Malware Analysis Report

2024-11-16 13:41

Sample ID 240531-rs5mksbh85
Target 1.exe
SHA256 4df13a3d7eb8be77ec0f83eed487dd17efc81b2a4684978f778e92f49106cec0
Tags
xworm execution rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4df13a3d7eb8be77ec0f83eed487dd17efc81b2a4684978f778e92f49106cec0

Threat Level: Known bad

The file 1.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution rat trojan

Xworm

Xworm family

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Drops startup file

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-31 14:28

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-31 14:28

Reported

2024-05-31 14:31

Platform

win7-20240220-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\1.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A 7.tcp.eu.ngrok.io N/A N/A
N/A 7.tcp.eu.ngrok.io N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1.exe N/A
Token: 33 N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3036 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3036 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3036 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3036 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3036 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3036 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3036 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3036 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3036 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3036 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3036 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3036 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1.exe

"C:\Users\Admin\AppData\Local\Temp\1.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 7.tcp.eu.ngrok.io udp
DE 3.68.56.232:10589 7.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 7.tcp.eu.ngrok.io udp
DE 3.67.15.169:10589 7.tcp.eu.ngrok.io tcp

Files

memory/3036-0-0x000007FEF5693000-0x000007FEF5694000-memory.dmp

memory/3036-1-0x00000000001E0000-0x00000000001F4000-memory.dmp

memory/3036-2-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

memory/2600-7-0x0000000002770000-0x00000000027F0000-memory.dmp

memory/2600-8-0x000000001B510000-0x000000001B7F2000-memory.dmp

memory/2600-9-0x00000000027F0000-0x00000000027F8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DRRPT6V5T98TXLZ6SZ4D.temp

MD5 0854a25055c828d97caa4f1da7284170
SHA1 79ab30732a775353ce6196c8d05f3393a90a9507
SHA256 b75ad9cb73d7ddf11f3eb3a139e8fc20acf9777dffd1f86f0549955977d2a984
SHA512 b24979c2e41aff806837e83171191966088c242e733267b8e7489f300ff95cf846af40f1b25b38d567c2ac612f7349dacbbccb4f0c8177d11a59048e1092d91b

memory/2548-15-0x000000001B660000-0x000000001B942000-memory.dmp

memory/2548-16-0x0000000002790000-0x0000000002798000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/3036-33-0x000007FEF5693000-0x000007FEF5694000-memory.dmp

