Malware Analysis Report

2024-08-06 19:32

Sample ID 240520-krpfmsch6x
Target 0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b.exe
SHA256 0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b
Tags
asyncrat darkcomet 2024+may3333-newcrt persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b

Threat Level: Known bad

The file 0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat darkcomet 2024+may3333-newcrt persistence rat trojan upx

Modifies WinLogon for persistence

AsyncRat

Darkcomet

Async RAT payload

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

UPX packed file

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Creates scheduled task(s)

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-20 08:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-20 08:50

Reported

2024-05-20 08:52

Platform

win7-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b.exe"

Signatures

AsyncRat

rat asyncrat

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\rar.exe" C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\Documents\rar.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodrvs.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\winrar = "C:\\Users\\Admin\\Documents\\rar.exe" C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\winrar = "C:\\Users\\Admin\\Documents\\rar.exe" C:\Users\Admin\Documents\rar.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodrvs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: 33 N/A C:\Users\Admin\Documents\rar.exe N/A
Token: 34 N/A C:\Users\Admin\Documents\rar.exe N/A
Token: 35 N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\audiodrvs.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\rar.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2412 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b.exe C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp
PID 2412 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b.exe C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp
PID 2412 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b.exe C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp
PID 2412 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b.exe C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp
PID 2596 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE
PID 2596 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE
PID 2596 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE
PID 2596 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE
PID 2596 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE
PID 2596 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE
PID 2596 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE
PID 2596 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE
PID 2716 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp
PID 2716 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp
PID 2716 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2596 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Windows\SysWOW64\notepad.exe
PID 2616 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE
PID 2616 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE
PID 2616 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE
PID 2616 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE
PID 2596 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Users\Admin\Documents\rar.exe
PID 2596 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Users\Admin\Documents\rar.exe
PID 2596 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Users\Admin\Documents\rar.exe
PID 2596 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp C:\Users\Admin\Documents\rar.exe
PID 2848 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE C:\Windows\SysWOW64\schtasks.exe
PID 2848 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE C:\Windows\SysWOW64\schtasks.exe
PID 2848 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE C:\Windows\SysWOW64\schtasks.exe
PID 2848 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE C:\Windows\SysWOW64\schtasks.exe
PID 2704 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp C:\Windows\System32\schtasks.exe
PID 2704 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp C:\Windows\System32\schtasks.exe
PID 2704 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp C:\Windows\System32\schtasks.exe
PID 2704 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp C:\Windows\system32\cmd.exe
PID 2704 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp C:\Windows\system32\cmd.exe
PID 2704 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp C:\Windows\system32\cmd.exe
PID 784 wrote to memory of 2312 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 784 wrote to memory of 2312 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 784 wrote to memory of 2312 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 784 wrote to memory of 2912 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\audiodrvs.exe
PID 784 wrote to memory of 2912 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\audiodrvs.exe
PID 784 wrote to memory of 2912 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\audiodrvs.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b.exe

"C:\Users\Admin\AppData\Local\Temp\0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b.exe"

C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp

"C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp"

C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE

"C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE"

C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE

"C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE"

C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp

"C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE

"C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE"

C:\Users\Admin\Documents\rar.exe

"C:\Users\Admin\Documents\rar.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "logons" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3BA9.tmp" /F

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'audiodrvs"' /tr "'C:\Users\Admin\AppData\Roaming\audiodrvs.exe"'

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp65F4.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\audiodrvs.exe

"C:\Users\Admin\AppData\Roaming\audiodrvs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 dgorijan20785.hopto.org udp
BE 172.111.233.238:35800 dgorijan20785.hopto.org tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
BE 172.111.233.238:4488 dgorijan20785.hopto.org tcp
BE 172.111.233.238:4488 dgorijan20785.hopto.org tcp
BE 172.111.233.238:4488 dgorijan20785.hopto.org tcp
BE 172.111.233.238:8808 dgorijan20785.hopto.org tcp

Files

memory/2412-0-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2412-2-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2412-1-0x00000000006BB000-0x00000000006BC000-memory.dmp

memory/2412-4-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2412-5-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2412-3-0x0000000000400000-0x00000000007956B4-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms22FB.tmp

