Malware Analysis Report

2024-08-06 14:06

Sample ID 240614-ckzc9svgkn
Target c9fa5ed936b3c7dde4c90b453c9bc95f08beb8d06af8e59dc02f4526b7fee017
SHA256 c9fa5ed936b3c7dde4c90b453c9bc95f08beb8d06af8e59dc02f4526b7fee017
Tags
modiloader trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c9fa5ed936b3c7dde4c90b453c9bc95f08beb8d06af8e59dc02f4526b7fee017

Threat Level: Known bad

The file c9fa5ed936b3c7dde4c90b453c9bc95f08beb8d06af8e59dc02f4526b7fee017 was found to be: Known bad.

Malicious Activity Summary

modiloader trojan

ModiLoader, DBatLoader

ModiLoader Second Stage

Executes dropped EXE

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-14 02:08

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 02:08

Reported

2024-06-14 02:11

Platform

win7-20240508-en

Max time kernel

143s

Max time network

146s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\kn.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\kn.exe N/A
N/A N/A C:\Users\Public\Libraries\Audio.pif N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Users\Public\Libraries\Audio.pif N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2232 wrote to memory of 1916 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 2232 wrote to memory of 1916 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 2232 wrote to memory of 1916 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 2232 wrote to memory of 2284 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2232 wrote to memory of 2284 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2232 wrote to memory of 2284 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2284 wrote to memory of 2944 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 2284 wrote to memory of 2944 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 2284 wrote to memory of 2944 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 2232 wrote to memory of 2324 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2232 wrote to memory of 2324 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2232 wrote to memory of 2324 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2324 wrote to memory of 2656 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2324 wrote to memory of 2656 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2324 wrote to memory of 2656 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2232 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2232 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2232 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2732 wrote to memory of 2712 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2732 wrote to memory of 2712 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2732 wrote to memory of 2712 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2232 wrote to memory of 2064 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Audio.pif
PID 2232 wrote to memory of 2064 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Audio.pif
PID 2232 wrote to memory of 2064 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Audio.pif
PID 2232 wrote to memory of 2064 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Audio.pif
PID 2232 wrote to memory of 2800 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2232 wrote to memory of 2800 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2232 wrote to memory of 2800 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2232 wrote to memory of 2956 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2232 wrote to memory of 2956 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2232 wrote to memory of 2956 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd"

C:\Windows\System32\extrac32.exe

C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Windows\system32\extrac32.exe

extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd" "C:\\Users\\Public\\Audio.mp4" 9

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd" "C:\\Users\\Public\\Audio.mp4" 9

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12

C:\Users\Public\Libraries\Audio.pif

C:\Users\Public\Libraries\Audio.pif

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S

Network

Country Destination Domain Proto
US 8.8.8.8:53 drive.google.com udp
US 8.8.8.8:53 drive.google.com udp
US 8.8.8.8:53 drive.google.com udp

Files

C:\Users\Public\alpha.exe

MD5 5746bd7e255dd6a8afa06f7c42c1ba41
SHA1 0f3c4ff28f354aede202d54e9d1c5529a3bf87d8
SHA256 db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386
SHA512 3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

C:\Users\Public\kn.exe

MD5 ec1fd3050dbc40ec7e87ab99c7ca0b03
SHA1 ae7fdfc29f4ef31e38ebf381e61b503038b5cb35
SHA256 1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3
SHA512 4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

C:\Users\Public\Audio.mp4

MD5 331acc128c73ca34df0ec4f2773a909d
SHA1 49efefcf09d9d1e7df14b12e937c78f64d30cd91
SHA256 c5d8ddff9277aa014c2612f57059eb7963a5ee7f9393b8dda53c6fedbb93646d
SHA512 cf549dbbfa3101f4587c4508fc6b9243831eb41a61ac1b75a8bf78f0d5350a6d50fcc840ae85163368b1254ab532259c0b9fc48053655d6e1dff3434677e65b3

C:\Users\Public\Libraries\Audio.pif

MD5 a7665a0ba38d413a4186778d0b589419
SHA1 fc281f3d97b91799ce0a0f90da106681810de663
SHA256 f9455699d8c8e96c69cb3c8e87336c34655b2f1c39fee7256ead815c444d39b0
SHA512 741ba77391db3d64deed3811b2024c91d5cc63c05294bf787ddab0d4dde2b434511f10ea08f466b11db1302a485e6ab04c92eb3ef971de2ad325a16a775e6220

memory/2064-34-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-38-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-37-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-36-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-35-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-39-0x0000000000400000-0x000000000051C000-memory.dmp

memory/2064-41-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-98-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-42-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-90-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-91-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-88-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-87-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-85-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-84-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-82-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-81-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-80-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-78-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-77-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-75-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-74-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-72-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-71-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-70-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-68-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-65-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-62-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-61-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-59-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-58-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-56-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-54-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-53-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-52-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-49-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-47-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-46-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-44-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-67-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-64-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-50-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-107-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-104-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-101-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-95-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-92-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-89-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-86-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-83-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-79-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-76-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-73-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-69-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-66-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-63-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-60-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-57-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-55-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-51-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-48-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-45-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-43-0x00000000030E0000-0x00000000040E0000-memory.dmp

memory/2064-40-0x00000000030E0000-0x00000000040E0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 02:08

