Malware Analysis Report

2024-09-11 14:54

Sample ID 240608-x98cpafb9z
Target Microsoft Network Realtime inspection.exe
SHA256 267d1802344caba41d174d5e9750695c446724e6c480bee1b79100a64931e788
Tags
xworm ramnit banker execution persistence rat spyware stealer trojan upx worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

267d1802344caba41d174d5e9750695c446724e6c480bee1b79100a64931e788

Threat Level: Known bad

The file Microsoft Network Realtime inspection.exe was found to be: Known bad.

Malicious Activity Summary

xworm ramnit banker execution persistence rat spyware stealer trojan upx worm

Xworm family

Xworm

Detect Xworm Payload

Ramnit

Command and Scripting Interpreter: PowerShell

Drops startup file

UPX packed file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Looks up external IP address via web service

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Creates scheduled task(s)

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-08 19:34

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-08 19:34

Reported

2024-06-08 19:37

Platform

win7-20240221-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Ramnit

trojan spyware stealer worm banker ramnit

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TLauncher.lnk C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TLauncher.lnk C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ixsjxa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\TLauncher N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qvkvtk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\TLauncher N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ixsjxa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\TLauncher = "C:\\Users\\Admin\\AppData\\Roaming\\TLauncher" C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\pxAA24.tmp C:\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46207E41-25CE-11EF-92E0-EA483E0BCDAF} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\TLauncher N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\TLauncher N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qvkvtk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1728 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\schtasks.exe
PID 1728 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\schtasks.exe
PID 1728 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\schtasks.exe
PID 1728 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Users\Admin\AppData\Local\Temp\ixsjxa.exe
PID 1728 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Users\Admin\AppData\Local\Temp\ixsjxa.exe
PID 1728 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Users\Admin\AppData\Local\Temp\ixsjxa.exe
PID 1728 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Users\Admin\AppData\Local\Temp\ixsjxa.exe
PID 1568 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\ixsjxa.exe C:\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe
PID 1568 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\ixsjxa.exe C:\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe
PID 1568 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\ixsjxa.exe C:\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe
PID 1568 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\ixsjxa.exe C:\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe
PID 1928 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 1928 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 1928 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 1928 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 796 wrote to memory of 2740 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 796 wrote to memory of 2740 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 796 wrote to memory of 2740 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 796 wrote to memory of 2740 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2740 wrote to memory of 1964 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2740 wrote to memory of 1964 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2740 wrote to memory of 1964 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2740 wrote to memory of 1964 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2848 wrote to memory of 2800 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\TLauncher
PID 2848 wrote to memory of 2800 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\TLauncher
PID 2848 wrote to memory of 2800 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\TLauncher
PID 1728 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Users\Admin\AppData\Local\Temp\qvkvtk.exe
PID 1728 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Users\Admin\AppData\Local\Temp\qvkvtk.exe
PID 1728 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Users\Admin\AppData\Local\Temp\qvkvtk.exe
PID 1728 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Users\Admin\AppData\Local\Temp\qvkvtk.exe
PID 2848 wrote to memory of 1828 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\TLauncher
PID 2848 wrote to memory of 1828 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\TLauncher
PID 2848 wrote to memory of 1828 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\TLauncher

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Microsoft Network Realtime inspection.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\TLauncher'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'TLauncher'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "TLauncher" /tr "C:\Users\Admin\AppData\Roaming\TLauncher"

C:\Users\Admin\AppData\Local\Temp\ixsjxa.exe

"C:\Users\Admin\AppData\Local\Temp\ixsjxa.exe"

C:\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe

C:\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:2

C:\Windows\system32\taskeng.exe

taskeng.exe {638D7D00-B3D3-48B5-BE39-2421C9BF49D4} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\TLauncher

C:\Users\Admin\AppData\Roaming\TLauncher

C:\Users\Admin\AppData\Local\Temp\qvkvtk.exe

"C:\Users\Admin\AppData\Local\Temp\qvkvtk.exe"

