Malware Analysis Report

2024-12-08 02:11

Sample ID 240516-plkygscc7y
Target 66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882
SHA256 66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882
Tags
glupteba discovery dropper evasion execution loader persistence rootkit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882

Threat Level: Known bad

The file 66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit

Glupteba

Glupteba payload

Modifies Windows Firewall

Executes dropped EXE

Manipulates WinMonFS driver.

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Creates scheduled task(s)

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 12:25

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 12:25

Reported

2024-05-16 12:27

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2460 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2460 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2460 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3456 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3456 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3456 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3456 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\system32\cmd.exe
PID 3456 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\system32\cmd.exe
PID 3684 wrote to memory of 4516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3684 wrote to memory of 4516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3456 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3456 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3456 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3456 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3456 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3456 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3456 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\rss\csrss.exe
PID 3456 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\rss\csrss.exe
PID 3456 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\rss\csrss.exe
PID 4856 wrote to memory of 2628 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4856 wrote to memory of 2628 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4856 wrote to memory of 2628 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4856 wrote to memory of 4312 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4856 wrote to memory of 4312 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4856 wrote to memory of 4312 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4856 wrote to memory of 1724 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4856 wrote to memory of 1724 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4856 wrote to memory of 1724 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4856 wrote to memory of 3088 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4856 wrote to memory of 3088 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe

"C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe

"C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 146.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 260bf36f-f5ae-4530-bfcd-3f3e88308f2a.uuid.allstatsin.ru udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 32.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 stun2.l.google.com udp
US 8.8.8.8:53 server3.allstatsin.ru udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun2.l.google.com udp
BG 185.82.216.104:443 server3.allstatsin.ru tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 104.216.82.185.in-addr.arpa udp
BG 185.82.216.104:443 server3.allstatsin.ru tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
BG 185.82.216.104:443 server3.allstatsin.ru tcp
US 8.8.8.8:53 24.173.189.20.in-addr.arpa udp

Files

memory/2460-1-0x0000000002940000-0x0000000002D3E000-memory.dmp

memory/2460-2-0x0000000002D40000-0x000000000362B000-memory.dmp

memory/2460-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4512-4-0x0000000074EFE000-0x0000000074EFF000-memory.dmp

memory/4512-5-0x0000000002BF0000-0x0000000002C26000-memory.dmp

memory/4512-6-0x0000000074EF0000-0x00000000756A0000-memory.dmp

memory/4512-7-0x0000000005490000-0x0000000005AB8000-memory.dmp

memory/4512-8-0x0000000074EF0000-0x00000000756A0000-memory.dmp

memory/4512-9-0x0000000005230000-0x0000000005252000-memory.dmp

memory/4512-10-0x00000000053D0000-0x0000000005436000-memory.dmp

memory/4512-11-0x0000000005AC0000-0x0000000005B26000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_41c35gjh.bx1.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4512-21-0x0000000005BD0000-0x0000000005F24000-memory.dmp

