Malware Analysis Report

2024-09-11 07:33

Sample ID 240613-zgzwystdpn
Target f_0051d6
SHA256 fbb5302b06f7e6824ecdaf59162f3a08557cac0efe6b40b4502eab60ecd04d82
Tags
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

fbb5302b06f7e6824ecdaf59162f3a08557cac0efe6b40b4502eab60ecd04d82

Threat Level: Shows suspicious behavior

The file f_0051d6 was found to be: Shows suspicious behavior.

Malicious Activity Summary


Legitimate hosting services abused for malware hosting/C2

Executes dropped EXE

Loads dropped DLL

Program crash

Modifies system certificate store

Script User-Agent

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Subvert Trust Controls
T1553
Install Root Certificate
T1553.004
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 20:42

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 20:42

Reported

2024-06-13 20:44

Platform

win7-20240220-en

Max time kernel

122s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2192 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp
PID 2192 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp
PID 2192 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp
PID 2192 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp
PID 2192 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp
PID 2192 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp
PID 2192 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe

"C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe"

C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp

"C:\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp" /SL5="$400EE,2484196,893952,C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 attribution.onelaunch.com udp
RO 54.192.235.98:443 attribution.onelaunch.com tcp
RO 54.192.235.98:443 attribution.onelaunch.com tcp
US 8.8.8.8:53 update.onelaunch.com udp
US 172.67.68.170:443 update.onelaunch.com tcp
US 8.8.8.8:53 apps.identrust.com udp
IE 2.18.24.18:80 apps.identrust.com tcp

Files

memory/2192-0-0x0000000000400000-0x00000000004E8000-memory.dmp

memory/2192-2-0x0000000000401000-0x00000000004B7000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-FCDE2.tmp\f_0051d6.tmp

MD5 5c6dc4f810bf08224a748763e915d294
SHA1 57e9256e9aeaafd45e4bdc8461f5fcb73f65302e
SHA256 44f80edcbb47c543b362916340af40e5e0f5fa38c1c17713af1ab463d1389e9d
SHA512 8a834ad640ea17ff74d4956d968fe4f5dc657f8fe152eaab778363b2d301733eca2ae01227e20ed9ed88b9eaabe2914a1e388ecea214effdce6725dd28164a15

\Users\Admin\AppData\Local\Temp\is-PD46S.tmp\Win32Library.dll

MD5 564f2dfb6bef1f47798dfb5d182232f0
SHA1 290a5ad705a85e7fb26efcdc5374cd39738ad242
SHA256 671fb4649ddd8428c7f6fd1e14b30fd4735efbbb8c142e2662e157d87f96c9c0
SHA512 492091b1ecb0e36f3d01a7b6d516d836224966dc6e8ec9bcdc2254d252f9530c9b9b45ac10d5216761d557cda2454e3d53060b42e55f6a95631baca29199926b

memory/1648-12-0x0000000000400000-0x000000000070A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab10D4.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar11B6.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f24b208df3b3f981e1c09a5c5e91a1b3
SHA1 ee32520280cab4f8f52aa88a6d37257d7bd9b896
SHA256 febc7ebf7a7092141a1c93ca9efacc43e040345784e2d1fd1be518b8f4ada4e6
SHA512 1025087e2287e6be69ff8302437a2c9a4f2ad760c01a7d27951bab079dfd01980c2b3d8852dcaeb70875c0790ab8b2f5cec152f0348192d7478f7d828e1d2cda

memory/1648-86-0x0000000000400000-0x000000000070A000-memory.dmp

memory/2192-88-0x0000000000400000-0x00000000004E8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 20:42

Reported

2024-06-13 20:44

Platform

win10v2004-20240226-en

Max time kernel

145s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe"

Signatures

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A api.keen.io N/A N/A
N/A api.keen.io N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0936M.tmp\f_0051d6.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0936M.tmp\f_0051d6.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0936M.tmp\f_0051d6.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0936M.tmp\f_0051d6.tmp N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\is-0936M.tmp\f_0051d6.tmp
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\is-0936M.tmp\f_0051d6.tmp

