Analysis Overview

score

10^/10

SHA256

04e78ecfe607fbbea63c548deac4a45403a4ce44ffa35a6e858bcbf4b09e7bdf

Threat Level: Known bad

The file 04e78ecfe607fbbea63c548deac4a45403a4ce44ffa35a6e858bcbf4b09e7bdf.zip was found to be: Known bad.

Malicious Activity Summary

stealc vidar xmrig discovery miner spyware stealer upx

xmrig

Detect Vidar Stealer

Vidar

Stealc

Detect binaries embedding considerable number of MFA browser extension IDs.

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

XMRig Miner payload

Detects Windows executables referencing non-Windows User-Agents

Detects executables containing potential Windows Defender anti-emulation checks

Detects executables manipulated with Fody

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

UPX dump on OEP (original entry point)

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Reads user/profile data of web browsers

Reads user/profile data of local email clients

UPX packed file

Reads data files stored by FTP clients

Accesses cryptocurrency files/wallets, possible credential harvesting

Downloads MZ/PE file

Checks computer location settings

Suspicious use of SetThreadContext

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in Windows directory

Program crash

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

MITRE ATT&CK Matrix V13

Subvert Trust Controls

T1553

Install Root Certificate

Unsecured Credentials

System Information Discovery

Data from Local System

Analysis: static1

Detonation Overview

Reported

2024-06-15 01:05

Signatures

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

56s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-rtlsupport-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-rtlsupport-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe"

Network

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win7-20240508-en

Max time kernel

120s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3256 -ip 3256

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3256 -ip 3256

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 540

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	22.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
BE	2.17.107.123:443	www.bing.com	tcp
US	8.8.8.8:53	123.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	35.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	163.126.19.2.in-addr.arpa	udp
US	8.8.8.8:53	106.246.116.51.in-addr.arpa	udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-sysinfo-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-sysinfo-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4336,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-util-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-util-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	133.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	5.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240226-en

Max time kernel

141s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4076 wrote to memory of 4440	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 4076 wrote to memory of 4440	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 4076 wrote to memory of 4440	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4440 -ip 4440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	138.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
GB	142.250.180.10:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	pki.goog	udp
US	8.8.8.8:53	pki.goog	udp
US	216.239.32.29:80	pki.goog	tcp
US	8.8.8.8:53	35.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	10.180.250.142.in-addr.arpa	udp
US	8.8.8.8:53	29.32.239.216.in-addr.arpa	udp
US	8.8.8.8:53	18.24.18.2.in-addr.arpa	udp
US	8.8.8.8:53	23.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	137.126.19.2.in-addr.arpa	udp
US	8.8.8.8:53	106.246.116.51.in-addr.arpa	udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240226-en

Max time kernel

141s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-heap-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-heap-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	241.150.49.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	228.249.119.40.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
GB	172.217.16.234:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	234.16.217.172.in-addr.arpa	udp
US	8.8.8.8:53	25.24.18.2.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	163.126.19.2.in-addr.arpa	udp
US	8.8.8.8:53	5.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\python310.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\python310.dll,#1

Network

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win7-20240508-en

Max time kernel

117s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2988 wrote to memory of 3004	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2988 wrote to memory of 3004	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2988 wrote to memory of 3004	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2988 wrote to memory of 3004	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2988 wrote to memory of 3004	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2988 wrote to memory of 3004	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2988 wrote to memory of 3004	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3004 wrote to memory of 3044	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 3004 wrote to memory of 3044	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 3004 wrote to memory of 3044	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 3004 wrote to memory of 3044	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 220

Network

N/A

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-conio-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-conio-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

96s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-filesystem-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-filesystem-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
BE	2.17.107.105:443	www.bing.com	tcp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	105.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	20.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	163.126.19.2.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	18.24.18.2.in-addr.arpa	udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win7-20240508-en

Max time kernel

119s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe"

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win7-20240611-en

Max time kernel

119s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\HDHelper_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	133.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
BE	2.17.107.105:443	www.bing.com	tcp
US	8.8.8.8:53	105.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	163.126.19.2.in-addr.arpa	udp
US	8.8.8.8:53	25.24.18.2.in-addr.arpa	udp
US	8.8.8.8:53		udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

55s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-timezone-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-timezone-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-math-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-math-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win7-20240220-en