memory/4512-23-0x0000000006220000-0x000000000626C000-memory.dmp

memory/4512-22-0x00000000061F0000-0x000000000620E000-memory.dmp

memory/4512-24-0x0000000006600000-0x0000000006644000-memory.dmp

memory/4512-25-0x0000000007300000-0x0000000007376000-memory.dmp

memory/4512-26-0x0000000007A00000-0x000000000807A000-memory.dmp

memory/4512-27-0x00000000073B0000-0x00000000073CA000-memory.dmp

memory/4512-29-0x0000000070D90000-0x0000000070DDC000-memory.dmp

memory/4512-28-0x0000000007770000-0x00000000077A2000-memory.dmp

memory/4512-31-0x00000000714D0000-0x0000000071824000-memory.dmp

memory/4512-30-0x0000000074EF0000-0x00000000756A0000-memory.dmp

memory/4512-42-0x00000000077D0000-0x0000000007873000-memory.dmp

memory/4512-41-0x00000000077B0000-0x00000000077CE000-memory.dmp

memory/4512-43-0x00000000078C0000-0x00000000078CA000-memory.dmp

memory/4512-44-0x0000000074EF0000-0x00000000756A0000-memory.dmp

memory/4512-45-0x0000000008080000-0x0000000008116000-memory.dmp

memory/4512-46-0x0000000007900000-0x0000000007911000-memory.dmp

memory/4512-47-0x0000000007940000-0x000000000794E000-memory.dmp

memory/4512-48-0x0000000007950000-0x0000000007964000-memory.dmp

memory/4512-49-0x00000000079A0000-0x00000000079BA000-memory.dmp

memory/4512-50-0x0000000007990000-0x0000000007998000-memory.dmp

memory/4512-53-0x0000000074EF0000-0x00000000756A0000-memory.dmp

memory/3456-55-0x0000000002920000-0x0000000002D26000-memory.dmp

memory/3456-56-0x0000000002D30000-0x000000000361B000-memory.dmp

memory/2336-66-0x0000000005C60000-0x0000000005FB4000-memory.dmp

memory/2336-67-0x0000000070D90000-0x0000000070DDC000-memory.dmp

memory/2336-68-0x0000000070F10000-0x0000000071264000-memory.dmp

memory/2336-78-0x0000000007320000-0x00000000073C3000-memory.dmp

memory/2336-79-0x0000000007640000-0x0000000007651000-memory.dmp

memory/2336-80-0x0000000007690000-0x00000000076A4000-memory.dmp

memory/2460-82-0x0000000002940000-0x0000000002D3E000-memory.dmp

memory/2460-81-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/624-86-0x0000000005FF0000-0x0000000006344000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 41cdeff337396b2ef45f0c89f7c5067a
SHA1 18d5e11973cee4a708cb53835b0a33de6b0749e3
SHA256 af7d6eb62a086c1224b15e2796b81541c9f14c5109d41b887ac3539c079e641f
SHA512 d21635893569fcfa0c2c8abcb8a5c6e7f98f8e02b726292efe82b1f6f2b0d8adfb3726af8a99ef3cabb47c4bacbfc0ad4b7269b0903886324370453f7507ee25

memory/624-97-0x0000000070D90000-0x0000000070DDC000-memory.dmp

memory/624-98-0x0000000071510000-0x0000000071864000-memory.dmp

memory/2460-108-0x0000000002D40000-0x000000000362B000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4a603392beda3563df2a5945245555fe
SHA1 2fc3e55c1187abbf72eee5e8d09fbddc7427fb47
SHA256 143b8e8029685ecb0fd97042dcc5913272373d6b095e1581c103b266146561ba
SHA512 f67399f87c7afd3ab0e7b28dff10a2bb2a0a47bfda4e11b3c303dc5d30efe9eae69f57c52c410028c2767d65baf035ab7eb7af52df56c42affd81aed1905fb8a

memory/3820-120-0x0000000070D90000-0x0000000070DDC000-memory.dmp

memory/3820-121-0x0000000071510000-0x0000000071864000-memory.dmp

memory/3456-133-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 39d996857eeacf39c33ec907b00aefaf
SHA1 618d7b7b56b3bc806b8e8e65dfdf82d66a216cb7
SHA256 66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882
SHA512 136d3e5ce2e441d3716a93b0e196ff28c1e12c2406a025219fd6af9507509c74784173807557ec1f3a3e17ad6281c4389093ec424cc0ad9f1da1cfeddb304b31

memory/3456-135-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 1debe6f0b8a6dc9dae7aff49c1b79c98
SHA1 77b67a675f75e3b45abe3080870f7cd930c26ad5
SHA256 9761503aa48d693c39ed9aa7cd807862ae5b0758d62c5d0dc460b9f087a1be56
SHA512 9db40b70bbcb6fe176dcd93a32c2cf725d764d579f2e59ab2f90008a958c5fc51636ca05efbb469659decdb7dee2e47946ff1a869881fe1b431f9710a807854e

