Malware Analysis Report

2024-08-06 14:17

Sample ID 240615-j5vn5sxbrk
Target hesaphareketi-01.cmd
SHA256 6ff59a7a9bb26552d874bf03ffd04b7c152184e443d09f79a4f2459f8a04dd55
Tags
modiloader trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6ff59a7a9bb26552d874bf03ffd04b7c152184e443d09f79a4f2459f8a04dd55

Threat Level: Known bad

The file hesaphareketi-01.cmd was found to be: Known bad.

Malicious Activity Summary

modiloader trojan

ModiLoader, DBatLoader

ModiLoader Second Stage

Executes dropped EXE

Loads dropped DLL

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-15 08:15

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 08:15

Reported

2024-06-15 08:18

Platform

win7-20240508-en

Max time kernel

141s

Max time network

118s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.cmd"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\kn.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\kn.exe N/A
N/A N/A C:\Users\Public\Libraries\Audio.pif N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Users\Public\Libraries\Audio.pif N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1644 wrote to memory of 2036 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 1644 wrote to memory of 2036 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 1644 wrote to memory of 2036 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 1644 wrote to memory of 2460 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1644 wrote to memory of 2460 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1644 wrote to memory of 2460 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2460 wrote to memory of 2772 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 2460 wrote to memory of 2772 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 2460 wrote to memory of 2772 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 1644 wrote to memory of 1972 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1644 wrote to memory of 1972 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1644 wrote to memory of 1972 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1972 wrote to memory of 2596 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 1972 wrote to memory of 2596 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 1972 wrote to memory of 2596 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 1644 wrote to memory of 2692 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1644 wrote to memory of 2692 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1644 wrote to memory of 2692 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2692 wrote to memory of 2716 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2692 wrote to memory of 2716 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2692 wrote to memory of 2716 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 1644 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Audio.pif
PID 1644 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Audio.pif
PID 1644 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Audio.pif
PID 1644 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Audio.pif
PID 1644 wrote to memory of 2728 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1644 wrote to memory of 2728 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1644 wrote to memory of 2728 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1644 wrote to memory of 2672 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1644 wrote to memory of 2672 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1644 wrote to memory of 2672 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.cmd"

C:\Windows\System32\extrac32.exe

C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Windows\system32\extrac32.exe

extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.cmd" "C:\\Users\\Public\\Audio.mp4" 9

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.cmd" "C:\\Users\\Public\\Audio.mp4" 9

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12

C:\Users\Public\Libraries\Audio.pif

C:\Users\Public\Libraries\Audio.pif

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S

Network

Country Destination Domain Proto
US 8.8.8.8:53 onedrive.live.com udp

Files

\Users\Public\alpha.exe

MD5 5746bd7e255dd6a8afa06f7c42c1ba41
SHA1 0f3c4ff28f354aede202d54e9d1c5529a3bf87d8
SHA256 db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386
SHA512 3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

\Users\Public\kn.exe

MD5 ec1fd3050dbc40ec7e87ab99c7ca0b03
SHA1 ae7fdfc29f4ef31e38ebf381e61b503038b5cb35
SHA256 1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3
SHA512 4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

C:\Users\Public\Audio.mp4

MD5 2b394a65ee90021cb0990dbdb9ee43bb
SHA1 341e96b53dfb4831dfe1f3334cfb6405df173f52
SHA256 e106349c4b793aac809fd7b11dca2cf1a293fecd584071e9ed0b48cb0bdff857
SHA512 51eae123e69dbf6d040d88f8984b9cdb8de16c0035f05a0c355c3f2d9b372706a7c8e6bf554051842980fb043328350d380c6590ac05cefb0996ddd9a9bd3680

C:\Users\Public\Libraries\Audio.pif

MD5 1a7ed7270f975e1aedd73a800e17a40b
SHA1 6a7b00eb876108cbbcbeaef40448ecf34a518d59
SHA256 a6d0ab763d30f720839b50458cf1e4ab601f5574dd6d835aa17488535e89bd3b
SHA512 289ef44a7e171145232f497075596bdba81f53016a8d16935a20069396f91548e5643b1fab2264613f54cb34c12974529ab01fd6e5b3a78708557df2e00781f7

memory/2632-34-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-37-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-38-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-36-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-35-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-39-0x0000000000400000-0x0000000000589000-memory.dmp

memory/2632-41-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-42-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-44-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-40-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-43-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-46-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-49-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-48-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-47-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-50-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-53-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-55-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-54-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-57-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-56-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-62-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-59-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-63-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-61-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-60-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-65-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-69-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-68-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-67-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-66-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-71-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-70-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-73-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-72-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-74-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-77-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-84-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-122-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-120-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-118-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-116-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-113-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-111-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-109-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-108-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-106-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-103-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-101-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-99-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-96-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-94-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-92-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-89-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-87-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-82-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-78-0x00000000033A0000-0x00000000043A0000-memory.dmp

memory/2632-76-0x00000000033A0000-0x00000000043A0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 08:15

