Malware Analysis Report

2024-09-11 09:43

Sample ID 240616-bgn8fswhjr
Target 15f948da0e0786ee883bc9714ee6b47a.bin
SHA256 f37c28f29f9ebba6ff413931a169d1e8979c1cf321ae4dc9521769b3c3bda4c4
Tags
redline sectoprat cheat execution infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f37c28f29f9ebba6ff413931a169d1e8979c1cf321ae4dc9521769b3c3bda4c4

Threat Level: Known bad

The file 15f948da0e0786ee883bc9714ee6b47a.bin was found to be: Known bad.

Malicious Activity Summary

redline sectoprat cheat execution infostealer rat trojan

SectopRAT payload

RedLine payload

SectopRAT

RedLine

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-16 01:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 01:07

Reported

2024-06-16 01:09

Platform

win7-20240220-en

Max time kernel

149s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2572 set thread context of 540 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1660 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1660 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1660 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1660 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2572 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2572 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2572 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2572 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2572 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2572 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2572 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2572 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2572 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2572 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2572 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2572 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2572 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2572 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2572 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2572 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2572 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Processes

C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe

"C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gsGRKUB.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gsGRKUB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5E89.tmp"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

Network

Country Destination Domain Proto
NL 45.137.22.68:55615 tcp
NL 45.137.22.68:55615 tcp
NL 45.137.22.68:55615 tcp
NL 45.137.22.68:55615 tcp
NL 45.137.22.68:55615 tcp
NL 45.137.22.68:55615 tcp

Files

memory/1660-4-0x00000000006D0000-0x00000000006D2000-memory.dmp

memory/2100-5-0x00000000000D0000-0x00000000000D2000-memory.dmp

memory/2100-6-0x00000000002D0000-0x00000000002D1000-memory.dmp

\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

MD5 6da58e4a005e57e0eee2faf662dfd4ae
SHA1 2146c9d021ac262c918c4cdf5d5c842568ee2c87
SHA256 364a57fff4c2f5d8f2b35945016f4660ea9e583250e81c13d3da523d21cf33cf
SHA512 f0895ce9160e05c434f3b3bb5ab6907dd4a767b38ea19f276de446e1d62476b00b912f4fb432bb12a4cadf19e25310b5c7a716b6d51a0156a47bc6c31a10ceeb

memory/2572-24-0x0000000000120000-0x00000000001D4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpg

MD5 e83ccb51ee74efd2a221be293d23c69a
SHA1 4365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256 da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA512 0252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar1F99.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/2572-123-0x0000000000640000-0x0000000000656000-memory.dmp

memory/2572-124-0x0000000000950000-0x000000000095E000-memory.dmp

memory/2572-125-0x0000000001F40000-0x0000000001F50000-memory.dmp

memory/2572-126-0x0000000005CD0000-0x0000000005D30000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 2176c0a75fcda3ec0b9267a8d152833a
SHA1 5f933fe18a8c6b41691b044f1ed17ea41cbcf7f6
SHA256 f18129a3cfc6f4249ebdc9d0549dc6cf013e298bc971de786da5fa51622bb764
SHA512 06d96f412864797e9be64ace3092fc80946854fc530de7b56dbabd669e4e53b6badce2890125ac3b6ea5aafd48b5db666d5147d1fa0bedebef491575546f6896

C:\Users\Admin\AppData\Local\Temp\tmp5E89.tmp

MD5 e454a1426c70effa82894c54096d3abb
SHA1 94d0ef330de0482aec2dc205f0ec20408096c815
SHA256 fc4df0cb427e56387f82531dc752f90dc396146e8d3cf61c70e56182d12f2016
SHA512 62cf7aa6ab129a062f833fa527ffd82ba59e5390cfc8f39618b71195ae009a66af9118cc46ff1e87133b0cb5cdeb8e24bab8ddffb4da1ef20570fe321aefd503

memory/540-144-0x0000000000400000-0x000000000041E000-memory.dmp

memory/540-142-0x0000000000400000-0x000000000041E000-memory.dmp

memory/540-150-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/540-151-0x0000000000400000-0x000000000041E000-memory.dmp

memory/540-148-0x0000000000400000-0x000000000041E000-memory.dmp

memory/540-146-0x0000000000400000-0x000000000041E000-memory.dmp

memory/540-153-0x0000000000400000-0x000000000041E000-memory.dmp

memory/540-154-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2100-155-0x00000000002D0000-0x00000000002D1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 01:07

Reported

2024-06-16 01:09

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2796 set thread context of 2608 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2764 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2764 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2764 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2796 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2796 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2796 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2796 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2796 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2796 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2796 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2796 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2796 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2796 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2796 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Processes

C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe

"C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gsGRKUB.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gsGRKUB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9A0D.tmp"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
NL 45.137.22.68:55615 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
NL 45.137.22.68:55615 tcp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
NL 45.137.22.68:55615 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 45.137.22.68:55615 tcp
NL 45.137.22.68:55615 tcp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