C:\Users\Admin\AppData\Roaming\TLauncher

C:\Users\Admin\AppData\Roaming\TLauncher

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 listing-trackbacks.gl.at.ply.gg udp
US 147.185.221.20:15337 listing-trackbacks.gl.at.ply.gg tcp
US 8.8.8.8:53 api.bing.com udp

Files

memory/1728-0-0x000007FEF58C3000-0x000007FEF58C4000-memory.dmp

memory/1728-1-0x00000000002F0000-0x000000000030A000-memory.dmp

memory/1728-2-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/2748-7-0x0000000002D20000-0x0000000002DA0000-memory.dmp

memory/2748-8-0x000000001B800000-0x000000001BAE2000-memory.dmp

memory/2748-9-0x0000000002240000-0x0000000002248000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 d766dc4315e2d36ba0ac07947d904a5c
SHA1 57b242b7b978f05af641dd777a6fbb5b01fd3602
SHA256 378ab568095cfac08a7d3f5e197b89905db219d6007f5c1ba45068690d8b2c77
SHA512 59265b60a4ad0571a525c36258db9f49bdbc964ecbcde2a6aacaad5fe164d6c02def8d8b97f5f20d172d4b342cea2e4210d1817c7837e91a0300c47bea731f4f

memory/2760-16-0x0000000001F80000-0x0000000001F88000-memory.dmp

memory/2760-15-0x000000001B570000-0x000000001B852000-memory.dmp

memory/1728-30-0x000007FEF58C3000-0x000007FEF58C4000-memory.dmp

memory/1728-31-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

\Users\Admin\AppData\Local\Temp\ixsjxaSrv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/796-58-0x0000000000400000-0x000000000042E000-memory.dmp

memory/796-56-0x0000000000240000-0x0000000000241000-memory.dmp

memory/796-54-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1928-47-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1568-46-0x0000000000240000-0x000000000026E000-memory.dmp

memory/1568-39-0x0000000000400000-0x000000000045B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ixsjxa.exe

MD5 7eb8c9c1701f6b347721b42ba15c0993
SHA1 13e62637aa5c402383f5665d20c7491c51bccbdc
SHA256 6d5e92ccc9d65e02d8f805e3f4e33841db34a562b3c882a137146461a56bdec2
SHA512 22572a6ebf16b5e260c5d99f30aaefabd88a143bc6b6a9a4d7b82a31ffeb7970d3701c697fcb4c692c6f450782982f3e43f74e3b01fe3ebf1957fc0ef0a4a072

C:\Users\Admin\AppData\Local\Temp\CabBF7A.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\TarC06C.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6374c16c6a992c6329cebc42e0bebcd1
SHA1 57c2f195e9a0d84a4edbea6b929f564057ab52aa
SHA256 5a39a0a8d972c2c20c9ecf28e12e5e34b9080dc193a90b8d3fd30d0da1764539
SHA512 c0127e3174c05e8806aba102d853941848f261fe5764064448e6c22f432902a5e98a345372851d50bed76b3c3b7fdc33e9c3c85133de646042bd79b46cdea93e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 087b97134dff0bff6ffc005ac5c0595f
SHA1 206f2867b8b479f00076f7c11efa13d64c9d084e
SHA256 9dfaae7cf1c51edfa5e3c287604372ed8042e675fb9c7d3e162becc2b607b549
SHA512 93bc564b7780027e8b9513ed4118ee8ec70126a6df6d77ca740d18bb41febff0cee44c961f28a48a9f86c2056b416935946fc992c60ae3b863ea6b7fbe6524cc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0657800df50e5670a5d6b3bfc0dfaff6
SHA1 ab83340adac2b304fa3ece9a6e63ec630b502e78
SHA256 95a74a91ae0658ba6c4b1d64334c1e0b24ae06778777cf7d0d9718871a1dfbd6
SHA512 7513e269f34974d3f97c301d96b3dd4accb80ee232226b3e0d3bb61fd123035feac5a49b157c5db7099d9f34e8211ab4d15c537bc57da9c7a18c9bad799d1603