Max time kernel

118s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\vcruntime140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\vcruntime140.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\vcruntime140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\vcruntime140.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8

Network

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win7-20240611-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

52s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\VSLauncher_[0MB]_[1].exe"

Network

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

60s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-multibyte-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-multibyte-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

95s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-private-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-private-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
BE	2.17.107.105:443	www.bing.com	tcp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	105.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240611-en

Max time kernel

124s

Max time network

130s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4088,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	17.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

59s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-string-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-string-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

157s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-synch-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-synch-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
BE	88.221.83.187:443	www.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	134.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	187.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	35.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	18.24.18.2.in-addr.arpa	udp
US	8.8.8.8:53	23.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	106.246.116.51.in-addr.arpa	udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-synch-l1-2-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-core-synch-l1-2-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
BE	2.17.107.115:443	www.bing.com	tcp
US	8.8.8.8:53	17.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	25.24.18.2.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	115.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240611-en

Max time kernel

124s

Max time network

129s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-locale-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-locale-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3808,i,11751898164297348119,13021661521765644467,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	22.160.190.20.in-addr.arpa	udp
BE	88.221.83.187:443	www.bing.com	tcp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	187.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	88.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	25.24.18.2.in-addr.arpa	udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240611-en

Max time kernel

143s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe"

Signatures

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Vidar

stealer vidar

xmrig

miner xmrig

Detect binaries embedding considerable number of MFA browser extension IDs.

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects Windows executables referencing non-Windows User-Agents

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects executables containing potential Windows Defender anti-emulation checks

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects executables manipulated with Fody

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

UPX dump on OEP (original entry point)

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Downloads MZ/PE file

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 3608 set thread context of 3380	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2460 set thread context of 4476	N/A	C:\ProgramData\KKJKEBKFCA.exe	C:\Windows\SysWOW64\ftp.exe
PID 2000 set thread context of 4280	N/A	C:\ProgramData\GIEHIDHJDB.exe	C:\Windows\SysWOW64\ftp.exe
PID 4476 set thread context of 4460	N/A	C:\Windows\SysWOW64\ftp.exe	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4460 set thread context of 3984	N/A	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Checks installed software on the system

