Malware Analysis Report

2024-08-06 12:59

Sample ID 240603-w1qkvaee81
Target 06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b
SHA256 06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b
Tags
asyncrat persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b

Threat Level: Known bad

The file 06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b was found to be: Known bad.

Malicious Activity Summary

asyncrat persistence rat

Contains code to disable Windows Defender

AsyncRat

Detects executables containing artifacts associated with disabling Widnows Defender

Detects Windows executables referencing non-Windows User-Agents

Detects file containing reversed ASEP Autorun registry keys

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Delays execution with timeout.exe

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-03 18:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 18:23

Reported

2024-06-03 18:26

Platform

win7-20240508-en

Max time kernel

149s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe"

Signatures

AsyncRat

rat asyncrat

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing artifacts associated with disabling Widnows Defender

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects file containing reversed ASEP Autorun registry keys

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\HiPatch = "C:\\Users\\Admin\\AppData\\Roaming\\HiPatch\\HiPatchService.exe" C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2608 set thread context of 2296 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2244 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe
PID 2244 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe
PID 2244 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe
PID 2244 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe
PID 2244 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe
PID 2244 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe
PID 2244 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe
PID 2244 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2608 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2608 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2608 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2608 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2608 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2608 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2608 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2608 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2608 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2608 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2608 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe

"C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe"

C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe

"C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 corporation.warzonedns.com udp

Files

memory/2244-0-0x000000007448E000-0x000000007448F000-memory.dmp

memory/2244-1-0x0000000000B60000-0x0000000000BA6000-memory.dmp

memory/2244-2-0x0000000000590000-0x000000000059A000-memory.dmp

memory/2244-3-0x0000000074480000-0x0000000074B6E000-memory.dmp

\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe

MD5 7651ecdf28112fa8868ad92c7cf5fdd3
SHA1 d8eb911cb37fcce68fbfe13d892014bcdab37612
SHA256 4ece890ab3090cad5866d223259f695ef1ab71904b5e77f4fc0bcf02153bef89
SHA512 2a02fa312b3a74b5ece0c092b679a8c2b10c06bbcfaa243decd718b6736e459842f99039416388e532c1f43da2f8124a509d31d7512405812b63719846828cd1

C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat

MD5 0955cb4b691d44b37f8b6fad48a33b8e
SHA1 9dae759ae014cc124ab6eed7c8035788c124ae4a
SHA256 9092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71
SHA512 08b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235

memory/2608-21-0x0000000074480000-0x0000000074B6E000-memory.dmp

memory/2608-22-0x0000000000F90000-0x0000000000FD6000-memory.dmp

memory/2244-24-0x0000000074480000-0x0000000074B6E000-memory.dmp

memory/2296-31-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2296-35-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2296-34-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2296-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2296-29-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2296-27-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2296-25-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2296-36-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2608-37-0x0000000074480000-0x0000000074B6E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 18:23

Reported

2024-06-03 18:26

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe"

Signatures

AsyncRat

rat asyncrat

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing artifacts associated with disabling Widnows Defender

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Description Indicator Process Target
N/A N/A N/A N/A

Detects file containing reversed ASEP Autorun registry keys

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HiPatch = "C:\\Users\\Admin\\AppData\\Roaming\\HiPatch\\HiPatchService.exe" C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1168 set thread context of 2900 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4252 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe
PID 4252 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe
PID 4252 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe
PID 4252 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Windows\SysWOW64\cmd.exe
PID 4252 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Windows\SysWOW64\cmd.exe
PID 4252 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe C:\Windows\SysWOW64\cmd.exe
PID 4696 wrote to memory of 3560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4696 wrote to memory of 3560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4696 wrote to memory of 3560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1168 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1168 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1168 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1168 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1168 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1168 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1168 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1168 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe

"C:\Users\Admin\AppData\Local\Temp\06e8de6d1ccf39fa45d08b9ae53602e5c4e0440f374d4a13fd8fc2c3601ce79b.exe"

C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe

"C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""

C:\Windows\SysWOW64\timeout.exe

timeout /t 180

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 216.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp

Files

memory/4252-0-0x000000007536E000-0x000000007536F000-memory.dmp

memory/4252-1-0x0000000000820000-0x0000000000866000-memory.dmp

memory/4252-2-0x0000000005870000-0x0000000005E14000-memory.dmp

memory/4252-3-0x00000000052C0000-0x0000000005352000-memory.dmp

memory/4252-4-0x0000000075360000-0x0000000075B10000-memory.dmp

memory/4252-5-0x0000000005260000-0x000000000526A000-memory.dmp

memory/4252-6-0x0000000005250000-0x000000000525A000-memory.dmp

C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe

MD5 aa7f18583fb07acd59abe65adcb3e269
SHA1 754a0f7e3724865e2f3974169ace967406472749
SHA256 4db5369f9892489b48b1d7a4b6b49aa9e308c21dce8107911599c40083861872
SHA512 1b6ad55e0dafda1c56e93bd15117a970bb87b1d8cc028c3f205d0b70494d9fd92ccbe0e9a6f3ff50645526effbfe8f2e96daad5c0fd4ce4112d86c1e360f928c

memory/1168-24-0x0000000075360000-0x0000000075B10000-memory.dmp

memory/4252-25-0x0000000075360000-0x0000000075B10000-memory.dmp

C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat

MD5 0955cb4b691d44b37f8b6fad48a33b8e
SHA1 9dae759ae014cc124ab6eed7c8035788c124ae4a
SHA256 9092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71
SHA512 08b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235

memory/1168-27-0x0000000075360000-0x0000000075B10000-memory.dmp

memory/2900-28-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1168-30-0x0000000075360000-0x0000000075B10000-memory.dmp