Reported

2024-06-14 02:11

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

151s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\kn.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\kn.exe N/A
N/A N/A C:\Users\Public\Libraries\Audio.pif N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3672 wrote to memory of 3128 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 3672 wrote to memory of 3128 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 3672 wrote to memory of 4352 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3672 wrote to memory of 4352 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 4352 wrote to memory of 2564 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 4352 wrote to memory of 2564 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 3672 wrote to memory of 1724 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3672 wrote to memory of 1724 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1724 wrote to memory of 4240 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 1724 wrote to memory of 4240 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 3672 wrote to memory of 4016 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3672 wrote to memory of 4016 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 4016 wrote to memory of 3060 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 4016 wrote to memory of 3060 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 3672 wrote to memory of 1764 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Audio.pif
PID 3672 wrote to memory of 1764 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Audio.pif
PID 3672 wrote to memory of 1764 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Audio.pif
PID 3672 wrote to memory of 3860 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3672 wrote to memory of 3860 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3672 wrote to memory of 4860 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3672 wrote to memory of 4860 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd"

C:\Windows\System32\extrac32.exe

C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Windows\system32\extrac32.exe

extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd" "C:\\Users\\Public\\Audio.mp4" 9

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd" "C:\\Users\\Public\\Audio.mp4" 9

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12

C:\Users\Public\Libraries\Audio.pif

C:\Users\Public\Libraries\Audio.pif

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S

Network

Country Destination Domain Proto
US 8.8.8.8:53 drive.google.com udp
US 8.8.8.8:53 drive.google.com udp
US 8.8.8.8:53 drive.google.com udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 drive.google.com udp
US 8.8.8.8:53 drive.google.com udp
US 8.8.8.8:53 drive.google.com udp
US 8.8.8.8:53 drive.google.com udp

Files

C:\Users\Public\alpha.exe

MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

C:\Users\Public\kn.exe

MD5 bd8d9943a9b1def98eb83e0fa48796c2
SHA1 70e89852f023ab7cde0173eda1208dbb580f1e4f
SHA256 8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2
SHA512 95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

C:\Users\Public\Audio.mp4

MD5 331acc128c73ca34df0ec4f2773a909d
SHA1 49efefcf09d9d1e7df14b12e937c78f64d30cd91
SHA256 c5d8ddff9277aa014c2612f57059eb7963a5ee7f9393b8dda53c6fedbb93646d
SHA512 cf549dbbfa3101f4587c4508fc6b9243831eb41a61ac1b75a8bf78f0d5350a6d50fcc840ae85163368b1254ab532259c0b9fc48053655d6e1dff3434677e65b3

C:\Users\Public\Libraries\Audio.pif

MD5 a7665a0ba38d413a4186778d0b589419
SHA1 fc281f3d97b91799ce0a0f90da106681810de663
SHA256 f9455699d8c8e96c69cb3c8e87336c34655b2f1c39fee7256ead815c444d39b0
SHA512 741ba77391db3d64deed3811b2024c91d5cc63c05294bf787ddab0d4dde2b434511f10ea08f466b11db1302a485e6ab04c92eb3ef971de2ad325a16a775e6220

memory/1764-30-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-31-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-32-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-29-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-28-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-33-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-35-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-36-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-38-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-40-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-43-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-44-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-53-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-71-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-91-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-90-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-88-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-87-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-85-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-83-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-82-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-81-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-78-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-77-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-76-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-75-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-74-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-73-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-72-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-89-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-86-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-84-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-80-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-79-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-66-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-63-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-70-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-69-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-68-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-67-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-65-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-56-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-64-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-55-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-62-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-61-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-54-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-48-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-60-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-59-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-52-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-58-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-51-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-57-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-50-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-49-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-47-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-46-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-45-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-42-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-41-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-39-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-37-0x0000000002A40000-0x0000000003A40000-memory.dmp

memory/1764-34-0x0000000002A40000-0x0000000003A40000-memory.dmp