memory/2628-150-0x0000000070D90000-0x0000000070DDC000-memory.dmp

memory/2628-151-0x0000000071510000-0x0000000071864000-memory.dmp

memory/4312-171-0x0000000005CA0000-0x0000000005FF4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 0b5cf515dd767c3e36e577e4b53846f8
SHA1 e47a58e3d15f1eaeae9e2c7b282d9d72b0b00eb7
SHA256 d8125ce02cab33469e9a333e1faa849821d73348dacd0e69ae37fea260e161e3
SHA512 9da2648dd7d282f81be6ebb5eed86ec708887b7a2e777c345677d8ec8b534952c706e16cd8d04e25dad28ef0fb15b3cf6fdcb03b0015c4ec894259815048d6ee

memory/4312-173-0x0000000006770000-0x00000000067BC000-memory.dmp

memory/4312-174-0x0000000070CB0000-0x0000000070CFC000-memory.dmp

memory/4312-175-0x0000000070E40000-0x0000000071194000-memory.dmp

memory/4312-185-0x0000000007450000-0x00000000074F3000-memory.dmp

memory/4312-186-0x0000000007770000-0x0000000007781000-memory.dmp

memory/4312-187-0x0000000006020000-0x0000000006034000-memory.dmp

memory/1724-189-0x0000000005900000-0x0000000005C54000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6e1d1ee48d5e7a1792fea280593ddd7b
SHA1 5014824a6aff0f400cc5cbfb316492c5dc107653
SHA256 7254db2b50f304436ae2d255d98823ad7d01bdc2dce3575b06e8ba7918b83f63
SHA512 4c31dcd01f3379d499b11448058071f3dc668089955b2fa9dbaadb33ad91ccdf497c30cac76d78827328fbd1e3dc73122fb341e8e94ef63b87e45af7582d52ce

memory/1724-200-0x0000000070CB0000-0x0000000070CFC000-memory.dmp

memory/1724-201-0x0000000071440000-0x0000000071794000-memory.dmp

memory/4856-213-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4856-219-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4856-221-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4856-223-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4856-226-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4856-227-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4856-229-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4856-231-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4856-234-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4856-235-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4856-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4856-239-0x0000000000400000-0x0000000000D1C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 12:25

Reported

2024-05-16 12:27

Platform

win11-20240508-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2864 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2864 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2864 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4276 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4276 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4276 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4276 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\system32\cmd.exe
PID 4276 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\system32\cmd.exe
PID 3636 wrote to memory of 4408 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3636 wrote to memory of 4408 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4276 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4276 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4276 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4276 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4276 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4276 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4276 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\rss\csrss.exe
PID 4276 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\rss\csrss.exe
PID 4276 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe C:\Windows\rss\csrss.exe
PID 2472 wrote to memory of 3732 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2472 wrote to memory of 3732 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2472 wrote to memory of 3732 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2472 wrote to memory of 4092 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2472 wrote to memory of 4092 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2472 wrote to memory of 4092 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2472 wrote to memory of 1524 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2472 wrote to memory of 1524 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2472 wrote to memory of 1524 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2472 wrote to memory of 3420 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2472 wrote to memory of 3420 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe

"C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe

"C:\Users\Admin\AppData\Local\Temp\66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 162.159.130.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun1.l.google.com udp
BG 185.82.216.104:443 server12.allstatsin.ru tcp
BG 185.82.216.104:443 server12.allstatsin.ru tcp
BG 185.82.216.104:443 server12.allstatsin.ru tcp

