-50-0x0000000009FA0000-0x0000000009FDC000-memory.dmp

memory/2600-40-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5089515.exe

MD5 4d10444994d8bcb46db1b0169d70408c
SHA1 cb75bd6e3f9a211e3f6f0edd621c4d19f3cbb932
SHA256 f3f96017154ef1ac7b8a8e402b1f4ec838b4cbf90b17d91fbd41c9d80fe93b73
SHA512 ff14d0549a3f9aae43c2535970fcb73c7287603eaed8f6ef02865d1137e6d0a83349eb19d088c162ed140e01689b62beba29a3b0081a15d6d538f5bc4836692f

memory/1512-51-0x0000000002310000-0x000000000235C000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240508-en

Max time kernel

143s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7031576.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1652674.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7031576.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4736 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1652674.exe
PID 4736 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1652674.exe
PID 4736 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1652674.exe
PID 1796 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1652674.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe
PID 1796 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1652674.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe
PID 1796 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1652674.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7031576.exe
PID 1796 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1652674.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7031576.exe
PID 1796 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1652674.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7031576.exe
PID 2996 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7031576.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 2996 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7031576.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 2996 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7031576.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 4736 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t5095424.exe
PID 4736 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t5095424.exe
PID 4736 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t5095424.exe
PID 5028 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 5028 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 5028 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 5028 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 5028 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 5028 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 3608 wrote to memory of 4580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3608 wrote to memory of 4580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3608 wrote to memory of 4580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3608 wrote to memory of 3632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3608 wrote to memory of 3632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3608 wrote to memory of 3632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3608 wrote to memory of 1140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3608 wrote to memory of 1140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3608 wrote to memory of 1140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3608 wrote to memory of 1104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3608 wrote to memory of 1104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3608 wrote to memory of 1104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3608 wrote to memory of 4404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3608 wrote to memory of 4404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3608 wrote to memory of 4404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3608 wrote to memory of 4596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3608 wrote to memory of 4596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3608 wrote to memory of 4596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe

"C:\Users\Admin\AppData\Local\Temp\3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1652674.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1652674.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7031576.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7031576.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t5095424.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t5095424.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 21.177.190.20.in-addr.arpa udp
BE 2.17.196.82:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 82.196.17.2.in-addr.arpa udp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
SE 5.42.92.67:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1652674.exe

MD5 b33a76ffa9ae1087429f9def685bde06
SHA1 d8fbd884d71c20241790b2fe65a01407da960016
SHA256 08fd4b67e2c4c681d66a9e031505d3815724fbbc7bb9906191ede12fa50b0d36
SHA512 750d40a257cf79610d62cf41728f5cd0496868bf717990f9cafb89caebea83a0d1087c8df925fc9034deba67c89151a700633bec733b382dd2a6fc0ca515bef5

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe

MD5 df34836915cd0c4fac04cdda8f0f01e4
SHA1 d5f824885ea82cf1661102275ff53f5f5bde23e6
SHA256 0f108b013812de470eaceb9f7525b1bb6bde6988725f343aa26197babde7317e
SHA512 9a95b029acb09fd55a793f841031089fbda1fbd2a1be3cb7574b9e8636ed3cc3f3c3fb3900c421579312abdefa14f018d52c75aae37d31e1b4f84b54feee8e11

memory/4848-15-0x00007FF9F5CF3000-0x00007FF9F5CF5000-memory.dmp

memory/4848-14-0x00000000001D0000-0x00000000001DA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7031576.exe

MD5 75eb00dbd2e7aefceac0c339ecbdb0dd
SHA1 05c60327471f7d568f6d620127c6be4d46963e7e
SHA256 bc29c56cfe78572a037dd108e09bdb1ea50f2541edd52b1f7072538234ff9a9e
SHA512 bcc38dea1e25ab65dcd9aa6ee760dd20eb6312fc07b81229f851b2cca001c197a51c582277fa247a120d1267871f00ee5e34d6fc40a724c0a37cae5b425ada56

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t5095424.exe

MD5 6629bdfba4d480157fa8c7b4f30fb371
SHA1 35eb967b684a5e0f388445f9d84ca97c52c44aa2
SHA256 f96fe7f37dd628d744e39a0d2dbe2e0205c35039ec06c3117be112c05440d465
SHA512 cbe48a1d17d19c34e17aac1d78092c13b088eaf9032e3c7a6661f758604a5be1ec01555334ddfe0dfc655dd6c4ea42614f9d3a4a57d7570c60610fc43ddf348e

memory/1788-33-0x0000000000D90000-0x0000000000DC0000-memory.dmp

memory/1788-34-0x0000000005570000-0x0000000005576000-memory.dmp

memory/1788-35-0x0000000005D50000-0x0000000006368000-memory.dmp

memory/1788-36-0x0000000005840000-0x000000000594A000-memory.dmp

memory/1788-37-0x0000000005730000-0x0000000005742000-memory.dmp

memory/1788-38-0x0000000005790000-0x00000000057CC000-memory.dmp

memory/1788-39-0x00000000057D0000-0x000000000581C000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

101s

Command Line

"C:\Users\Admin\AppData\Local\Temp\55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1660 set thread context of 1256 N/A C:\Users\Admin\AppData\Local\Temp\55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1660 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe

"C:\Users\Admin\AppData\Local\Temp\55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1660 -ip 1660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 356

