Malware Analysis Report

2024-10-10 12:02

Sample ID 240615-pnkeqszhpc
Target e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829
SHA256 e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829
Tags
risepro stealc vidar spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829

Threat Level: Known bad

The file e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829 was found to be: Known bad.

Malicious Activity Summary

risepro stealc vidar spyware stealer

Vidar

Detect Vidar Stealer

Stealc

RisePro

Downloads MZ/PE file

Executes dropped EXE

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Unsigned PE

Checks processor information in registry

Delays execution with timeout.exe

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-15 12:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 12:28

Reported

2024-06-15 12:31

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RisePro

stealer risepro

Stealc

stealer stealc

Vidar

stealer vidar

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\GIJJKFCGDG.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3084 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3084 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3084 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3084 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3084 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3084 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3084 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3084 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3084 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2260 wrote to memory of 1096 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\GIJJKFCGDG.exe
PID 2260 wrote to memory of 1096 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\GIJJKFCGDG.exe
PID 2260 wrote to memory of 1096 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\GIJJKFCGDG.exe
PID 1096 wrote to memory of 4024 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1096 wrote to memory of 4024 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1096 wrote to memory of 4024 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1096 wrote to memory of 4420 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1096 wrote to memory of 4420 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1096 wrote to memory of 4420 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1096 wrote to memory of 1864 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1096 wrote to memory of 1864 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1096 wrote to memory of 1864 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1096 wrote to memory of 1864 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1096 wrote to memory of 1864 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1096 wrote to memory of 1864 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1096 wrote to memory of 1864 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1096 wrote to memory of 1864 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1096 wrote to memory of 1864 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1096 wrote to memory of 1864 N/A C:\ProgramData\GIJJKFCGDG.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2260 wrote to memory of 4052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 4052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 4052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 4052 wrote to memory of 2944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4052 wrote to memory of 2944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4052 wrote to memory of 2944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe

"C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

C:\ProgramData\GIJJKFCGDG.exe

"C:\ProgramData\GIJJKFCGDG.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\JJKEBGHJKFID" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country Destination Domain Proto
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 99.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
DE 195.201.251.58:9000 195.201.251.58 tcp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
BE 88.221.83.185:443 www.bing.com tcp
US 8.8.8.8:53 23.249.124.192.in-addr.arpa udp
US 8.8.8.8:53 58.251.201.195.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 185.83.221.88.in-addr.arpa udp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 tcp
DE 195.201.251.58:9000 tcp
DE 195.201.251.58:9000 tcp
DE 195.201.251.58:9000 tcp
DE 195.201.251.58:9000 tcp
DE 195.201.251.58:9000 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
RU 5.42.65.116:80 5.42.65.116 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
US 8.8.8.8:53 116.65.42.5.in-addr.arpa udp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
DE 195.201.251.58:9000 195.201.251.58 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/3084-0-0x0000000074DFE000-0x0000000074DFF000-memory.dmp

memory/3084-1-0x0000000000530000-0x0000000000970000-memory.dmp

memory/3084-2-0x0000000005390000-0x000000000542C000-memory.dmp

memory/3084-3-0x0000000074DF0000-0x00000000755A0000-memory.dmp

memory/3084-4-0x0000000005540000-0x00000000055EA000-memory.dmp

memory/3084-5-0x0000000005350000-0x000000000536C000-memory.dmp

memory/3084-61-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-65-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-63-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-59-0x0000000005350000-0x0000000005365000-memory.dmp

memory/2260-68-0x0000000000400000-0x0000000000648000-memory.dmp

memory/2260-67-0x0000000000400000-0x0000000000648000-memory.dmp

memory/3084-57-0x0000000005350000-0x0000000005365000-memory.dmp

memory/2260-71-0x0000000000400000-0x0000000000648000-memory.dmp

memory/3084-70-0x0000000074DF0000-0x00000000755A0000-memory.dmp

memory/3084-55-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-72-0x0000000074DF0000-0x00000000755A0000-memory.dmp

memory/3084-53-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-51-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-47-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-45-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-43-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-41-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-39-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-35-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-33-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-31-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-29-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-27-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-26-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-21-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-19-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-17-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-15-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-13-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-11-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-9-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-6-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-49-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-37-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-23-0x0000000005350000-0x0000000005365000-memory.dmp

memory/3084-7-0x0000000005350000-0x0000000005365000-memory.dmp

memory/2260-84-0x0000000000400000-0x0000000000648000-memory.dmp

C:\ProgramData\GIJJKFCGDG.exe

MD5 7fc744e8d5f2c7c533dd995a5d0c1d30
SHA1 f8220ea06b9c3e5d31a203f63787bd502780f33c
SHA256 00bb335318bc7964d7d8f58e4e3688d340431a5f38998ee257898c88874b0797
SHA512 c3a96071bdabaaca5689f11c14505d0d4bd8f877a7aaf6ce5b376db46cd589819bf810c68f704197a9a91b7ce46217e7a05c3f86b7d64cd61a7a367178e68aeb

memory/1096-144-0x0000000000360000-0x0000000000533000-memory.dmp

memory/1096-145-0x0000000000360000-0x0000000000533000-memory.dmp

memory/1864-149-0x0000000000400000-0x0000000000596000-memory.dmp

memory/2260-152-0x0000000000400000-0x0000000000648000-memory.dmp

memory/1864-153-0x0000000000400000-0x0000000000596000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 12:28

Reported

2024-06-15 12:31

Platform

win11-20240508-en

Max time kernel

114s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1876 set thread context of 1892 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1876 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1876 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1876 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1876 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1876 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1876 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1876 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1876 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1876 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1892 wrote to memory of 2712 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 1892 wrote to memory of 2712 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 1892 wrote to memory of 2712 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 4892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2712 wrote to memory of 4892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2712 wrote to memory of 4892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe

"C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\KEHDHIDAEHCF" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country Destination Domain Proto
US 8.8.8.8:53 t.me udp
US 8.8.8.8:53 steamcommunity.com udp

Files

memory/1876-0-0x00000000751BE000-0x00000000751BF000-memory.dmp

memory/1876-1-0x0000000000430000-0x0000000000870000-memory.dmp

memory/1876-2-0x0000000005210000-0x00000000052AC000-memory.dmp

memory/1876-3-0x0000000005330000-0x00000000053DA000-memory.dmp

memory/1876-4-0x00000000751B0000-0x0000000075961000-memory.dmp

memory/1876-5-0x00000000051D0000-0x00000000051EC000-memory.dmp

memory/1876-31-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-29-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-27-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-25-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-23-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-21-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-19-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-17-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-15-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-13-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-11-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-9-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-7-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-6-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-65-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1892-66-0x0000000000400000-0x0000000000648000-memory.dmp

memory/1892-71-0x0000000000400000-0x0000000000648000-memory.dmp

memory/1876-70-0x00000000751B0000-0x0000000075961000-memory.dmp

memory/1892-68-0x0000000000400000-0x0000000000648000-memory.dmp

memory/1876-63-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-61-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-59-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-57-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-55-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-53-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-72-0x00000000751B0000-0x0000000075961000-memory.dmp

memory/1876-51-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-49-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-47-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-45-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-43-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-41-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-39-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-37-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-35-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1876-33-0x00000000051D0000-0x00000000051E5000-memory.dmp

memory/1892-73-0x0000000000400000-0x0000000000648000-memory.dmp

memory/1892-74-0x0000000000400000-0x0000000000648000-memory.dmp

memory/1892-76-0x0000000000400000-0x0000000000648000-memory.dmp