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f4cf0683a45e93f2796fafb684ac5f00
SHA1 874ead59cd6b3742d52514b3c232463d93917d82
SHA256 7b631d26b3d87360891d3ed54a09624e4a6c5a92e874857bde1f065dd4eb16e7
SHA512 3ed51b3169afa2ab2490df1c0910371517df0f816b4cfce8be2c20c8b42387828ae99f5778c1ad018e5cca4181753a3fd5a70e5be7b6734ca7b6448aa415987a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fc545a338b21db34f800d22d2189055a
SHA1 ef220f565aec3f5c6a7fc3140757bc203dde8f2e
SHA256 47fae85a89e4e7013f184166f863b35dd7d947da0f67d99da961b31c38054630
SHA512 781843a5f2a083dc9e53c41d0b133e539fcd8c1d1e2477d2bf6ed2e7e2089fa421ebb831c3197dc7cb5c8c3d3d2cb93f56afa578b1b539c443ddbbf6d58a4eb7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0a1fb0d3711e03574861d70ed5245b7b
SHA1 b2f183e5a24de723b66e33556a4579e203db5ce7
SHA256 731add6d6a897bfc25d083b54342b97009a59c1993260ecfb4f0516974c4cce7
SHA512 c09ea66b44dfd800f1d661b0187a1ff5305ae4f09568b177717dadd6af89dc5efc0ed4b6be22fec1909f1271a08d9ad8594fe2803a78fca2f933ec2fc83f52f0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e0af77b66a0732a2dd8dba07661e4f91
SHA1 ae48bbad8d6e1416510bb2e886e34cf73404b28a
SHA256 385bbc646872bf45898b77d495cd28e9ef915f4c2172f345098806b87178fcb4
SHA512 4fbd0951725b3564980aecb35d925841194f924eb8049c708a2a753a14a057681af473eee579c1097621a6aad5425c388c692e462ce7547b498f31fc573cffc2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1e4ac761f7f594fd296837f8fba7d2c7
SHA1 0093c20721a36d8ad69c8e51d50ee30432ca9643
SHA256 4b69a3a14ca09ee4d10c3c1404471606fe64b6b3d8d5997ce3ff38684b5ce4c4
SHA512 ad7ef98c56035cd85e1836ecec1b514bb10d432c04f92c02e578622b2d30e2c78536551fc98910b55529832c4632356bd6d7cd958f0f69d49a6e83689ca71b05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3a48d65eb6b228879c88d929072153d0
SHA1 3ce211ebedfe21389cdd378f4050215dc9b30f00
SHA256 77841b1dc965c674388410ebd3a0581bf3bbbc17fd642d552a64a4fdfd2789b5
SHA512 73f39c097f0d6cb5c364119c4e98a70495b07c81790ade7de9e03645af86a95e5c473a214843bfa9de16fb921df4bc69f34c60d9cfa43cd0aae0f3ec8e0620c6

memory/1568-533-0x0000000000400000-0x000000000045B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\~DF1E00461333DD8B84.TMP

MD5 acea6b9b3835b77db3952b6906b0cfca
SHA1 f3121a81f4d2d473992ead77ab977faa6c763801
SHA256 a920d8ee83952ce665b68d906b67247a5ad8e20c49cac438f4872cb65c12874c
SHA512 7c19dbb53dbd8d7caac69ff5127a59b5df4e70cba897f604d83f7159d134ceaaa0e2c99c94540fe4ccf4f253a9ba428ebae1969f4816b81dc2d1a41a76bb3ca3

memory/1568-547-0x0000000000240000-0x000000000026E000-memory.dmp

C:\Users\Admin\AppData\Roaming\TLauncher

MD5 5c888eddae30076bd7aaa2e5d5fea097
SHA1 6a5b5c290d24bcd984a7083f934dbf35f56ec888
SHA256 267d1802344caba41d174d5e9750695c446724e6c480bee1b79100a64931e788
SHA512 4a17d517772d0efff6fea2074af232c90f47b370fa9269d36970bec3a8204e1e3df8f273f21287f712d26117a803b428ffd3683581b85498515e1d908c5b3dd1

memory/2800-553-0x0000000000B10000-0x0000000000B2A000-memory.dmp

memory/1568-554-0x0000000000400000-0x000000000045B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qvkvtk.exe