MD5 6da58e4a005e57e0eee2faf662dfd4ae
SHA1 2146c9d021ac262c918c4cdf5d5c842568ee2c87
SHA256 364a57fff4c2f5d8f2b35945016f4660ea9e583250e81c13d3da523d21cf33cf
SHA512 f0895ce9160e05c434f3b3bb5ab6907dd4a767b38ea19f276de446e1d62476b00b912f4fb432bb12a4cadf19e25310b5c7a716b6d51a0156a47bc6c31a10ceeb

memory/2796-14-0x00000000726BE000-0x00000000726BF000-memory.dmp

memory/2796-15-0x0000000000990000-0x0000000000A44000-memory.dmp

memory/2796-16-0x0000000005A90000-0x0000000006034000-memory.dmp

memory/2796-17-0x00000000053F0000-0x0000000005482000-memory.dmp

memory/2796-18-0x0000000005610000-0x0000000005964000-memory.dmp

memory/2796-19-0x00000000726B0000-0x0000000072E60000-memory.dmp

memory/2796-20-0x00000000055A0000-0x00000000055AA000-memory.dmp

memory/2796-21-0x0000000006180000-0x0000000006196000-memory.dmp

memory/2796-22-0x0000000006ED0000-0x0000000006EDE000-memory.dmp

memory/2796-23-0x0000000006EE0000-0x0000000006EF0000-memory.dmp

memory/2796-24-0x0000000006F10000-0x0000000006F70000-memory.dmp

memory/2796-25-0x0000000009600000-0x000000000969C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpg

MD5 e83ccb51ee74efd2a221be293d23c69a
SHA1 4365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256 da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA512 0252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46

memory/2372-31-0x0000000002E30000-0x0000000002E66000-memory.dmp

memory/2372-32-0x0000000005A60000-0x0000000006088000-memory.dmp

memory/2372-33-0x0000000005770000-0x0000000005792000-memory.dmp

memory/2372-34-0x0000000005990000-0x00000000059F6000-memory.dmp

memory/2372-35-0x0000000006100000-0x0000000006166000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ghebmo25.ej1.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\tmp9A0D.tmp

MD5 845305fbe3db50162c83e7dbc86c9061
SHA1 068296fb5a34aebf25ec1f11620edcf73314899f
SHA256 33e782860a506d12df328e4539bd6f53c49b90017c13df18325f3763734bb604
SHA512 e362694bebc6b47660438d04669790399105e8ed4b76301bf6d73307d64d1b9a47786e533137e55f51d073c458c658015c66c1f6f7479eac2c55729ba70b670d

memory/2608-55-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2796-59-0x00000000726B0000-0x0000000072E60000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO.exe.log

MD5 b7b9acb869ccc7f7ecb5304ec0384dee
SHA1 6a90751c95817903ee833d59a0abbef425a613b3
SHA256 8cb00a15cd942a1861c573d86d6fb430512c8e2f80f6349f48b16b8709ca7aa4
SHA512 7bec881ac5f59ac26f1be1e7e26d63f040c06369de10c1c246e531a4395d27c335d9acc647ecdedb48ed37bdc2dc405a4cfc11762e1c00659a49be259eaf8764

memory/2608-60-0x0000000005700000-0x0000000005D18000-memory.dmp

memory/2608-61-0x0000000004FD0000-0x0000000004FE2000-memory.dmp

memory/2608-62-0x0000000005030000-0x000000000506C000-memory.dmp

memory/4492-63-0x0000000006690000-0x00000000066AE000-memory.dmp

memory/4492-64-0x0000000006D20000-0x0000000006D6C000-memory.dmp

memory/2608-65-0x00000000052E0000-0x00000000053EA000-memory.dmp

memory/2372-67-0x000000006F1A0000-0x000000006F1EC000-memory.dmp

memory/2372-66-0x0000000007720000-0x0000000007752000-memory.dmp

memory/4492-78-0x000000006F1A0000-0x000000006F1EC000-memory.dmp

memory/2372-77-0x0000000006C80000-0x0000000006C9E000-memory.dmp

memory/2372-81-0x0000000007760000-0x0000000007803000-memory.dmp

memory/2372-89-0x00000000080A0000-0x000000000871A000-memory.dmp

memory/2372-90-0x0000000007A60000-0x0000000007A7A000-memory.dmp

memory/2372-91-0x0000000007AD0000-0x0000000007ADA000-memory.dmp

memory/2372-92-0x0000000007CE0000-0x0000000007D76000-memory.dmp

memory/4492-93-0x0000000007CC0000-0x0000000007CD1000-memory.dmp

memory/4492-94-0x0000000007CF0000-0x0000000007CFE000-memory.dmp

memory/4492-95-0x0000000007D00000-0x0000000007D14000-memory.dmp

memory/2372-96-0x0000000007DA0000-0x0000000007DBA000-memory.dmp

memory/2372-97-0x0000000007D80000-0x0000000007D88000-memory.dmp