Malware Analysis Report

2024-11-16 13:38

Sample ID 240530-bnrxxsab28
Target 71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe
SHA256 71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d
Tags
agenttesla xworm keylogger persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d

Threat Level: Known bad

The file 71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe was found to be: Known bad.

Malicious Activity Summary

agenttesla xworm keylogger persistence rat spyware stealer trojan

AgentTesla

Xworm

Detect Xworm Payload

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects executables referencing many email and collaboration clients. Observed in information stealers

Detects executables referencing many file transfer clients. Observed in information stealers

Detects Windows executables referencing non-Windows User-Agents

Detects executables referencing Windows vault credential objects. Observed in infostealers

Detects executables using Telegram Chat Bot

Detect packed .NET executables. Mostly AgentTeslaV4.

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Detects executables packed with SmartAssembly

Checks computer location settings

Reads WinSCP keys stored on the system

Loads dropped DLL

Reads data files stored by FTP clients

Executes dropped EXE

Reads user/profile data of local email clients

Drops startup file

Reads user/profile data of web browsers

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-30 01:17

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 01:17

Reported

2024-05-30 01:20

Platform

win7-20240220-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Detect packed .NET executables. Mostly AgentTeslaV4.

Description Indicator Process Target
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables packed with SmartAssembly

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing Windows vault credential objects. Observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many email and collaboration clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many file transfer clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables using Telegram Chat Bot

Description Indicator Process Target
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Findo = "C:\\Users\\Admin\\AppData\\Roaming\\Findo.exe" C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Findo = "C:\\Users\\Admin\\AppData\\Roaming\\Findo.exe" C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2968 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 2968 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 2968 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 2968 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 2968 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2968 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2968 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2968 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2968 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2968 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2968 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2968 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2968 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2968 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2968 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2968 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2060 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2060 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2060 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2060 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2060 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2060 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2060 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2060 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2060 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2060 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2060 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2060 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe

"C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe"

C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe

"C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
CY 185.205.187.173:80 185.205.187.173 tcp
CY 185.205.187.173:80 185.205.187.173 tcp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.13.205:443 api.ipify.org tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
TR 178.215.236.251:717 tcp
TR 178.215.236.251:717 tcp
TR 178.215.236.251:717 tcp
TR 178.215.236.251:717 tcp

Files

memory/2968-0-0x000000007423E000-0x000000007423F000-memory.dmp

memory/2968-1-0x0000000000A30000-0x0000000000A64000-memory.dmp

memory/2968-2-0x0000000074230000-0x000000007491E000-memory.dmp

memory/2968-3-0x0000000006670000-0x00000000068B6000-memory.dmp

memory/2968-7-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-4-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-5-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-29-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-31-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-22-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-37-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-41-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-43-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-45-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-49-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-53-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-55-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-51-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-47-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-39-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-35-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-33-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-27-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-25-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-23-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-19-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-18-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-15-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-13-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-11-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-9-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-57-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-67-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-59-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-61-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-63-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-65-0x0000000006670000-0x00000000068B0000-memory.dmp

memory/2968-4890-0x0000000074230000-0x000000007491E000-memory.dmp

memory/2968-4892-0x0000000005610000-0x000000000565C000-memory.dmp

memory/2968-4891-0x0000000005B60000-0x0000000005BE2000-memory.dmp

memory/2060-4901-0x0000000001080000-0x00000000010B2000-memory.dmp

memory/2060-4902-0x0000000074230000-0x000000007491E000-memory.dmp

memory/2060-4903-0x0000000074230000-0x000000007491E000-memory.dmp

memory/2968-4900-0x0000000000A70000-0x0000000000AC4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe

MD5 f3578e8755842b11168c9cfe8d72f51e
SHA1 5973e517739c944d5e1e269f399e7bebf33fd172
SHA256 2376cb21ed4b8e05774a49512f21e1f4d3ca960df5d74865786774d000481f5b
SHA512 48b2ed8fe52bdf97d5be0d8ea75c1e4243ee2e282240041e7b7715db8dad4c5d3457a270d4b4b006b56a0641b839e54a24a879ddb4526e5e961d8700829d3a29

memory/1544-4916-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2968-4917-0x0000000074230000-0x000000007491E000-memory.dmp

memory/2060-4918-0x0000000006580000-0x00000000067A0000-memory.dmp

memory/2060-9805-0x00000000056C0000-0x000000000571C000-memory.dmp

memory/2060-9806-0x0000000074230000-0x000000007491E000-memory.dmp

memory/2060-9807-0x0000000074230000-0x000000007491E000-memory.dmp

\??\c:\users\admin\appdata\roaming\findo.exe

MD5 06f89bea6cec0ee3459c26732c6f4d40
SHA1 077c773301223d98b07630487facd24710353335
SHA256 71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d
SHA512 a172753e363467928c9bf700f36865eb53ab5ea85dcbf7bb3fa8bc756f130eacf3ba194f8b25707203b55e8b84a256f756e27a17cce4f81991e9cc2c31353d6b

memory/3344-9822-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2060-9823-0x0000000074230000-0x000000007491E000-memory.dmp

\Users\Admin\AppData\Roaming\XClient.exe

MD5 b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1 d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA256 6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512 b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 01:17

Reported

2024-05-30 01:20

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Detect packed .NET executables. Mostly AgentTeslaV4.