memory/3036-34-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

memory/2936-42-0x000007FEF2770000-0x000007FEF27A4000-memory.dmp

memory/2936-41-0x000000013FB20000-0x000000013FC18000-memory.dmp

memory/2936-49-0x000007FEF6BD0000-0x000007FEF6BE8000-memory.dmp

memory/2936-43-0x000007FEEDE10000-0x000007FEEE0C4000-memory.dmp

memory/2936-51-0x000007FEF1AE0000-0x000007FEF1AF1000-memory.dmp

memory/2936-50-0x000007FEF6710000-0x000007FEF6727000-memory.dmp

memory/2948-56-0x000007FEF6710000-0x000007FEF6727000-memory.dmp

memory/2948-57-0x000007FEF1AE0000-0x000007FEF1AF1000-memory.dmp

memory/2948-61-0x000007FEEF4F0000-0x000007FEEF501000-memory.dmp

memory/2948-60-0x000007FEEF510000-0x000007FEEF52D000-memory.dmp

memory/2948-59-0x000007FEEF530000-0x000007FEEF541000-memory.dmp

memory/2948-58-0x000007FEEF550000-0x000007FEEF567000-memory.dmp

memory/2948-54-0x000007FEEDE10000-0x000007FEEE0C4000-memory.dmp

memory/2948-55-0x000007FEF6BD0000-0x000007FEF6BE8000-memory.dmp

memory/2948-53-0x000007FEF2770000-0x000007FEF27A4000-memory.dmp

memory/2948-52-0x000000013FB20000-0x000000013FC18000-memory.dmp

memory/2948-64-0x000007FEEF320000-0x000007FEEF35F000-memory.dmp

memory/2948-65-0x000007FEEC5F0000-0x000007FEEC611000-memory.dmp

memory/2948-66-0x000007FEEC5D0000-0x000007FEEC5E8000-memory.dmp

memory/2948-67-0x000007FEEC5B0000-0x000007FEEC5C1000-memory.dmp

memory/2948-68-0x000007FEEC590000-0x000007FEEC5A1000-memory.dmp

memory/2948-69-0x000007FEEC570000-0x000007FEEC581000-memory.dmp

memory/2948-86-0x000007FEEC040000-0x000007FEEC105000-memory.dmp

memory/2948-76-0x000007FEEC3E0000-0x000007FEEC3F1000-memory.dmp

memory/2948-75-0x000007FEEC400000-0x000007FEEC46F000-memory.dmp

memory/2948-74-0x000007FEEC470000-0x000007FEEC4D7000-memory.dmp

memory/2948-73-0x000007FEEC4E0000-0x000007FEEC510000-memory.dmp

memory/2948-72-0x000007FEEC510000-0x000007FEEC528000-memory.dmp

memory/2948-71-0x000007FEEC530000-0x000007FEEC541000-memory.dmp

memory/2948-70-0x000007FEEC550000-0x000007FEEC56B000-memory.dmp

memory/2948-91-0x000007FEEBD60000-0x000007FEEBD90000-memory.dmp

memory/2948-89-0x000007FEEBEE0000-0x000007FEEBF4D000-memory.dmp

memory/2948-88-0x000007FEEBF50000-0x000007FEEBFB2000-memory.dmp

memory/2948-90-0x000007FEEBD90000-0x000007FEEBE4D000-memory.dmp

memory/2948-87-0x000007FEEBFC0000-0x000007FEEC035000-memory.dmp

memory/2948-62-0x000007FEEC820000-0x000007FEED8CB000-memory.dmp

memory/2948-85-0x000007FEEC110000-0x000007FEEC126000-memory.dmp

memory/2948-84-0x000007FEEC130000-0x000007FEEC141000-memory.dmp

memory/2948-83-0x000007FEEC150000-0x000007FEEC17F000-memory.dmp

memory/2948-82-0x000007FEFB290000-0x000007FEFB2A0000-memory.dmp

memory/2948-81-0x000007FEEC180000-0x000007FEEC197000-memory.dmp

memory/2948-80-0x000007FEEC1A0000-0x000007FEEC318000-memory.dmp

memory/2948-63-0x000007FEEC620000-0x000007FEEC820000-memory.dmp

memory/2948-79-0x000007FEEC320000-0x000007FEEC344000-memory.dmp

memory/2948-78-0x000007FEEC350000-0x000007FEEC378000-memory.dmp

memory/2948-77-0x000007FEEC380000-0x000007FEEC3D6000-memory.dmp

memory/2948-93-0x000007FEEA440000-0x000007FEEA5B0000-memory.dmp

memory/2948-97-0x000007FEE99B0000-0x000007FEE99C1000-memory.dmp

memory/2948-96-0x000007FEE9D20000-0x000007FEE9D35000-memory.dmp

memory/2948-95-0x000007FEEA3D0000-0x000007FEEA412000-memory.dmp

memory/2948-94-0x000007FEEA420000-0x000007FEEA432000-memory.dmp

memory/2948-98-0x000007FEE9950000-0x000007FEE99AD000-memory.dmp

memory/2948-99-0x000007FEE9900000-0x000007FEE9947000-memory.dmp

memory/2948-101-0x000007FEE9700000-0x000007FEE9711000-memory.dmp

memory/2948-102-0x000007FEE9400000-0x000007FEE944E000-memory.dmp

memory/2948-100-0x000007FEE9870000-0x000007FEE98F1000-memory.dmp

memory/2948-103-0x000007FEE93B0000-0x000007FEE93F3000-memory.dmp

memory/2948-104-0x000007FEE9390000-0x000007FEE93A5000-memory.dmp

memory/2948-105-0x000007FEE9370000-0x000007FEE9381000-memory.dmp

memory/2948-106-0x000007FEE9350000-0x000007FEE9362000-memory.dmp

memory/2948-108-0x000007FEE9190000-0x000007FEE91C4000-memory.dmp

memory/2948-107-0x000007FEE91D0000-0x000007FEE934A000-memory.dmp

memory/2948-92-0x000007FEEA5B0000-0x000007FEEBD60000-memory.dmp

memory/3036-223-0x0000000001FD0000-0x0000000001FDC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-31 14:28

Reported

2024-05-31 14:31

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\1.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A 7.tcp.eu.ngrok.io N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1.exe

"C:\Users\Admin\AppData\Local\Temp\1.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 160.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 171.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
US 8.8.8.8:53 7.tcp.eu.ngrok.io udp
DE 3.68.56.232:10589 7.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 232.56.68.3.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 89.16.208.104.in-addr.arpa udp

Files

memory/4868-0-0x00000000002D0000-0x00000000002E4000-memory.dmp

memory/4868-1-0x00007FFFBA453000-0x00007FFFBA455000-memory.dmp

memory/4868-2-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp

memory/4928-3-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp

memory/4928-4-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp

memory/4928-5-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp

memory/4928-11-0x000002E071150000-0x000002E071172000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xo2mkplm.yaj.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4928-16-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp

memory/4928-19-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 82cea548460260b6dc4d446dbfb01ab4
SHA1 0dd102070146bcb149f8fdb03ac00f5f802e9950
SHA256 257f3d4fd20a8bb855a36bd76b1bd0ece44e97b3930326e74d765644673ee3e5
SHA512 700e928624be3d4b68d2265b8ae6522cd15fb334c5f0dd03e4c111775dbc23eb371bcd3de2a0f582550d0cd829ae37a4acec9fd8001238f8210f9aaa44bf0bec

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b9ace02bfe8d5d5fa289cf5c6e7ae89d
SHA1 bf4b471d0ab05fabbaec1ef2c52f36d9d2396adb
SHA256 3ca941c9577cdd7a20a56c8a38df634de23abd2f1c14270fedb1b0191833d847
SHA512 154162c43570cc3205357b4673e0124eeefc4861cd8f159b6f520be77cdda5f8177b4faf6969d018aec4c7e3af8ec34263844660f612a30741a6a8c868e8d97a

memory/4868-58-0x00007FFFBA453000-0x00007FFFBA455000-memory.dmp

memory/4868-59-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp