Malware Analysis Report

2024-10-23 20:45

Sample ID 240528-qpbpnagc59
Target CalamityGenV3.EXE
SHA256 e0b81ce21a37cbd4db6f46e4e381ce0961fb8446a064a9a21e0565ea2789123c
Tags
njrat evasion persistence pyinstaller trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e0b81ce21a37cbd4db6f46e4e381ce0961fb8446a064a9a21e0565ea2789123c

Threat Level: Known bad

The file CalamityGenV3.EXE was found to be: Known bad.

Malicious Activity Summary

njrat evasion persistence pyinstaller trojan

njRAT/Bladabindi

Modifies Windows Firewall

Loads dropped DLL

Drops startup file

Executes dropped EXE

Adds Run key to start application

Detects Pyinstaller

Enumerates physical storage devices

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-28 13:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-28 13:25

Reported

2024-05-28 13:27

Platform

win11-20240426-en

Max time kernel

90s

Max time network

93s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CalamityGenV3.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b22a0109880b3427de44fee115dc40ce.exe C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\b22a0109880b3427de44fee115dc40ce.exe C:\Windows\system32\taskmgr.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b22a0109880b3427de44fee115dc40ce.exe C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b22a0109880b3427de44fee115dc40ce = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServices.exe\" .." C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\CalamityGenV3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FINALF~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\final.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\Windows\CurrentVersion\Run\b22a0109880b3427de44fee115dc40ce = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServices.exe\" .." C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2532 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\CalamityGenV3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FINALF~1.EXE
PID 2532 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\CalamityGenV3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FINALF~1.EXE
PID 2076 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FINALF~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\final.EXE
PID 2076 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FINALF~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\final.EXE
PID 4280 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\final.EXE C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe
PID 4280 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\final.EXE C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe
PID 4280 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\final.EXE C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe
PID 1992 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
PID 1992 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
PID 1992 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
PID 4280 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\final.EXE C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\calamity.exe
PID 4280 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\final.EXE C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\calamity.exe
PID 4280 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\final.EXE C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\calamity.exe
PID 1144 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\calamity.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\calamity.exe
PID 1144 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\calamity.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\calamity.exe
PID 1144 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\calamity.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\calamity.exe
PID 2644 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe C:\Windows\SysWOW64\netsh.exe
PID 2644 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe C:\Windows\SysWOW64\netsh.exe
PID 2644 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\CalamityGenV3.exe

"C:\Users\Admin\AppData\Local\Temp\CalamityGenV3.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FINALF~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FINALF~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\final.EXE

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\final.EXE

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe

C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe

"C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\calamity.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\calamity.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\calamity.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\calamity.exe

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /0

Network

Country Destination Domain Proto
NL 91.92.241.69:5555 tcp
US 8.8.8.8:53 69.241.92.91.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FINALF~1.EXE

MD5 ff9562b017a9f22fe6023cb1838d3eff
SHA1 32779ede68f21f18be5cc73d81d1282032f76692
SHA256 b999d927cee769116b141095c0a849bc0c471376af46f53cf01d764ac5a0ab3a
SHA512 b438190c86a0a66adced252a1cc61d8f6a2caf7aa25aaa7bffacf1ef8e76aba6f68e1319785b71523f51321f2db0db6bc8937517d25c8f4a6ea6559f55661351

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\final.EXE

MD5 9626602578e06939e96866cb6906f3ba
SHA1 50c1691c07c1c79e55a0689169cb8d34055242bd
SHA256 c3f4894018c829fcb8bacb62e4079d4895f963b9e94dfaaefefec7a7c6e8fa74
SHA512 2debddccc8bd79fd9598bc6a24e0440534f8e22088bf235d03757774543e502ec43f651593c2bd05922f53817392c5e97fc2824c074ef833d82b90ed55a7f162