MD5 89feeb6ec82c704b1771bfa2536bd401
SHA1 2ae958b6e74986696e412e313b5f0aee3756ba19
SHA256 9765068707da158f492b48d5628b3b6cc93dc34dd402d57c0b4ced60701e0b9a
SHA512 9ef8c9c1c9795cf4451dd577c2292171c7dccb9aa24447dff72de9e886e604638b32f637ba8e19cfc86c377fed7a97c56336a62f7edd6130d4a8b928f5bf0484

memory/2596-12-0x0000000000400000-0x000000000055B000-memory.dmp

memory/2596-13-0x0000000000400000-0x000000000055B000-memory.dmp

\Users\Admin\AppData\Local\Temp\CHROMEL.EXE

MD5 f6062ddb9cc2fad6e403b8b9dbe02df7
SHA1 efebcabb3902cdcc7b789786d96db2a93156b81a
SHA256 61309415bb524bba3d6065cf5df5ce2031ddde239c7f7864d0d2eaf31597a96c
SHA512 3d2473fd09d5d0a4a0f463ed84522165254880a6f94491b5c9a21fbbd39df4579980184fd838f75b3ad6457065c818c536447ae18c97eac29146cd8be5883040

\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE

MD5 b8eaef2339ba6bfac3648df30d041a95
SHA1 0833419f0da847383c0031611c69a87baa8f2d6d
SHA256 6ce2b4a0e176126f0899223eace35c31b544e46a2067b0ecf0adf8d06f87309d
SHA512 c265a39039c9dd8237fb10c26066ff7247babc727a556919f7673311dee1d38c3a52a2cf83e54f148401b984495b4e5636b8254388376e96f0a4e9a40cba6613

memory/2596-33-0x0000000003720000-0x0000000003801000-memory.dmp

memory/2716-37-0x0000000000400000-0x00000000004E05B0-memory.dmp

memory/2596-36-0x0000000003720000-0x0000000003801000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms25B9.tmp

MD5 194de251c043183099b2d6f7f5d1e09f
SHA1 dc477dfc0e090e8d7bd31fb808f59060dd2cf360
SHA256 12bee16f9692cb9a6d3713543cf998a4f953d0341f4e9c661748faef525d91e6
SHA512 6a1433b9bc070f18f60c3f115a1173e8979d211f6e97daf3fc7fe13f05ab15123874919418fc014fdd8af62c82426cb091b867b36a49fe7fc8fe929709b3a433

memory/2616-42-0x0000000001280000-0x00000000012EE000-memory.dmp

memory/2704-43-0x0000000000280000-0x0000000000292000-memory.dmp

memory/2616-44-0x00000000004C0000-0x00000000004C6000-memory.dmp

memory/2512-47-0x00000000000C0000-0x00000000000C1000-memory.dmp

memory/2512-75-0x0000000000160000-0x0000000000161000-memory.dmp

memory/2848-81-0x00000000000F0000-0x000000000015E000-memory.dmp

memory/2596-91-0x0000000005550000-0x00000000056AB000-memory.dmp

memory/2596-90-0x0000000005550000-0x00000000056AB000-memory.dmp

memory/2976-92-0x0000000000400000-0x000000000055B000-memory.dmp

memory/2596-94-0x0000000000400000-0x000000000055B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp3BA9.tmp

MD5 db5e3f14b64ed69affa1389010cd445e
SHA1 752719617c787dbb741cfd4e8a608dd2f578d4c9
SHA256 eaeea05441cdf6ec90fd034de26b0108920f2d625f308497ebe7c05be8b69cc4
SHA512 8ee07a3e1684fb72852ad954b985db0d5a3931be5037a1fa8cb62677401d52042d80a80f27e1692edfef1d9f15b1d0cb8b8633b0414727cd775b04c4bb5e7fa9

memory/2716-99-0x0000000000400000-0x00000000004E05B0-memory.dmp

memory/2976-100-0x0000000000400000-0x000000000055B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp65F4.tmp.bat

MD5 bf6d9c0fd98147073eb45f3e19ed871f
SHA1 f06ab0010a9e1449b57fdc306d5cdc7ae772f509
SHA256 c937a87d93b6b0f437c98883b757467a1b0e3a7762df4460be4928afc750a393
SHA512 7f3d6baec6119add34fd3ab786dbca442c4fa144484cf03785f0f862972c941e5fa67a81d4b5880c51552e4b24a1649e593fe0d638ba7b68b7b829adc5baf752

C:\Users\Admin\AppData\Roaming\audiodrvs.exe

MD5 f08e9401964961c64b904d6916e52a4f
SHA1 2d336f74e5f5e1db6bd08b72fec879689bb6f686
SHA256 22645233b67c800b20e095621f20fffc161ca6df0832d3f29e86d4f72b442572
SHA512 f1a26baa1d968eda8bf92012704d66c2231d44aba5b95ac6f8b01f265ff9a804417561a36686583e0725498d0f42edc4c0f5242119058ec5b6fea46dcc2c5a55

memory/2912-114-0x00000000010C0000-0x00000000010D2000-memory.dmp

memory/2976-115-0x0000000000400000-0x000000000055B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab8E5D.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-20 08:50