Reported

2024-06-15 08:18

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.cmd"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\kn.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\kn.exe N/A
N/A N/A C:\Users\Public\Libraries\Audio.pif N/A
N/A N/A C:\Users\Public\alpha.exe N/A
N/A N/A C:\Users\Public\alpha.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 216 wrote to memory of 4204 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 216 wrote to memory of 4204 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\extrac32.exe
PID 216 wrote to memory of 3496 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 216 wrote to memory of 3496 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3496 wrote to memory of 4340 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 3496 wrote to memory of 4340 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 216 wrote to memory of 4048 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 216 wrote to memory of 4048 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 4048 wrote to memory of 1176 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 4048 wrote to memory of 1176 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 216 wrote to memory of 1012 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 216 wrote to memory of 1012 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1012 wrote to memory of 2408 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 1012 wrote to memory of 2408 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 216 wrote to memory of 1344 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Audio.pif
PID 216 wrote to memory of 1344 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Audio.pif
PID 216 wrote to memory of 1344 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Audio.pif
PID 216 wrote to memory of 2216 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 216 wrote to memory of 2216 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 216 wrote to memory of 4964 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 216 wrote to memory of 4964 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.cmd"

C:\Windows\System32\extrac32.exe

C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Windows\system32\extrac32.exe

extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.cmd" "C:\\Users\\Public\\Audio.mp4" 9

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.cmd" "C:\\Users\\Public\\Audio.mp4" 9

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12

C:\Users\Public\Libraries\Audio.pif

C:\Users\Public\Libraries\Audio.pif

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S

Network

Country Destination Domain Proto
US 8.8.8.8:53 onedrive.live.com udp
US 8.8.8.8:53 onedrive.live.com udp
US 8.8.8.8:53 onedrive.live.com udp
US 8.8.8.8:53 onedrive.live.com udp
US 8.8.8.8:53 onedrive.live.com udp
US 8.8.8.8:53 onedrive.live.com udp
US 8.8.8.8:53 onedrive.live.com udp

Files

C:\Users\Public\alpha.exe

MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

C:\Users\Public\kn.exe

MD5 bd8d9943a9b1def98eb83e0fa48796c2
SHA1 70e89852f023ab7cde0173eda1208dbb580f1e4f
SHA256 8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2
SHA512 95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

C:\Users\Public\Audio.mp4

MD5 2b394a65ee90021cb0990dbdb9ee43bb
SHA1 341e96b53dfb4831dfe1f3334cfb6405df173f52
SHA256 e106349c4b793aac809fd7b11dca2cf1a293fecd584071e9ed0b48cb0bdff857
SHA512 51eae123e69dbf6d040d88f8984b9cdb8de16c0035f05a0c355c3f2d9b372706a7c8e6bf554051842980fb043328350d380c6590ac05cefb0996ddd9a9bd3680

C:\Users\Public\Libraries\Audio.pif

MD5 1a7ed7270f975e1aedd73a800e17a40b
SHA1 6a7b00eb876108cbbcbeaef40448ecf34a518d59
SHA256 a6d0ab763d30f720839b50458cf1e4ab601f5574dd6d835aa17488535e89bd3b
SHA512 289ef44a7e171145232f497075596bdba81f53016a8d16935a20069396f91548e5643b1fab2264613f54cb34c12974529ab01fd6e5b3a78708557df2e00781f7

memory/1344-29-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-32-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-31-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-30-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-28-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-33-0x0000000000400000-0x0000000000589000-memory.dmp

memory/1344-34-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-35-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-36-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-37-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-39-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-40-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-41-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-43-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-45-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-47-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-49-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-52-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-56-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-61-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-69-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-79-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-91-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-90-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-88-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-87-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-86-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-85-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-83-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-82-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-81-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-78-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-77-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-89-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-75-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-74-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-72-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-84-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-71-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-70-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-80-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-68-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-67-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-76-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-66-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-65-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-73-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-64-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-63-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-62-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-60-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-59-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-58-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-57-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-55-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-54-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-53-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-51-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-50-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-48-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-46-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-42-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-44-0x0000000002AB0000-0x0000000003AB0000-memory.dmp

memory/1344-38-0x0000000002AB0000-0x0000000003AB0000-memory.dmp