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.120:443 www.bing.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 120.196.17.2.in-addr.arpa udp
BE 2.17.196.120:443 www.bing.com tcp
US 8.8.8.8:53 omnomnom.top udp
DE 195.201.252.28:443 omnomnom.top tcp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
US 8.8.8.8:53 28.252.201.195.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

memory/1660-0-0x0000000000B81000-0x0000000000B82000-memory.dmp

memory/1256-1-0x0000000000400000-0x0000000000422000-memory.dmp

memory/1256-2-0x0000000074E5E000-0x0000000074E5F000-memory.dmp

memory/1256-3-0x0000000005100000-0x0000000005166000-memory.dmp

memory/1256-4-0x0000000005C10000-0x0000000006228000-memory.dmp

memory/1256-5-0x0000000005680000-0x0000000005692000-memory.dmp

memory/1256-6-0x00000000057B0000-0x00000000058BA000-memory.dmp

memory/1256-7-0x0000000074E50000-0x0000000075600000-memory.dmp

memory/1256-8-0x00000000065B0000-0x00000000065EC000-memory.dmp

memory/1256-9-0x00000000065F0000-0x000000000663C000-memory.dmp

memory/1256-10-0x0000000006930000-0x0000000006AF2000-memory.dmp

memory/1256-11-0x0000000007030000-0x000000000755C000-memory.dmp

memory/1256-12-0x0000000007B10000-0x00000000080B4000-memory.dmp

memory/1256-13-0x0000000006B00000-0x0000000006B92000-memory.dmp

memory/1256-14-0x0000000006BA0000-0x0000000006BF0000-memory.dmp

memory/1256-15-0x0000000006C70000-0x0000000006CE6000-memory.dmp

memory/1256-16-0x0000000006BF0000-0x0000000006C0E000-memory.dmp

memory/1256-18-0x0000000074E50000-0x0000000075600000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-09 11:12

Reported

2024-05-09 11:35

Platform

win10v2004-20240426-en

Max time kernel

145s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ac6f6a79014cf8f7e7574684eefac7be8456184590031637c4329470e2c2d66b.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7509987.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7509987.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7509987.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7509987.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7509987.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7509987.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4914254.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7509987.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\ac6f6a79014cf8f7e7574684eefac7be8456184590031637c4329470e2c2d66b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5679989.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7509987.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7509987.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7509987.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3772 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\ac6f6a79014cf8f7e7574684eefac7be8456184590031637c4329470e2c2d66b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5679989.exe
PID 3772 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\ac6f6a79014cf8f7e7574684eefac7be8456184590031637c4329470e2c2d66b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5679989.exe
PID 3772 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\ac6f6a79014cf8f7e7574684eefac7be8456184590031637c4329470e2c2d66b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5679989.exe
PID 3108 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5679989.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4914254.exe
PID 3108 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5679989.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4914254.exe
PID 3108 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5679989.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4914254.exe
PID 4592 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4914254.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4592 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4914254.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4592 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4914254.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3108 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5679989.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7509987.exe
PID 3108 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5679989.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7509987.exe
PID 3860 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3860 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3860 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3860 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3860 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3860 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 4244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 4244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 4244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3020 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3020 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3020 wrote to memory of 2072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3020 wrote to memory of 2072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3020 wrote to memory of 2072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3020 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 1860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3020 wrote to memory of 1860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3020 wrote to memory of 1860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3020 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3020 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3020 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3772 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\ac6f6a79014cf8f7e7574684eefac7be8456184590031637c4329470e2c2d66b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8502715.exe
PID 3772 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\ac6f6a79014cf8f7e7574684eefac7be8456184590031637c4329470e2c2d66b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8502715.exe
PID 3772 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\ac6f6a79014cf8f7e7574684eefac7be8456184590031637c4329470e2c2d66b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8502715.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ac6f6a79014cf8f7e7574684eefac7be8456184590031637c4329470e2c2d66b.exe

"C:\Users\Admin\AppData\Local\Temp\ac6f6a79014cf8f7e7574684eefac7be8456184590031637c4329470e2c2d66b.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5679989.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5679989.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4914254.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4914254.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7509987.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7509987.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8502715.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8502715.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.82:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 82.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
BE 2.17.196.82:443 www.bing.com tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5679989.exe

MD5 b7868e83bd3bfbf31c9783dbce6ca59f
SHA1 d37c96b80144094d739b79432152c507f6c6ad16
SHA256 533b488c388f3eb7a76a00e7b9c8b7a292aa66b879c91b63478789cf6e95febf
SHA512 56cb501cb2919ebb16ae106703ab971b9f142e4bacd24efdae09434b577e8b1ede86398577a289d78474c89b3930580d74ef4c2b87033d88e9890692c2860158

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4914254.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7509987.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/924-27-0x0000000000F80000-0x0000000000F8A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8502715.exe

MD5 0a210a494fa4d1c199e7ddca49407a59
SHA1 d34ee983eac407194e201bf023a3e28f3bbfff81
SHA256 41ddbda01e5d44628a25ea749b072153040aa970275142350114ea89b84a9ba2
SHA512 3a1f4bb5ac12773fc51ffc2cc50a86b7a65b098d41966c8cc36fc701ebdba438130027c581aaf33451bc6b2e5a66311a6ada615f877133958d54023b6bcd2afa

memory/4336-32-0x00000000000A0000-0x00000000000D0000-memory.dmp

memory/4336-33-0x0000000002490000-0x0000000002496000-memory.dmp

memory/4336-34-0x000000000A540000-0x000000000AB58000-memory.dmp

memory/4336-35-0x000000000A050000-0x000000000A15A000-memory.dmp

memory/4336-36-0x0000000009F90000-0x0000000009FA2000-memory.dmp

memory/4336-37-0x0000000009FF0000-0x000000000A02C000-memory.dmp

memory/4336-38-0x00000000044F0000-0x000000000453C000-memory.dmp