MD5 62cbb85434223022a0b0e369b227a3d9
SHA1 4978b691168f16c678a1ffe53e126ba1d946bce0
SHA256 ea3087204e3ed644308a0a96bbf319590a9b2701ac850bb63f2ba3dc4955f1fd
SHA512 f76d281ce4c4401315f811dba1512757fa59a9c1ca6486c006f7861aed793a1f196fd66b772405374a751f383b5a234234e64de16f2fe9d613694e354b882f69

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-08 19:34

Reported

2024-06-08 19:37

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TLauncher.lnk C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TLauncher.lnk C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\TLauncher N/A
N/A N/A C:\Users\Admin\AppData\Roaming\TLauncher N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TLauncher = "C:\\Users\\Admin\\AppData\\Roaming\\TLauncher" C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\TLauncher N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\TLauncher N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4916 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4916 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4916 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4916 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4916 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4916 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4916 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4916 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4916 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\schtasks.exe
PID 4916 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Microsoft Network Realtime inspection.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\TLauncher'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'TLauncher'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "TLauncher" /tr "C:\Users\Admin\AppData\Roaming\TLauncher"

C:\Users\Admin\AppData\Roaming\TLauncher

C:\Users\Admin\AppData\Roaming\TLauncher

C:\Users\Admin\AppData\Roaming\TLauncher

C:\Users\Admin\AppData\Roaming\TLauncher

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 listing-trackbacks.gl.at.ply.gg udp
US 147.185.221.20:15337 listing-trackbacks.gl.at.ply.gg tcp
US 8.8.8.8:53 20.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 160.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

memory/4916-0-0x0000000000C10000-0x0000000000C2A000-memory.dmp

memory/4916-1-0x00007FFE39C23000-0x00007FFE39C25000-memory.dmp

memory/4916-2-0x00007FFE39C20000-0x00007FFE3A6E1000-memory.dmp

memory/3116-9-0x00007FFE39C20000-0x00007FFE3A6E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3qro0d1z.pxe.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3116-3-0x0000022057220000-0x0000022057242000-memory.dmp

memory/3116-14-0x00007FFE39C20000-0x00007FFE3A6E1000-memory.dmp

memory/3116-15-0x00007FFE39C20000-0x00007FFE3A6E1000-memory.dmp

memory/3116-18-0x00007FFE39C20000-0x00007FFE3A6E1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 380007fbdf9fef355db2afd71fce9cd1
SHA1 e98802ef10fac8ef96a3210930784c317ca76fa0
SHA256 6353a11014d2c1495ac7a5efef195d06d8e8b30a163c437263361deb5a28de03
SHA512 9790c6b4c16ed4f4e6cddf492d01a6b4963e20bde6ddf40017db20ffc672b0cfaea2ad6aebcb51e8e459682974be0d024b35546aad840051a1e9fe2d3e565bd5

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 04f1d68afbed6b13399edfae1e9b1472
SHA1 8bfdcb687a995e4a63a8c32df2c66dc89f91a8b0
SHA256 f358f33a42122e97c489fad7bbc8beab2eb42d42e4ec7fce0dd61fe6d8c0b8de
SHA512 30c5e72a8134992094d937d2588f7a503b1d6407d11afe0265b7c8b0ce14071925e5caed13fc4f9c28705df4c7aed3601f81b007048b148af274d7784aa5fb75

memory/4916-56-0x00007FFE39C23000-0x00007FFE39C25000-memory.dmp

memory/4916-57-0x00007FFE39C20000-0x00007FFE3A6E1000-memory.dmp

C:\Users\Admin\AppData\Roaming\TLauncher

MD5 5c888eddae30076bd7aaa2e5d5fea097
SHA1 6a5b5c290d24bcd984a7083f934dbf35f56ec888
SHA256 267d1802344caba41d174d5e9750695c446724e6c480bee1b79100a64931e788
SHA512 4a17d517772d0efff6fea2074af232c90f47b370fa9269d36970bec3a8204e1e3df8f273f21287f712d26117a803b428ffd3683581b85498515e1d908c5b3dd1

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TLauncher.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1