Files

memory/2864-1-0x0000000002A20000-0x0000000002E21000-memory.dmp

memory/2864-2-0x0000000002E30000-0x000000000371B000-memory.dmp

memory/2864-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3740-4-0x0000000074AAE000-0x0000000074AAF000-memory.dmp

memory/3740-5-0x00000000025F0000-0x0000000002626000-memory.dmp

memory/3740-6-0x0000000074AA0000-0x0000000075251000-memory.dmp

memory/3740-7-0x0000000004D90000-0x00000000053BA000-memory.dmp

memory/3740-8-0x0000000074AA0000-0x0000000075251000-memory.dmp

memory/3740-9-0x0000000004D00000-0x0000000004D22000-memory.dmp

memory/3740-10-0x00000000054F0000-0x0000000005556000-memory.dmp

memory/3740-11-0x0000000005560000-0x00000000055C6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cjojt14e.kdu.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3740-20-0x00000000055D0000-0x0000000005927000-memory.dmp

memory/3740-21-0x0000000005AB0000-0x0000000005ACE000-memory.dmp

memory/3740-22-0x0000000005AD0000-0x0000000005B1C000-memory.dmp

memory/3740-23-0x0000000005F80000-0x0000000005FC6000-memory.dmp

memory/3740-26-0x0000000070E90000-0x00000000711E7000-memory.dmp

memory/3740-25-0x0000000070D10000-0x0000000070D5C000-memory.dmp

memory/3740-35-0x0000000006F00000-0x0000000006F1E000-memory.dmp

memory/3740-37-0x0000000074AA0000-0x0000000075251000-memory.dmp

memory/3740-36-0x0000000006F20000-0x0000000006FC4000-memory.dmp

memory/3740-24-0x0000000006EA0000-0x0000000006ED4000-memory.dmp

memory/3740-38-0x0000000074AA0000-0x0000000075251000-memory.dmp

memory/3740-39-0x0000000007690000-0x0000000007D0A000-memory.dmp

memory/3740-40-0x0000000007050000-0x000000000706A000-memory.dmp

memory/3740-41-0x0000000007090000-0x000000000709A000-memory.dmp

memory/3740-42-0x0000000007150000-0x00000000071E6000-memory.dmp

memory/3740-43-0x00000000070C0000-0x00000000070D1000-memory.dmp

memory/3740-44-0x0000000007100000-0x000000000710E000-memory.dmp

memory/3740-45-0x0000000007110000-0x0000000007125000-memory.dmp

memory/3740-46-0x0000000007210000-0x000000000722A000-memory.dmp

memory/3740-47-0x00000000071F0000-0x00000000071F8000-memory.dmp

memory/3740-50-0x0000000074AA0000-0x0000000075251000-memory.dmp

memory/4276-52-0x0000000002A20000-0x0000000002E25000-memory.dmp

memory/4772-61-0x0000000006360000-0x00000000066B7000-memory.dmp

memory/4772-62-0x0000000070D10000-0x0000000070D5C000-memory.dmp

memory/4772-63-0x0000000070F60000-0x00000000712B7000-memory.dmp

memory/4772-72-0x0000000007AD0000-0x0000000007B74000-memory.dmp

memory/4772-73-0x0000000007E00000-0x0000000007E11000-memory.dmp

memory/2864-75-0x0000000002A20000-0x0000000002E21000-memory.dmp

memory/2864-74-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4772-76-0x0000000007E50000-0x0000000007E65000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d4b44d2e7192826bf5fe66af104043b8
SHA1 f542191ce9bdfa28eafc113503539cc29c6e02cb
SHA256 d8a5042812c8fa19b76cf4b6905f4f67d36140624ec5931649307bf03f1ee32e
SHA512 e6fef08b002fc880734a906d3543484ea621e36bba6b220ea9f7bf12053636f1d53a64a34abde2a8f6c0268088d844f04ee9abc64c036f371b8fa2a14fbb2483

