Malware Analysis Report

2024-08-06 14:43

Sample ID 240616-bdbsyssena
Target 0e4c4d9f7b2ee56acdd9b3da668e2da3.bin
SHA256 60bc196e60e29a55ec882753e03883834e0df25d93ab6848b738b3d3a5b0cdaa
Tags
nanocore execution keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

60bc196e60e29a55ec882753e03883834e0df25d93ab6848b738b3d3a5b0cdaa

Threat Level: Known bad

The file 0e4c4d9f7b2ee56acdd9b3da668e2da3.bin was found to be: Known bad.

Malicious Activity Summary

nanocore execution keylogger spyware stealer trojan

NanoCore

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-16 01:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 01:01

Reported

2024-06-16 01:03

Platform

win7-20240611-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2652 set thread context of 2952 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2652 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\schtasks.exe
PID 2652 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\schtasks.exe
PID 2652 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\schtasks.exe
PID 2652 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\schtasks.exe
PID 2652 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2652 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe

"C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PKoUYTS.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PKoUYTS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp781D.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp
US 8.8.8.8:53 alibabaforwader10.ddns.net udp
SE 46.246.14.10:54880 alibabaforwader10.ddns.net tcp
US 8.8.8.8:53 alibabaforwader10.ddns.net udp
SE 46.246.14.10:54880 alibabaforwader10.ddns.net tcp
US 8.8.8.8:53 alibabaforwader10.ddns.net udp
SE 46.246.14.10:54880 alibabaforwader10.ddns.net tcp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp
US 8.8.8.8:53 alibabaforwader10.ddns.net udp
SE 46.246.14.10:54880 alibabaforwader10.ddns.net tcp
US 8.8.8.8:53 alibabaforwader10.ddns.net udp
SE 46.246.14.10:54880 alibabaforwader10.ddns.net tcp
US 8.8.8.8:53 alibabaforwader10.ddns.net udp
SE 46.246.14.10:54880 alibabaforwader10.ddns.net tcp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp

Files

memory/2652-0-0x0000000074A9E000-0x0000000074A9F000-memory.dmp

memory/2652-1-0x00000000013A0000-0x0000000001474000-memory.dmp

memory/2652-2-0x0000000074A90000-0x000000007517E000-memory.dmp

memory/2652-3-0x0000000000A10000-0x0000000000A2A000-memory.dmp

memory/2652-4-0x0000000000480000-0x0000000000490000-memory.dmp

memory/2652-5-0x0000000005DB0000-0x0000000005E2A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp781D.tmp

MD5 fcd374e62a33ec39905684b1391d47e4
SHA1 d4c95f6a1cc1a741a5115638eda26401e266c7d1
SHA256 467513ad2f94a392bace2c9c0ade6ea09a2f36e107d40d242c1a689b5eb9b941
SHA512 f7f3431217de05b53eafdfb36ef4bdf939f11c6c1929e27c4491c358b9b2b2097ba86be132c2fb5060eb850873657d1d6267259f5187fec8f87e610690905dde

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\49BS3CWXX23X24C7FJHT.temp

MD5 9e82a1f4ca9d5c14c99ddeada7723885
SHA1 a9cef3f9de614e2685ec505f580498e3e4ee3de9
SHA256 3496eb65e275b8a2bd33699eb97a3854f8b5764eedd85109f99cfb7ad3ffadec
SHA512 a151266d3a56317dbe5767eb2cb5cd5036523255b0120b41b6e1e006b1cd520d47683aef4302cee1f34a883da3cf1a84ea7f35a3aa858b1647d4efdf941544bd

memory/2952-20-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2952-24-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2952-30-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2952-28-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2952-27-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2952-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2952-22-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2952-18-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2652-31-0x0000000074A90000-0x000000007517E000-memory.dmp

memory/2952-33-0x0000000000450000-0x000000000045A000-memory.dmp

memory/2952-34-0x0000000000580000-0x000000000059E000-memory.dmp

memory/2952-35-0x0000000000460000-0x000000000046A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 01:01

Reported

2024-06-16 01:03

Platform

win10v2004-20240611-en

Max time kernel

146s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2708 set thread context of 1328 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2708 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2708 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2708 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2708 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2708 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2708 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2708 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\schtasks.exe
PID 2708 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\schtasks.exe
PID 2708 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\SysWOW64\schtasks.exe
PID 2708 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2708 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2708 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2708 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2708 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2708 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2708 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2708 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2708 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2708 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2708 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe

"C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4040,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PKoUYTS.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PKoUYTS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp33EC.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp
US 8.8.8.8:53 26.69.169.192.in-addr.arpa udp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 alibabaforwader10.ddns.net udp
SE 46.246.14.10:54880 alibabaforwader10.ddns.net tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 alibabaforwader10.ddns.net udp
SE 46.246.14.10:54880 alibabaforwader10.ddns.net tcp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 alibabaforwader10.ddns.net udp
SE 46.246.14.10:54880 alibabaforwader10.ddns.net tcp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp
US 8.8.8.8:53 alibabaforwader10.ddns.net udp
SE 46.246.14.10:54880 alibabaforwader10.ddns.net tcp
US 8.8.8.8:53 alibabaforwader10.ddns.net udp
SE 46.246.14.10:54880 alibabaforwader10.ddns.net tcp
US 8.8.8.8:53 alibabaforwader10.ddns.net udp
SE 46.246.14.10:54880 alibabaforwader10.ddns.net tcp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp
US 8.8.8.8:53 vjhelena.duckdns.org udp
US 192.169.69.26:54880 vjhelena.duckdns.org tcp