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4436 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe C:\Users\Admin\AppData\Local\Temp\is-0936M.tmp\f_0051d6.tmp
PID 4436 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe C:\Users\Admin\AppData\Local\Temp\is-0936M.tmp\f_0051d6.tmp
PID 4436 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe C:\Users\Admin\AppData\Local\Temp\is-0936M.tmp\f_0051d6.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe

"C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe"

C:\Users\Admin\AppData\Local\Temp\is-0936M.tmp\f_0051d6.tmp

"C:\Users\Admin\AppData\Local\Temp\is-0936M.tmp\f_0051d6.tmp" /SL5="$701CA,2484196,893952,C:\Users\Admin\AppData\Local\Temp\f_0051d6.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4820 -ip 4820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 1944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4820 -ip 4820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 1944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 attribution.onelaunch.com udp
RO 54.192.235.94:443 attribution.onelaunch.com tcp
US 8.8.8.8:53 update.onelaunch.com udp
US 104.26.13.224:443 update.onelaunch.com tcp
US 8.8.8.8:53 94.235.192.54.in-addr.arpa udp
US 8.8.8.8:53 88.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 api.keen.io udp
US 54.186.96.245:443 api.keen.io tcp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 224.13.26.104.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 api.mixpanel.com udp
US 35.190.25.25:443 api.mixpanel.com tcp
US 8.8.8.8:53 245.96.186.54.in-addr.arpa udp
US 8.8.8.8:53 25.25.190.35.in-addr.arpa udp
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 98.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.200.42:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

memory/4436-2-0x0000000000401000-0x00000000004B7000-memory.dmp

memory/4436-0-0x0000000000400000-0x00000000004E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-0936M.tmp\f_0051d6.tmp

MD5 5c6dc4f810bf08224a748763e915d294
SHA1 57e9256e9aeaafd45e4bdc8461f5fcb73f65302e
SHA256 44f80edcbb47c543b362916340af40e5e0f5fa38c1c17713af1ab463d1389e9d
SHA512 8a834ad640ea17ff74d4956d968fe4f5dc657f8fe152eaab778363b2d301733eca2ae01227e20ed9ed88b9eaabe2914a1e388ecea214effdce6725dd28164a15

memory/4820-6-0x0000000000400000-0x000000000070A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-T0JBF.tmp\Win32Library.dll

MD5 564f2dfb6bef1f47798dfb5d182232f0
SHA1 290a5ad705a85e7fb26efcdc5374cd39738ad242
SHA256 671fb4649ddd8428c7f6fd1e14b30fd4735efbbb8c142e2662e157d87f96c9c0
SHA512 492091b1ecb0e36f3d01a7b6d516d836224966dc6e8ec9bcdc2254d252f9530c9b9b45ac10d5216761d557cda2454e3d53060b42e55f6a95631baca29199926b

memory/4820-20-0x0000000000400000-0x000000000070A000-memory.dmp

memory/4820-24-0x0000000008FB0000-0x0000000008FC4000-memory.dmp

memory/4820-25-0x0000000074640000-0x0000000074654000-memory.dmp

memory/4820-26-0x0000000008FD0000-0x0000000009062000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-T0JBF.tmp\onelaunch.png

MD5 d3110fb775ee7fd24426503d67840c25
SHA1 54f649c8bf3af2ad3a4d92cd8b1397bad1a49a75
SHA256 f8392390dc81756e79ec5f359dbdcac3b4bd219b5188a429b814fc51aabb6e36
SHA512 f6b79f728be17c9060edb2df2dac2b0f59a4dffd8c416e7e957bc3fa4696f4237e5969647309f5425a6297f189e351e20c99c642f90d1476050285929657c32f

memory/4820-42-0x00000000037C0000-0x0000000003900000-memory.dmp

memory/4820-43-0x00000000037C0000-0x0000000003900000-memory.dmp

memory/4436-44-0x0000000000400000-0x00000000004E8000-memory.dmp

memory/4820-45-0x0000000000400000-0x000000000070A000-memory.dmp

memory/4436-47-0x0000000000400000-0x00000000004E8000-memory.dmp