discovery

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\Tasks\Watcher Com SH.job	C:\Windows\SysWOW64\ftp.exe	N/A
File created	C:\Windows\Tasks\TWI Cloud Host.job	C:\Windows\SysWOW64\ftp.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\ProgramData\GIEHIDHJDB.exe	N/A
N/A	N/A	C:\ProgramData\KKJKEBKFCA.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\ProgramData\GIEHIDHJDB.exe	N/A
N/A	N/A	C:\ProgramData\KKJKEBKFCA.exe	N/A
N/A	N/A	C:\ProgramData\KKJKEBKFCA.exe	N/A
N/A	N/A	C:\ProgramData\GIEHIDHJDB.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\ProgramData\KKJKEBKFCA.exe	N/A
N/A	N/A	C:\ProgramData\GIEHIDHJDB.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3608 wrote to memory of 3380	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 3608 wrote to memory of 3380	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 3608 wrote to memory of 3380	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 3608 wrote to memory of 3380	N/A	C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 3380 wrote to memory of 1680	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 3380 wrote to memory of 1680	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 3380 wrote to memory of 1680	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 3380 wrote to memory of 1680	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 3380 wrote to memory of 1680	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1680 wrote to memory of 2000	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\ProgramData\GIEHIDHJDB.exe
PID 1680 wrote to memory of 2000	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\ProgramData\GIEHIDHJDB.exe
PID 1680 wrote to memory of 2000	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\ProgramData\GIEHIDHJDB.exe
PID 1680 wrote to memory of 2460	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\ProgramData\KKJKEBKFCA.exe
PID 1680 wrote to memory of 2460	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\ProgramData\KKJKEBKFCA.exe
PID 1680 wrote to memory of 2460	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\ProgramData\KKJKEBKFCA.exe
PID 2460 wrote to memory of 4476	N/A	C:\ProgramData\KKJKEBKFCA.exe	C:\Windows\SysWOW64\ftp.exe
PID 2460 wrote to memory of 4476	N/A	C:\ProgramData\KKJKEBKFCA.exe	C:\Windows\SysWOW64\ftp.exe
PID 2460 wrote to memory of 4476	N/A	C:\ProgramData\KKJKEBKFCA.exe	C:\Windows\SysWOW64\ftp.exe
PID 2000 wrote to memory of 4280	N/A	C:\ProgramData\GIEHIDHJDB.exe	C:\Windows\SysWOW64\ftp.exe
PID 2000 wrote to memory of 4280	N/A	C:\ProgramData\GIEHIDHJDB.exe	C:\Windows\SysWOW64\ftp.exe
PID 2000 wrote to memory of 4280	N/A	C:\ProgramData\GIEHIDHJDB.exe	C:\Windows\SysWOW64\ftp.exe
PID 2460 wrote to memory of 4476	N/A	C:\ProgramData\KKJKEBKFCA.exe	C:\Windows\SysWOW64\ftp.exe
PID 2000 wrote to memory of 4280	N/A	C:\ProgramData\GIEHIDHJDB.exe	C:\Windows\SysWOW64\ftp.exe
PID 1680 wrote to memory of 376	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 376	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 376	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 716	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 376 wrote to memory of 716	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 376 wrote to memory of 716	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 4476 wrote to memory of 4460	N/A	C:\Windows\SysWOW64\ftp.exe	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4476 wrote to memory of 4460	N/A	C:\Windows\SysWOW64\ftp.exe	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4280 wrote to memory of 4768	N/A	C:\Windows\SysWOW64\ftp.exe	C:\Windows\SysWOW64\explorer.exe
PID 4280 wrote to memory of 4768	N/A	C:\Windows\SysWOW64\ftp.exe	C:\Windows\SysWOW64\explorer.exe
PID 4280 wrote to memory of 4768	N/A	C:\Windows\SysWOW64\ftp.exe	C:\Windows\SysWOW64\explorer.exe
PID 4476 wrote to memory of 4460	N/A	C:\Windows\SysWOW64\ftp.exe	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4476 wrote to memory of 4460	N/A	C:\Windows\SysWOW64\ftp.exe	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4280 wrote to memory of 4768	N/A	C:\Windows\SysWOW64\ftp.exe	C:\Windows\SysWOW64\explorer.exe
PID 4460 wrote to memory of 3984	N/A	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 4460 wrote to memory of 3984	N/A	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 4460 wrote to memory of 3984	N/A	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 4460 wrote to memory of 3984	N/A	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 4460 wrote to memory of 3984	N/A	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 4460 wrote to memory of 3984	N/A	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 4460 wrote to memory of 3984	N/A	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\ProgramData\GIEHIDHJDB.exe

"C:\ProgramData\GIEHIDHJDB.exe"

C:\ProgramData\KKJKEBKFCA.exe

"C:\ProgramData\KKJKEBKFCA.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HCAEGCBFHJDG" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe -a rx/0 --url=65.109.127.181:3333 -u PLAYA -p PLAYA -R --variant=-1 --max-cpu-usage=70 --donate-level=1 -opencl

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	20.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	feeldog.xyz	udp
US	104.21.13.222:443	feeldog.xyz	tcp
US	8.8.8.8:53	c.pki.goog	udp
GB	172.217.169.67:80	c.pki.goog	tcp
US	8.8.8.8:53	222.13.21.104.in-addr.arpa	udp
US	8.8.8.8:53	67.169.217.172.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	t.me	udp
NL	149.154.167.99:443	t.me	tcp
DE	195.201.251.58:9000	195.201.251.58	tcp
US	8.8.8.8:53	36.249.124.192.in-addr.arpa	udp
US	8.8.8.8:53	99.167.154.149.in-addr.arpa	udp
DE	195.201.251.58:9000	195.201.251.58	tcp
DE	195.201.251.58:9000	195.201.251.58	tcp
US	8.8.8.8:53	58.251.201.195.in-addr.arpa	udp
DE	195.201.251.58:9000	195.201.251.58	tcp
DE	195.201.251.58:9000	195.201.251.58	tcp
DE	195.201.251.58:9000	195.201.251.58	tcp
DE	195.201.251.58:9000	195.201.251.58	tcp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
DE	195.201.251.58:9000	195.201.251.58	tcp
DE	195.201.251.58:9000	195.201.251.58	tcp
DE	195.201.251.58:9000	195.201.251.58	tcp
DE	195.201.251.58:9000	195.201.251.58	tcp
DE	195.201.251.58:9000	195.201.251.58	tcp
US	8.8.8.8:53	businessdownloads.ltd	udp
US	172.67.212.123:443	businessdownloads.ltd	tcp
US	8.8.8.8:53	123.212.67.172.in-addr.arpa	udp
DE	195.201.251.58:9000	195.201.251.58	tcp
US	8.8.8.8:53	i.imgur.com	udp
US	199.232.196.193:443	i.imgur.com	tcp
DE	195.201.251.58:9000	195.201.251.58	tcp
DE	195.201.251.58:9000	195.201.251.58	tcp
US	8.8.8.8:53	193.196.232.199.in-addr.arpa	udp
DE	195.201.251.58:9000	195.201.251.58	tcp
DE	195.201.251.58:9000	195.201.251.58	tcp
DE	195.201.251.58:9000	195.201.251.58	tcp
US	8.8.8.8:53	137.126.19.2.in-addr.arpa	udp
FI	135.181.22.88:80	135.181.22.88	tcp
US	8.8.8.8:53	88.22.181.135.in-addr.arpa	udp
FI	65.109.127.181:3333		tcp
FI	65.109.127.181:3333		tcp
US	8.8.8.8:53	proresupdate.com	udp
US	45.152.112.146:80	proresupdate.com	tcp
US	8.8.8.8:53	146.112.152.45.in-addr.arpa	udp
FI	65.109.127.181:3333		tcp
FI	65.109.127.181:3333		tcp

Files

memory/3608-0-0x00007FFFA80A0000-0x00007FFFA8212000-memory.dmp

memory/3608-5-0x00007FFFA80B8000-0x00007FFFA80B9000-memory.dmp

memory/3608-6-0x00007FFFA80A0000-0x00007FFFA8212000-memory.dmp

memory/3608-7-0x00007FFFA80A0000-0x00007FFFA8212000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\76c6e391

MD5	ea000b2a5bbbfd4d20821bd85e4cf932
SHA1	dcafe122ab40bfe96757fe7822231c988464a5eb
SHA256	17d3c744a54fd039c9db3d25c20f75854461a9a05835355af5edd3d0838a603a
SHA512	11790680396dbc4d0a535bc860a58be46836aa07b02d9c46bff9c2b84420b9129ca861b02194759033d6e6af8d3d994a5df3317c5b622b98d36dc2b0cbd3ad77

memory/3380-10-0x00007FFFC62D0000-0x00007FFFC64C5000-memory.dmp

memory/3380-12-0x0000000073D1E000-0x0000000073D20000-memory.dmp

memory/3380-13-0x0000000073D11000-0x0000000073D1F000-memory.dmp

memory/3380-17-0x0000000073D11000-0x0000000073D1F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\coml.au3

MD5	c56b5f0201a3b3de53e561fe76912bfd
SHA1	2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256	237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512	195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/1680-19-0x0000000000FC0000-0x000000000170C000-memory.dmp

memory/1680-21-0x00007FFFC62D0000-0x00007FFFC64C5000-memory.dmp

memory/1680-28-0x0000000000FC0000-0x000000000170C000-memory.dmp

memory/1680-41-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\ProgramData\HCAEGCBFHJDG\nss3.dll

MD5	1cc453cdf74f31e4d913ff9c10acdde2
SHA1	6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256	ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512	dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\HCAEGCBFHJDG\mozglue.dll

MD5	c8fd9be83bc728cc04beffafc2907fe9
SHA1	95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256	ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512	fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\GIEHIDHJDB.exe

MD5	6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1	424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA256	376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
SHA512	d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8

memory/2000-125-0x0000000000B50000-0x0000000001063000-memory.dmp

memory/1680-126-0x0000000000FC0000-0x000000000170C000-memory.dmp

C:\ProgramData\KKJKEBKFCA.exe

MD5	daaff76b0baf0a1f9cec253560c5db20
SHA1	0311cf0eeb4beddd2c69c6e97462595313a41e78
SHA256	5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
SHA512	987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3

memory/2460-137-0x0000000000AD0000-0x0000000000D18000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\e5bb857

MD5	c62f812e250409fbd3c78141984270f2
SHA1	9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA256	d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
SHA512	7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092

memory/2460-143-0x0000000072170000-0x00000000722EB000-memory.dmp

memory/2460-144-0x00007FFFC62D0000-0x00007FFFC64C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\13942430

