Malware Analysis Report

2024-09-22 07:14

Sample ID 240530-ymp39sgh5w
Target 255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553
SHA256 255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553
Tags
rat default asyncrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553

Threat Level: Known bad

The file 255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553 was found to be: Known bad.

Malicious Activity Summary

rat default asyncrat

Asyncrat family

Detects executables attemping to enumerate video devices using WMI

Async RAT payload

AsyncRat

Async RAT payload

Detects executables attemping to enumerate video devices using WMI

Checks computer location settings

Executes dropped EXE

Enumerates physical storage devices

Unsigned PE

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-30 19:54

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Detects executables attemping to enumerate video devices using WMI

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 19:54

Reported

2024-05-30 19:56

Platform

win7-20240508-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Detects executables attemping to enumerate video devices using WMI

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2104 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe C:\Windows\System32\cmd.exe
PID 2104 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe C:\Windows\System32\cmd.exe
PID 2104 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe C:\Windows\System32\cmd.exe
PID 2104 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe C:\Windows\system32\cmd.exe
PID 2104 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe C:\Windows\system32\cmd.exe
PID 2104 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe C:\Windows\system32\cmd.exe
PID 2288 wrote to memory of 2616 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2288 wrote to memory of 2616 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2288 wrote to memory of 2616 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2248 wrote to memory of 2472 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2248 wrote to memory of 2472 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2248 wrote to memory of 2472 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2288 wrote to memory of 2748 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 2288 wrote to memory of 2748 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 2288 wrote to memory of 2748 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\svhost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe

"C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"' & exit

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3820.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"'

C:\Users\Admin\AppData\Roaming\svhost.exe

"C:\Users\Admin\AppData\Roaming\svhost.exe"

Network

Country Destination Domain Proto
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp

Files

memory/2104-0-0x000007FEF5C43000-0x000007FEF5C44000-memory.dmp

memory/2104-1-0x00000000010F0000-0x0000000001108000-memory.dmp

memory/2104-3-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

memory/2104-11-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp3820.tmp.bat

MD5 1a6af2e217de77c455359d9178489e23
SHA1 90cb978c3b224458338d305e6b11d37cac8d96c8
SHA256 e01bebe45f91ed70604d7c411dc77062bd737532ca9ed1af37c22c84c32184e7
SHA512 8056b231aa82db20bbfde3210825981a455d8ffa4286824b97e21d1655d26f752022715ae31d9ca5b3b4861327e33b9eb1c7eee3af48b1d41f212b702eff7b4a

memory/2104-14-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 c9e368cb65ed6c541e29b52aeb4c2af4
SHA1 b2fe42b7ee53d11cc6cac3e6a99a92f72ff9cc01
SHA256 255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553
SHA512 10ad380013e2efa9f85110e97ebb1187c22fadc2b43f6633af65aedb3b9ffc0355695a70858eef8a6d819423778552f17ebaeeb19ba3b521da2584a9f1e74b81

memory/2748-18-0x00000000011F0000-0x0000000001208000-memory.dmp

C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

MD5 cf759e4c5f14fe3eec41b87ed756cea8
SHA1 c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512 c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 19:54

Reported

2024-05-30 19:56

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Detects executables attemping to enumerate video devices using WMI

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe

"C:\Users\Admin\AppData\Local\Temp\255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"' & exit

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp590D.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"'

C:\Users\Admin\AppData\Roaming\svhost.exe

"C:\Users\Admin\AppData\Roaming\svhost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.160:443 www.bing.com tcp
US 8.8.8.8:53 160.61.62.23.in-addr.arpa udp
US 147.185.221.19:38173 tcp
US 8.8.8.8:53 19.221.185.147.in-addr.arpa udp
US 147.185.221.19:38173 tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 147.185.221.19:38173 tcp
US 8.8.8.8:53 3.173.189.20.in-addr.arpa udp

Files

memory/1732-0-0x00007FFB552B3000-0x00007FFB552B5000-memory.dmp

memory/1732-1-0x0000000000DB0000-0x0000000000DC8000-memory.dmp

memory/1732-3-0x00007FFB552B0000-0x00007FFB55D71000-memory.dmp

memory/1732-6-0x00007FFB552B0000-0x00007FFB55D71000-memory.dmp

memory/1732-9-0x00007FFB552B0000-0x00007FFB55D71000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp590D.tmp.bat

MD5 eff9d4944ccfa8fb2488b8f65b8a24b0
SHA1 989e8d0b10779a997d1fee55b51a1a3240b89366
SHA256 798c386f63e1af56e2b535f6d7b75fd27786eb3154bad385cd6a847c612c5b55
SHA512 b12c8eea7e5bde24abda9ff01ff63a869970a6ace5606b41fd90f27049b7b40ebd3d83517bffca07bba68c1b5a48437ba2d63c2727154b5d121cac995b8babbb

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 c9e368cb65ed6c541e29b52aeb4c2af4
SHA1 b2fe42b7ee53d11cc6cac3e6a99a92f72ff9cc01
SHA256 255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553
SHA512 10ad380013e2efa9f85110e97ebb1187c22fadc2b43f6633af65aedb3b9ffc0355695a70858eef8a6d819423778552f17ebaeeb19ba3b521da2584a9f1e74b81

C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

MD5 cf759e4c5f14fe3eec41b87ed756cea8
SHA1 c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512 c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b