Files

memory/2708-0-0x000000007519E000-0x000000007519F000-memory.dmp

memory/2708-1-0x0000000000E50000-0x0000000000F24000-memory.dmp

memory/2708-2-0x0000000005E30000-0x00000000063D4000-memory.dmp

memory/2708-3-0x0000000005920000-0x00000000059B2000-memory.dmp

memory/2708-4-0x0000000005AC0000-0x0000000005ACA000-memory.dmp

memory/2708-5-0x0000000075190000-0x0000000075940000-memory.dmp

memory/2708-6-0x0000000006CF0000-0x0000000006D0A000-memory.dmp

memory/2708-7-0x0000000006CC0000-0x0000000006CD0000-memory.dmp

memory/2708-8-0x0000000008660000-0x00000000086DA000-memory.dmp

memory/2708-9-0x000000000ADE0000-0x000000000AE7C000-memory.dmp

memory/2708-14-0x000000007519E000-0x000000007519F000-memory.dmp

memory/2228-15-0x0000000005080000-0x00000000050B6000-memory.dmp

memory/2708-16-0x0000000075190000-0x0000000075940000-memory.dmp

memory/2228-18-0x0000000075190000-0x0000000075940000-memory.dmp

memory/2228-17-0x0000000005710000-0x0000000005D38000-memory.dmp

memory/2228-19-0x0000000075190000-0x0000000075940000-memory.dmp

memory/3232-20-0x0000000075190000-0x0000000075940000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp33EC.tmp

MD5 769ae8b017d293afdcf96cb9f84c9307
SHA1 2aca4ae67caeaa905ec3806d63911a215a210d87
SHA256 eb6b33e70a7e3da1f189b95e6218aca555177d52b306172437280648af3297af
SHA512 92fcd5db8e710127468bbdca38923b125181ca73679697e6e689d06305b4f9df6f9da56de6fd2d6789639516f6dcb620385b88731ac586005431a268cd9ddc38

memory/2228-23-0x0000000005F50000-0x0000000005FB6000-memory.dmp

memory/2228-24-0x0000000006030000-0x0000000006096000-memory.dmp

memory/2228-25-0x0000000075190000-0x0000000075940000-memory.dmp

memory/1328-32-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5exqfr30.bs2.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3232-37-0x0000000075190000-0x0000000075940000-memory.dmp

memory/3232-26-0x00000000058C0000-0x0000000005C14000-memory.dmp

memory/2228-22-0x0000000005EB0000-0x0000000005ED2000-memory.dmp

memory/2708-49-0x0000000075190000-0x0000000075940000-memory.dmp

memory/3232-48-0x0000000075190000-0x0000000075940000-memory.dmp

memory/2228-50-0x0000000006650000-0x000000000666E000-memory.dmp

memory/2228-51-0x0000000006C80000-0x0000000006CCC000-memory.dmp

memory/1328-55-0x0000000006530000-0x000000000653A000-memory.dmp

memory/1328-54-0x00000000058E0000-0x00000000058FE000-memory.dmp

memory/1328-53-0x0000000005790000-0x000000000579A000-memory.dmp

memory/3232-58-0x0000000071980000-0x00000000719CC000-memory.dmp

memory/2228-57-0x0000000071980000-0x00000000719CC000-memory.dmp

memory/2228-56-0x0000000006BE0000-0x0000000006C12000-memory.dmp

memory/3232-77-0x0000000006E40000-0x0000000006E5E000-memory.dmp

memory/2228-78-0x0000000007660000-0x0000000007703000-memory.dmp

memory/3232-79-0x0000000007830000-0x0000000007EAA000-memory.dmp

memory/3232-80-0x00000000071F0000-0x000000000720A000-memory.dmp

memory/3232-81-0x0000000007260000-0x000000000726A000-memory.dmp

memory/3232-82-0x0000000007470000-0x0000000007506000-memory.dmp

memory/3232-83-0x00000000073F0000-0x0000000007401000-memory.dmp

memory/2228-84-0x0000000007BA0000-0x0000000007BAE000-memory.dmp

memory/3232-85-0x0000000007430000-0x0000000007444000-memory.dmp

memory/2228-86-0x0000000007CB0000-0x0000000007CCA000-memory.dmp

memory/3232-87-0x0000000007510000-0x0000000007518000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3c0986fc3c94455b9f7c7b9c06ebf55e
SHA1 debf78092df34057a67baaa8c07c89c0e132667e
SHA256 8dd52480c497035d589d1d1f5a6338a45dac87a301813c96a36e23e6f4352a81
SHA512 01a68662638c6cd8e047d0e839f194389bf216b8872fa2e4ac3e60cb0108c4a4b5e9b2aacdc68d7dd8bbaa9b2629be1c1db5b9d978efffd13ab1a0a73aa4d1d6

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/3232-93-0x0000000075190000-0x0000000075940000-memory.dmp

memory/2228-94-0x0000000075190000-0x0000000075940000-memory.dmp