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Client.exe

MD5 2560eaeea2f78be73934dff77dc21115
SHA1 47da9e0270fdd3c762dcb371614eaf4ff67add03
SHA256 c5bbe1f75d15903b38f0c1e944b8205dcbbb8033206b22921ad90bc64b0699e6
SHA512 5ac9af16716e2e9ffa1cec0f74f273468789caf157ddfe7cbf20e6efdf03ad5f0c86d46bf8944c15a79c8d890ec4f683a9c4758c44c3ce5a5f0d3915f9fe977c

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\calamity.exe

MD5 b4e12983731d4ad7ee395bdf56a7fa45
SHA1 27ca32c0a036ba8fa88eccb91a76e75f9574c3c5
SHA256 be9c34f35b051d3ac630dd6c2e135ff18c528f844fcf1260e79cc7b8e1923089
SHA512 9263b65e47424c3a2b9b067bf455be472774edf1d055bb85190117506f7e7ecc1536de81ee7a2813e81499472db9a5d5c86686510046856e0870476382b3de38

C:\Users\Admin\AppData\Local\Temp\_MEI11442\python311.dll

MD5 b8769a867abc02bfdd8637bea508cab2
SHA1 782f5fb799328c001bca77643e31fb7824f9d8cc
SHA256 9cf39945840ee8d769e47ffdb554044550b5843b29c68fa3849ba9376c3a7ec8
SHA512 bf01e343877a92d458373c02a9d64426118915ade324cf12d6ff200970da641358e8f362732cd9a8508845e367313c9bab2772d59a9ae8d934cd0dd7d28535b3

C:\Users\Admin\AppData\Local\Temp\_MEI11442\VCRUNTIME140.dll

MD5 1e6e97d60d411a2dee8964d3d05adb15
SHA1 0a2fe6ec6b6675c44998c282dbb1cd8787612faf
SHA256 8598940e498271b542f2c04998626aa680f2172d0ff4f8dbd4ffec1a196540f9
SHA512 3f7d79079c57786051a2f7facfb1046188049e831f12b549609a8f152664678ee35ad54d1fff4447428b6f76bea1c7ca88fa96aab395a560c6ec598344fcc7fa

C:\Users\Admin\AppData\Local\Temp\_MEI11442\base_library.zip

MD5 83d235e1f5b0ee5b0282b5ab7244f6c4
SHA1 629a1ce71314d7abbce96674a1ddf9f38c4a5e9c
SHA256 db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0
SHA512 77364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f

C:\Users\Admin\AppData\Local\Temp\_MEI11442\select.pyd

MD5 aae48cf580702fec3a79524d1721305c
SHA1 33f68231ff3e82adc90c3c9589d5cc918ad9c936
SHA256 93b2b54c80d03ff7ade5fe4cd03baed8c5b5a8e1edcd695a53bae2e369006265
SHA512 1c826364015684bb3fb36ce1fcb608da88f4c74b0eec6b53f4ca07b5ea99fee8b4e318c1570ce358cefd6b7bdf21b046b1375c3d687f6d0d08bf7b955568a1c6

C:\Users\Admin\AppData\Local\Temp\_MEI11442\_socket.pyd

MD5 b55ce33c6ba6d7af221f3d8b1a30a6f7
SHA1 b8696ed5b7a52c9bfda5c1ea4bd43a9ecc17fed0
SHA256 ec5817b46539f9a5cbf1525cf7c714bc0e9f5a918fc4b963dec9c301b86c7d1f
SHA512 4d15d90dd2bacc8c9537533b1267455fbc030e38546c1f6f4eb7dabe690c744471bd45c079f0c711b9eca330f1a413ea37fc6b08810854d5f51b69b19e991462

C:\Users\Admin\AppData\Local\Temp\_MEI11442\_lzma.pyd

MD5 b4251ed45538a2a7d79737db8fb139db
SHA1 cded1a4637e7e18684d89cd34c73cfae424183e6
SHA256 caad390c4c3c6b1e50a33754a0af7d2c3f4b1245c8ead79ff7f7be0e5654e210
SHA512 d40f7de85c8dbb3e16135e1f8d8ce829cb681eaab49c6f4c40792fa8f733743df70cfa7c6224e06bff68214069f90cd960970ac47d0348e9827a2136789c43c1