Reported

2024-05-20 08:52

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b.exe"

Signatures

AsyncRat

rat asyncrat

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\rar.exe" C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\Documents\rar.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodrvs.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winrar = "C:\\Users\\Admin\\Documents\\rar.exe" C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winrar = "C:\\Users\\Admin\\Documents\\rar.exe" C:\Users\Admin\Documents\rar.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodrvs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: 33 N/A C:\Users\Admin\Documents\rar.exe N/A
Token: 34 N/A C:\Users\Admin\Documents\rar.exe N/A
Token: 35 N/A C:\Users\Admin\Documents\rar.exe N/A
Token: 36 N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\audiodrvs.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\rar.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2316 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b.exe C:\Users\Admin\AppData\Local\Temp\sms4323.tmp
PID 2316 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b.exe C:\Users\Admin\AppData\Local\Temp\sms4323.tmp
PID 2316 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b.exe C:\Users\Admin\AppData\Local\Temp\sms4323.tmp
PID 4856 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE
PID 4856 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE
PID 4856 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE
PID 4856 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE
PID 4856 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE
PID 4392 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE C:\Users\Admin\AppData\Local\Temp\sms4527.tmp
PID 4392 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE C:\Users\Admin\AppData\Local\Temp\sms4527.tmp
PID 5052 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE
PID 5052 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE
PID 5052 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Windows\SysWOW64\notepad.exe
PID 4856 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Users\Admin\Documents\rar.exe
PID 4856 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Users\Admin\Documents\rar.exe
PID 4856 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\sms4323.tmp C:\Users\Admin\Documents\rar.exe
PID 4388 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE C:\Windows\SysWOW64\schtasks.exe
PID 4388 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE C:\Windows\SysWOW64\schtasks.exe
PID 4388 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE C:\Windows\SysWOW64\schtasks.exe
PID 3644 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp C:\Windows\System32\schtasks.exe
PID 3644 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp C:\Windows\System32\schtasks.exe
PID 3644 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp C:\Windows\system32\cmd.exe
PID 3644 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\sms4527.tmp C:\Windows\system32\cmd.exe
PID 1264 wrote to memory of 4912 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 1264 wrote to memory of 4912 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 1264 wrote to memory of 4376 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\audiodrvs.exe
PID 1264 wrote to memory of 4376 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\audiodrvs.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b.exe

"C:\Users\Admin\AppData\Local\Temp\0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b.exe"

C:\Users\Admin\AppData\Local\Temp\sms4323.tmp

"C:\Users\Admin\AppData\Local\Temp\sms4323.tmp"

C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE

"C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE"

C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE

"C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE"

C:\Users\Admin\AppData\Local\Temp\sms4527.tmp

"C:\Users\Admin\AppData\Local\Temp\sms4527.tmp"

C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE

"C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Users\Admin\Documents\rar.exe

"C:\Users\Admin\Documents\rar.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "logons" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5AC2.tmp" /F

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'audiodrvs"' /tr "'C:\Users\Admin\AppData\Roaming\audiodrvs.exe"'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp856C.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\audiodrvs.exe

"C:\Users\Admin\AppData\Roaming\audiodrvs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
BE 172.111.233.238:35800 dgorijan20785.hopto.org tcp
US 8.8.8.8:53 238.233.111.172.in-addr.arpa udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
BE 172.111.233.238:4488 dgorijan20785.hopto.org tcp
BE 172.111.233.238:4488 dgorijan20785.hopto.org tcp
BE 172.111.233.238:4488 dgorijan20785.hopto.org tcp
BE 172.111.233.238:7707 dgorijan20785.hopto.org tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
NL 23.62.61.171:443 www.bing.com tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 171.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/2316-0-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2316-1-0x00000000006BB000-0x00000000006BC000-memory.dmp

memory/2316-2-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2316-3-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2316-5-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2316-6-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2316-4-0x0000000000400000-0x00000000007956B4-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms4323.tmp