memory/2864-89-0x0000000002E30000-0x000000000371B000-memory.dmp

memory/1276-90-0x0000000070D10000-0x0000000070D5C000-memory.dmp

memory/1276-91-0x0000000070E90000-0x00000000711E7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7a39d6711dff4d9e78fedb5c3d1cf941
SHA1 aa95df82a11f1b0986e3b79516e6b629b4861ed3
SHA256 84efef7541870e19adc505ed561a4d3673343082ec78c84abccd74b8b93da842
SHA512 37e83372295383921aacf15ae990525125f527fe204d6c314e304adf135b5cb74e440598c7dcb8e0903d858c6edd17cb310dd2916bd7534062aa53453b7764fc

memory/1448-110-0x0000000070D10000-0x0000000070D5C000-memory.dmp

memory/1448-111-0x0000000070E90000-0x00000000711E7000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 39d996857eeacf39c33ec907b00aefaf
SHA1 618d7b7b56b3bc806b8e8e65dfdf82d66a216cb7
SHA256 66d087ead6b6dc3275d4b08726df6af1499fbf8867476667fdb62b8ecfaca882
SHA512 136d3e5ce2e441d3716a93b0e196ff28c1e12c2406a025219fd6af9507509c74784173807557ec1f3a3e17ad6281c4389093ec424cc0ad9f1da1cfeddb304b31

memory/4276-126-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 8fc875fcbe54e786fc42890f49063455
SHA1 efea617f5f83aef365270fb3b1e7ed2f752ad5ef
SHA256 af0319c9fd9e1bc3da711c5d4ec0dc6854e3600942c0c2541f47174cddadb09d
SHA512 eef2cd4ffa3106948247ad48c5825535d126b3d8c25c2b2bac2d2660320d6aed88067b8f2fbbce0b3f0ab6b5effa359be9f22656b6eedb21f588d4cdea58be27

memory/3732-136-0x0000000070D10000-0x0000000070D5C000-memory.dmp

memory/3732-137-0x0000000070E90000-0x00000000711E7000-memory.dmp

memory/4092-156-0x0000000005880000-0x0000000005BD7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 9fbb7ca13f00c7cf834af14ead112aea
SHA1 85f90b0bc74f0b8f83d7bc3306baa8a19589202d
SHA256 df0f347a65ef332182c97393408f4e0ac64ff2e4c42d1b703eaec93d530b83e7
SHA512 b2b1766b65611c9449ca6196893df41ed02de7dc6ef3bd579b5afd789c49667138dd489859a9cdbb648938f8222f2bc412b744474eef373d8ea10d45e1c7e38a

memory/4092-158-0x0000000006260000-0x00000000062AC000-memory.dmp

memory/4092-160-0x0000000070DB0000-0x0000000071107000-memory.dmp

memory/4092-159-0x0000000070C30000-0x0000000070C7C000-memory.dmp

memory/4092-169-0x0000000006F40000-0x0000000006FE4000-memory.dmp

memory/4092-170-0x0000000007290000-0x00000000072A1000-memory.dmp

memory/4092-171-0x00000000057B0000-0x00000000057C5000-memory.dmp

memory/1524-181-0x0000000006290000-0x00000000065E7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 a57c6a1164ab82280671bb8b00df5534
SHA1 276ff3106d6456873fbbff6f2596cdbd7132a2c5
SHA256 f1eea7ea73157615a9b20a6b38aa44447ae83278e2a2afec89d6fbe91a2279a6
SHA512 001bb89e4958313317e725fec37d0f56b8823f2413e8c3c1549f70b7d9e7211144f652a5e82768720732e8be9814af50d63debbefc5ec8ab0a224eb73c578cbc

memory/1524-184-0x0000000070E40000-0x0000000071197000-memory.dmp

memory/1524-183-0x0000000070C30000-0x0000000070C7C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2472-201-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4276-202-0x0000000002A20000-0x0000000002E25000-memory.dmp

memory/2472-205-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2472-208-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2472-210-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2472-213-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2472-217-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2472-220-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2472-222-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2472-226-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2472-229-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2472-232-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2472-234-0x0000000000400000-0x0000000000D1C000-memory.dmp