C:\Users\Admin\AppData\Local\Temp\_MEI11442\_hashlib.pyd

MD5 303a1d7d21ca6e625950a966d17f86be
SHA1 660aaad68207dc0a4d757307ad57e86b120f2d91
SHA256 53180306bad339e76cc427009db15f124f49d4c879676258264365a7e2ed703f
SHA512 99036d59cad6f286e8f901acadcc7db192bb385699228b1b34907ea49fb5ff07b636550c04f0d4b70f161a26ea2e58794d9080d69d053ada08d2ad9bd3f861df

C:\Users\Admin\AppData\Local\Temp\_MEI11442\_decimal.pyd

MD5 bcdbf3a04a8bfd8c8a9624996735fc1a
SHA1 08d35c136fe5c779b67f56ae7165b394d5c8d8ef
SHA256 1f6db9be716626f6803cefd646fbbc478878c6acce597d9f6c5776dc7b69d3c7
SHA512 d22195c0a0535f7986d0a6d0bb820d36c8824a0b15378cb5d5ab0f334064896e0d64ed880d706f80e0b96d022631fc6b4fcc47371ca1d5cdd2c37dd75c62274b

C:\Users\Admin\AppData\Local\Temp\_MEI11442\_bz2.pyd

MD5 f73ea2b834471fb01d491a65caa1eea3
SHA1 00e888645e0a1638c639a2c21df04a3baa4c640a
SHA256 8633e8ad7172b095ed7ba40fa1039a64b04b20e6f42ac428e103d0c793831bda
SHA512 b8329b33d78458c2ac7979a5c5a19bd37ea9a473682d23faf54e77cfc5edadc0426490add9864e99a719ac5b4a57c5326ed82496adf80afd1876577caa608418

C:\Users\Admin\AppData\Local\Temp\_MEI11442\unicodedata.pyd

MD5 b98d5dd9980b29ce394675dc757509b8
SHA1 7a3ad4947458baa61de998bc8fde1ef736a3a26c
SHA256 1498105d00434a5ebbaa6bee2e5f5677c34a948b2073d789f4d4b5968a4c8aaf
SHA512 ba7e52deaf88aab062646d6a70f9e15016fcbdcf55a4f16d8c73ea6a63ad591eb3b623514a9fecc03188b1d1eb55a6b168da55bb035dc7d605cae53def2b65f2

C:\Users\Admin\AppData\Local\Temp\_MEI11442\libcrypto-1_1.dll

MD5 90311ea0cc27e27d2998969c57eba038
SHA1 4653f1261fb7b16bc64c72833cfb93f0662d6f6d
SHA256 239d518dd67d8c2bbf6aeaded86ed464865e914db6bf3b115973d525ebd7d367
SHA512 6e2f839fb8d7aaab0b51778670da104c36355e22991eae930d2eaecabab45b40fda5e2317f1c928a803146855ac5553e4e464a65213696311c206bec926775d8

memory/4496-60-0x000001A8CBC70000-0x000001A8CBC71000-memory.dmp

memory/4496-59-0x000001A8CBC70000-0x000001A8CBC71000-memory.dmp

memory/4496-58-0x000001A8CBC70000-0x000001A8CBC71000-memory.dmp

memory/4496-70-0x000001A8CBC70000-0x000001A8CBC71000-memory.dmp

memory/4496-69-0x000001A8CBC70000-0x000001A8CBC71000-memory.dmp

memory/4496-68-0x000001A8CBC70000-0x000001A8CBC71000-memory.dmp

memory/4496-67-0x000001A8CBC70000-0x000001A8CBC71000-memory.dmp

memory/4496-66-0x000001A8CBC70000-0x000001A8CBC71000-memory.dmp

memory/4496-65-0x000001A8CBC70000-0x000001A8CBC71000-memory.dmp

memory/4496-64-0x000001A8CBC70000-0x000001A8CBC71000-memory.dmp