Malware Analysis Report

2025-03-14 23:51

Sample ID 240603-f91t6see49
Target f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718
SHA256 f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718
Tags
persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718

Threat Level: Shows suspicious behavior

The file f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Loads dropped DLL

Checks computer location settings

Drops startup file

Executes dropped EXE

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Modifies registry key

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 05:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 05:35

Reported

2024-06-03 05:37

Platform

win7-20240419-en

Max time kernel

148s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe"

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PDF Reader Launcher.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\COM_LOADER = "\\\\.\\F:\\Program Files\\PDF_Reader\\bin\\COM7.EXE" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2028 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
PID 2028 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
PID 2028 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
PID 2028 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
PID 2028 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
PID 2028 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
PID 2028 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
PID 2028 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
PID 2176 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE C:\Windows\SysWOW64\reg.exe
PID 2176 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE C:\Windows\SysWOW64\reg.exe
PID 2176 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE C:\Windows\SysWOW64\reg.exe
PID 2176 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE C:\Windows\SysWOW64\reg.exe
PID 2176 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
PID 2176 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
PID 2176 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
PID 2176 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
PID 2084 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
PID 2084 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
PID 2084 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
PID 2084 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe

"C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe"

C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe

\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe

C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE

\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v COM_LOADER /d "\\.\F:\Program Files\PDF_Reader\bin\COM7.EXE"

C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe

\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe

C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE

\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.ibayme.eb2a.com udp
US 199.59.243.225:80 www.ibayme.eb2a.com tcp

Files

\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe

MD5 008f97461b521f70694805a0c31fc3c6
SHA1 d3f875708b24a28ae3c4b896af9a67788f12baed
SHA256 ec19b137d7af783d80c54ccd4100b7db8734b099b514e23380b27001f1644cb9
SHA512 b2fe858e723944d13994466d7119ef2e1395f580541c9640f6f29a23d63fbc5140e7882fcdaf1b4c28598033b16acf8dfdf2708faf4e4790742454dcd495585d

\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE

MD5 2d407d07ebf12fbec35385e89e9560d2
SHA1 e7f06fb53ca497c96bbd6ac4be821e3b724c3f5f
SHA256 b77d7e2669b87bf67aa237b41fc62112283d60c6b4c15abda3e11882465ecd9a
SHA512 1bab6bd5fd1e6e5652983c5e32851666271f90c5df65aff9e9ceb295c8793010a8974e59d6f889e9a1d121195dd4ddce77aabe88d0ba6fc34eef7662aaf04a24

memory/2028-21-0x0000000000400000-0x0000000000549000-memory.dmp

memory/2084-24-0x0000000000400000-0x0000000000549000-memory.dmp

memory/2176-27-0x0000000000400000-0x0000000000549000-memory.dmp

memory/2564-33-0x0000000000400000-0x0000000000549000-memory.dmp

memory/2664-38-0x0000000000400000-0x0000000000549000-memory.dmp

memory/2084-42-0x0000000000400000-0x0000000000549000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 05:35

Reported

2024-06-03 05:37

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

98s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PDF Reader Launcher.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM_LOADER = "\\\\.\\F:\\Program Files\\PDF_Reader\\bin\\COM7.EXE" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2852 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
PID 2852 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
PID 2852 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
PID 2852 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
PID 2852 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
PID 2852 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
PID 1680 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE C:\Windows\SysWOW64\reg.exe
PID 1680 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE C:\Windows\SysWOW64\reg.exe
PID 1680 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE C:\Windows\SysWOW64\reg.exe
PID 1680 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
PID 1680 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
PID 1680 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
PID 768 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
PID 768 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
PID 768 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe

"C:\Users\Admin\AppData\Local\Temp\f54bf9a40a76b489ec1dd002d9dc61948dc57a5a25bcc9fc239980319d805718.exe"

C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe

\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe

C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE

\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v COM_LOADER /d "\\.\F:\Program Files\PDF_Reader\bin\COM7.EXE"

C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe

\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe

C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE

\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 www.ibayme.eb2a.com udp
US 199.59.243.225:80 www.ibayme.eb2a.com tcp
US 8.8.8.8:53 225.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
NL 23.62.61.155:443 www.bing.com tcp
US 8.8.8.8:53 155.61.62.23.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe

MD5 15d92fb4fcd10fb3576445036656873c
SHA1 0a00745a069e3ecaca46060157df84496dadc5bb
SHA256 25fe519ec217bbd3fd457d5d84565724c1e70d86894ca31d32e70aa9b76c1adc
SHA512 bfa15aeeba3f88c19e012357c3372eef98d8a6031eaf8258cb169c24a11660cd84e2b9184296e9fdecae2460f775e53fc02209015049c354035d74e0b4d1a7f4

C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE

MD5 ed77f9f1f7c3c68e177206b0701c0ef0
SHA1 d78f3a95774368c81e0b00c2e80cccc30e1039a3
SHA256 375158e0d3d86a3ac86a5d3cb00b4938560377887217aec4750437331e30f9c4
SHA512 b44dfc234ef43a91699069c2a20f96a4dec2c713a1739f28fc39512eeb65dae91d0c798b4863fdcd7f1e542c7ace3c37a6f7f01d550c03963dc98d9e75c82303

memory/2852-12-0x0000000000400000-0x0000000000549000-memory.dmp

memory/768-15-0x0000000000400000-0x0000000000549000-memory.dmp

memory/1680-18-0x0000000000400000-0x0000000000549000-memory.dmp

memory/1792-22-0x0000000000400000-0x0000000000549000-memory.dmp

memory/4672-25-0x0000000000400000-0x0000000000549000-memory.dmp

memory/768-29-0x0000000000400000-0x0000000000549000-memory.dmp