Description Indicator Process Target
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables packed with SmartAssembly

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing Windows vault credential objects. Observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many email and collaboration clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many file transfer clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables using Telegram Chat Bot

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Findo = "C:\\Users\\Admin\\AppData\\Roaming\\Findo.exe" C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Findo = "C:\\Users\\Admin\\AppData\\Roaming\\Findo.exe" C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4688 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 4688 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 4688 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 4688 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4688 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4688 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4688 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4688 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4688 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4688 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4688 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe

"C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe"

C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe

"C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
CY 185.205.187.173:80 185.205.187.173 tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 173.187.205.185.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
CY 185.205.187.173:80 185.205.187.173 tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.12.205:443 api.ipify.org tcp
US 8.8.8.8:53 205.12.26.104.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
TR 178.215.236.251:717 tcp
TR 178.215.236.251:717 tcp
US 8.8.8.8:53 93.65.42.20.in-addr.arpa udp

Files

memory/4688-0-0x000000007509E000-0x000000007509F000-memory.dmp

memory/4688-1-0x0000000000A70000-0x0000000000AA4000-memory.dmp

memory/4688-2-0x0000000075090000-0x0000000075840000-memory.dmp

memory/4688-3-0x0000000006560000-0x00000000067A6000-memory.dmp

memory/4688-4-0x0000000006D50000-0x00000000072F4000-memory.dmp

memory/4688-5-0x0000000006890000-0x0000000006922000-memory.dmp

memory/4688-15-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-9-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-21-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-35-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-45-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-63-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-69-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-67-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-65-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-61-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-59-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-57-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-55-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-53-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-52-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-49-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-47-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-43-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-41-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-37-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-33-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-31-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-29-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-27-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-25-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-23-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-39-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-19-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-17-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-13-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-11-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-7-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-6-0x0000000006560000-0x00000000067A0000-memory.dmp

memory/4688-4892-0x0000000075090000-0x0000000075840000-memory.dmp

memory/4688-4893-0x0000000005E70000-0x0000000005EF2000-memory.dmp

memory/4688-4894-0x0000000006460000-0x00000000064AC000-memory.dmp

memory/4688-4895-0x0000000006A30000-0x0000000006A96000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe

MD5 f3578e8755842b11168c9cfe8d72f51e
SHA1 5973e517739c944d5e1e269f399e7bebf33fd172
SHA256 2376cb21ed4b8e05774a49512f21e1f4d3ca960df5d74865786774d000481f5b
SHA512 48b2ed8fe52bdf97d5be0d8ea75c1e4243ee2e282240041e7b7715db8dad4c5d3457a270d4b4b006b56a0641b839e54a24a879ddb4526e5e961d8700829d3a29

memory/4688-4907-0x0000000006AA0000-0x0000000006AF4000-memory.dmp

memory/5068-4908-0x0000000000C50000-0x0000000000C82000-memory.dmp

memory/5068-4910-0x0000000075090000-0x0000000075840000-memory.dmp

memory/4688-4913-0x0000000075090000-0x0000000075840000-memory.dmp

memory/2192-4914-0x0000000075090000-0x0000000075840000-memory.dmp

memory/2192-4915-0x0000000000400000-0x0000000000440000-memory.dmp

memory/5068-4916-0x0000000006600000-0x0000000006820000-memory.dmp

memory/2192-5579-0x00000000063C0000-0x0000000006410000-memory.dmp

memory/2192-5722-0x0000000006430000-0x000000000643A000-memory.dmp

memory/5068-9805-0x0000000005F10000-0x0000000005F6C000-memory.dmp

memory/5068-9806-0x0000000075090000-0x0000000075840000-memory.dmp

memory/2192-9807-0x0000000075090000-0x0000000075840000-memory.dmp

\??\c:\users\admin\appdata\roaming\findo.exe

MD5 33d2128a357211d5e715744eacb02cd2
SHA1 5e65c9b2448699acce698bc583db4c9a0068f6ed
SHA256 f52a9d91629ba5fe8497ac97aa8268b1fc9560007fd227afc00bf4382b9711c5
SHA512 aaac8ff82c0b28baf69ec6813475e3c2dda71eb2b81b4d93080ce1af1a193863b2ba02194d6ced3d6a48715989f9fbb93bc69f32aea9ae42d05abef389c912dd

memory/2660-9813-0x0000000000400000-0x0000000000412000-memory.dmp

memory/5068-9812-0x0000000075090000-0x0000000075840000-memory.dmp

memory/2660-9814-0x00000000055B0000-0x000000000564C000-memory.dmp