MD5	8d443e7cb87cacf0f589ce55599e008f
SHA1	c7ff0475a3978271e0a8417ac4a826089c083772
SHA256	e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
SHA512	c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5

memory/2000-150-0x0000000072170000-0x00000000722EB000-memory.dmp

memory/2000-151-0x00007FFFC62D0000-0x00007FFFC64C5000-memory.dmp

memory/1680-155-0x0000000000FC0000-0x000000000170C000-memory.dmp

memory/1680-156-0x0000000000FC0000-0x000000000170C000-memory.dmp

memory/2460-160-0x0000000072170000-0x00000000722EB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1122e574

MD5	3ca89f5c8a5d435eb758701a2c6fe548
SHA1	6d41dd827e5549203d5ea31ac119c112423a4f7c
SHA256	921120b68c6417b024c8a89962c1480d2e45d452a72e092546aaaa907a42cd81
SHA512	580f9eb4c5af88d3e0ed9448603dbb6b0be92dab587c781a13d473ff730212c67460049453ab2382cc4fc71fc186367a788c218a39c62eaf9bf44a9b3c93f8f4

memory/2000-167-0x0000000072170000-0x00000000722EB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\158310c3

MD5	12853f1a15c7c5d4cc3971b582d9a1c6
SHA1	89f687e97f1ad7b300279f005dc3a13547aeaa10
SHA256	66423098a26b58619976ff05222628024a03cfb30ef370224966d30b74ef01f9
SHA512	4a6cdb2c773ed00ff09b82e8d9aca80d0cea2937259b852f6f4ee257b00d38d7ac766d844bc2ce1bad83161b54cf712ecc40a353ec74e7a421a1b428cec12acb

memory/1680-174-0x0000000000FC0000-0x000000000170C000-memory.dmp

memory/4476-175-0x00007FFFC62D0000-0x00007FFFC64C5000-memory.dmp

memory/4280-176-0x00007FFFC62D0000-0x00007FFFC64C5000-memory.dmp

memory/4476-177-0x0000000072170000-0x00000000722EB000-memory.dmp

C:\ProgramData\HCAEGCBFHJDG\VCRUNT~1.DLL

MD5	a37ee36b536409056a86f50e67777dd7
SHA1	1cafa159292aa736fc595fc04e16325b27cd6750
SHA256	8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512	3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\HCAEGCBFHJDG\softokn3.dll

MD5	4e52d739c324db8225bd9ab2695f262f
SHA1	71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256	74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512	2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

C:\ProgramData\HCAEGCBFHJDG\msvcp140.dll

MD5	5ff1fca37c466d6723ec67be93b51442
SHA1	34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256	5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512	4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

memory/4476-192-0x0000000072170000-0x00000000722EB000-memory.dmp

memory/4460-195-0x00007FFFA6380000-0x00007FFFA79F7000-memory.dmp

memory/4768-199-0x00007FFFC62D0000-0x00007FFFC64C5000-memory.dmp

memory/4460-200-0x0000000000400000-0x000000000040A000-memory.dmp

memory/3984-204-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3984-206-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3984-208-0x000002E5A7630000-0x000002E5A7650000-memory.dmp

memory/3984-207-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3984-210-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3984-212-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3984-211-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3984-209-0x0000000140000000-0x00000001407DC000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win7-20240221-en

Max time kernel

117s

Max time network

118s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\python310.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\python310.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

157s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-convert-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-convert-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
BE	2.17.107.115:443	www.bing.com	tcp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	136.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	115.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	58.99.105.20.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	18.24.18.2.in-addr.arpa	udp
US	8.8.8.8:53	106.246.116.51.in-addr.arpa	udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-15 01:04

Reported

2024-06-15 01:07

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-environment-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0Pen_4422_P@$SW0rd~!!$\x86\api-ms-win-crt-environment-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	75.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
BE	88.221.83.187:443	www.bing.com	tcp
US	8.8.8.8:53	187.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	88.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	23.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53		udp

Files

N/A

Sample ID	240615-bfeydstcqe
Target	04e78ecfe607fbbea63c548deac4a45403a4ce44ffa35a6e858bcbf4b09e7bdf.zip
SHA256	04e78ecfe607fbbea63c548deac4a45403a4ce44ffa35a6e858bcbf4b09e7bdf
Tags	stealc vidar xmrig discovery miner spyware stealer upx

Malware Analysis Report

2024-09-11 16:29

Table of Contents