MD5 89feeb6ec82c704b1771bfa2536bd401
SHA1 2ae958b6e74986696e412e313b5f0aee3756ba19
SHA256 9765068707da158f492b48d5628b3b6cc93dc34dd402d57c0b4ced60701e0b9a
SHA512 9ef8c9c1c9795cf4451dd577c2292171c7dccb9aa24447dff72de9e886e604638b32f637ba8e19cfc86c377fed7a97c56336a62f7edd6130d4a8b928f5bf0484

memory/4856-11-0x0000000000400000-0x000000000055B000-memory.dmp

memory/4856-12-0x0000000000400000-0x000000000055B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE

MD5 f6062ddb9cc2fad6e403b8b9dbe02df7
SHA1 efebcabb3902cdcc7b789786d96db2a93156b81a
SHA256 61309415bb524bba3d6065cf5df5ce2031ddde239c7f7864d0d2eaf31597a96c
SHA512 3d2473fd09d5d0a4a0f463ed84522165254880a6f94491b5c9a21fbbd39df4579980184fd838f75b3ad6457065c818c536447ae18c97eac29146cd8be5883040

memory/4392-32-0x0000000000400000-0x00000000004E05B0-memory.dmp

C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE

MD5 b8eaef2339ba6bfac3648df30d041a95
SHA1 0833419f0da847383c0031611c69a87baa8f2d6d
SHA256 6ce2b4a0e176126f0899223eace35c31b544e46a2067b0ecf0adf8d06f87309d
SHA512 c265a39039c9dd8237fb10c26066ff7247babc727a556919f7673311dee1d38c3a52a2cf83e54f148401b984495b4e5636b8254388376e96f0a4e9a40cba6613

memory/5052-36-0x00000000734DE000-0x00000000734DF000-memory.dmp

memory/5052-38-0x0000000000760000-0x00000000007CE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms4527.tmp

MD5 194de251c043183099b2d6f7f5d1e09f
SHA1 dc477dfc0e090e8d7bd31fb808f59060dd2cf360
SHA256 12bee16f9692cb9a6d3713543cf998a4f953d0341f4e9c661748faef525d91e6
SHA512 6a1433b9bc070f18f60c3f115a1173e8979d211f6e97daf3fc7fe13f05ab15123874919418fc014fdd8af62c82426cb091b867b36a49fe7fc8fe929709b3a433

memory/3644-43-0x0000000000050000-0x0000000000062000-memory.dmp

memory/5052-44-0x00000000050C0000-0x00000000050C6000-memory.dmp

memory/1860-58-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PRINTSERV.EXE.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/4856-117-0x0000000000400000-0x000000000055B000-memory.dmp

memory/2316-118-0x0000000000400000-0x00000000007956B4-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5AC2.tmp

MD5 db5e3f14b64ed69affa1389010cd445e
SHA1 752719617c787dbb741cfd4e8a608dd2f578d4c9
SHA256 eaeea05441cdf6ec90fd034de26b0108920f2d625f308497ebe7c05be8b69cc4
SHA512 8ee07a3e1684fb72852ad954b985db0d5a3931be5037a1fa8cb62677401d52042d80a80f27e1692edfef1d9f15b1d0cb8b8633b0414727cd775b04c4bb5e7fa9

memory/4388-122-0x0000000005A60000-0x0000000005AC6000-memory.dmp

memory/4392-123-0x0000000000400000-0x00000000004E05B0-memory.dmp

memory/4936-124-0x0000000000400000-0x000000000055B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp856C.tmp.bat

MD5 c68fb8e143e12e69f31c83f949175a7d
SHA1 6e5d345c8b70e29529ec5ecfaa421299dba5c14f
SHA256 1e4a420ca8ccb21ffdb9ad22cad9a2addb9346aa83c36ac5d621ab6016e3b2e0
SHA512 13239917866b3a52566be890d556d7ea3deb0f0fccbe3eea2e50c86ade6e3f190fe16c6f7cd7e521696d761cfa65522adbe945cd3767bfa3805674a4f8e10860

C:\Users\Admin\AppData\Roaming\audiodrvs.exe

MD5 b66d6b47aafc5403cd9facb85167adc1
SHA1 ecbd2ed963c33db5cfff3ecb53d83df13933c2c2
SHA256 ddca7fa19730a59fc088ca18b24c30e485bf0f324784b8f0c8c588fbf4df0bac
SHA512 8d9a8c9dd3aaf7c42d1876cb5376ebc0d974bb5a9feb8879a18a34d59e1306276a23c251aad04e6e5f8490e570ffcd5a3aaeecd07838b418e9c51593ad0b03e6

memory/4936-134-0x0000000000400000-0x000000000055B000-memory.dmp