Description	Indicator	Process	Target
PID 924 wrote to memory of 4684	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 924 wrote to memory of 4684	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 924 wrote to memory of 4684	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4684 -ip 4684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 604

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	31.243.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:54

Platform

win10v2004-20240611-en

Max time kernel

146s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-synch-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-synch-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	140.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	23.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:53

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-math-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-math-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:54

Platform

win10v2004-20240508-en

Max time kernel

49s

Max time network

56s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Network

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:53

Platform

win10v2004-20240611-en

Max time kernel

118s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-multibyte-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-multibyte-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	138.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	200.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	92.12.20.2.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	52.111.227.14:443		tcp
US	8.8.8.8:53	29.243.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:53

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-convert-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-convert-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:53

Platform

win10v2004-20240611-en

Max time kernel

122s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-filesystem-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-filesystem-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4564,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	20.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	107.12.20.2.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:54

Platform

win10v2004-20240226-en

Max time kernel

154s

Max time network

175s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\VSLauncher_[0MB]_[1].exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3944 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
GB	23.44.234.16:80		tcp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	22.160.190.20.in-addr.arpa	udp
US	13.107.253.64:443		tcp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	215.169.36.23.in-addr.arpa	udp
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
NL	52.142.223.178:80		tcp
US	8.8.8.8:53	30.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	23.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:53

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-timezone-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-timezone-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	17.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	200.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	10.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:54

Platform

win10v2004-20240611-en

Max time kernel

91s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-conio-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-conio-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	134.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	92.12.20.2.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:54

Platform

win7-20240611-en

Max time kernel

122s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\VSLauncher_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:54

Platform

win10v2004-20240508-en

Max time kernel

77s

Max time network

105s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-synch-l1-2-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-synch-l1-2-0.dll,#1

Network

Country	Destination	Domain	Proto
US	52.111.227.14:443		tcp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:54

Platform

win10v2004-20240611-en

Max time kernel

89s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-util-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-util-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	72.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	200.131.50.23.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:53

Platform

win10v2004-20240611-en

Max time kernel

91s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	133.32.126.40.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	29.243.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:54

Platform

win10v2004-20240611-en

Max time kernel

146s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-private-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-private-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	140.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	200.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	29.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	11.179.89.13.in-addr.arpa	udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:53

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-process-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-process-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	68.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	169.253.116.51.in-addr.arpa	udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:53

Platform

win10v2004-20240508-en

Max time kernel

49s

Max time network

51s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4636 wrote to memory of 628	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 4636 wrote to memory of 628	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 4636 wrote to memory of 628	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 628 -ip 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 600

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:54

Platform

win10v2004-20240508-en

Max time kernel

141s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\HDHelper_[0MB]_[1].exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1324,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:54

Platform

win10v2004-20240508-en

Max time kernel

141s

Max time network

157s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-string-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-string-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3124,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:54

Platform

win10v2004-20240508-en

Max time kernel

49s

Max time network

56s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-heap-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-heap-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:53

Platform

win10v2004-20240508-en

Max time kernel

60s

Max time network

51s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-locale-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-locale-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:53

Platform

win10v2004-20240508-en

Max time kernel

49s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe

Processes

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4616 -ip 4616

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4616 -ip 4616

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 584

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:54

Platform

win10v2004-20240611-en

Max time kernel

112s

Max time network

139s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-rtlsupport-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-rtlsupport-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4532,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	10.27.171.150.in-addr.arpa	udp
US	8.8.8.8:53	20.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
GB	52.123.242.9:443		tcp
GB	52.123.242.49:443		tcp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	10.179.89.13.in-addr.arpa	udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:54

Platform

win10v2004-20240226-en

Max time kernel

154s

Max time network

175s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-environment-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-environment-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
GB	96.16.110.114:80		tcp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	134.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
GB	142.250.187.202:443		tcp
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	215.169.36.23.in-addr.arpa	udp
NL	52.142.223.178:80		tcp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	11.179.89.13.in-addr.arpa	udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:53

Platform

win7-20240220-en

Max time kernel

118s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2100 wrote to memory of 1656	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2100 wrote to memory of 1656	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2100 wrote to memory of 1656	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2100 wrote to memory of 1656	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2100 wrote to memory of 1656	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2100 wrote to memory of 1656	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2100 wrote to memory of 1656	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1656 wrote to memory of 2240	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1656 wrote to memory of 2240	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1656 wrote to memory of 2240	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1656 wrote to memory of 2240	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 220

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:53

Platform

win7-20240221-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\HDHelper_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:53

Platform

win7-20240611-en

Max time kernel

121s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:53

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-sysinfo-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-sysinfo-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:54

Platform

win7-20240611-en

Max time kernel

157s

Max time network

158s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description	Indicator	Process	Target
PID 2908 created 1400	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Windows\Explorer.EXE

Vidar

stealer vidar

Downloads MZ/PE file

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\ProgramData\FHCGCFHDHI.exe	N/A
N/A	N/A	C:\ProgramData\GCBKFBFCGI.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\cmd.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2908 set thread context of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 1912 set thread context of 2240	N/A	C:\ProgramData\FHCGCFHDHI.exe	C:\Windows\SysWOW64\ftp.exe
PID 1376 set thread context of 2300	N/A	C:\ProgramData\GCBKFBFCGI.exe	C:\Windows\SysWOW64\ftp.exe

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\Tasks\TWI Cloud Host.job	C:\Windows\SysWOW64\ftp.exe	N/A
File created	C:\Windows\Tasks\Watcher Com SH.job	C:\Windows\SysWOW64\ftp.exe	N/A

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Enumerates processes with tasklist

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\ProgramData\FHCGCFHDHI.exe	N/A
N/A	N/A	C:\ProgramData\GCBKFBFCGI.exe	N/A
N/A	N/A	C:\ProgramData\FHCGCFHDHI.exe	N/A
N/A	N/A	C:\ProgramData\GCBKFBFCGI.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\ProgramData\FHCGCFHDHI.exe	N/A
N/A	N/A	C:\ProgramData\GCBKFBFCGI.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2580 wrote to memory of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	C:\Windows\SysWOW64\cmd.exe
PID 2580 wrote to memory of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	C:\Windows\SysWOW64\cmd.exe
PID 2580 wrote to memory of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	C:\Windows\SysWOW64\cmd.exe
PID 2580 wrote to memory of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	C:\Windows\SysWOW64\cmd.exe
PID 2156 wrote to memory of 3012	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2156 wrote to memory of 3012	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2156 wrote to memory of 3012	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2156 wrote to memory of 3012	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2156 wrote to memory of 3020	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2156 wrote to memory of 3020	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2156 wrote to memory of 3020	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2156 wrote to memory of 3020	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2156 wrote to memory of 1632	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2156 wrote to memory of 1632	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2156 wrote to memory of 1632	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2156 wrote to memory of 1632	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2156 wrote to memory of 1652	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2156 wrote to memory of 1652	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2156 wrote to memory of 1652	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2156 wrote to memory of 1652	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2156 wrote to memory of 2312	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2156 wrote to memory of 2312	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2156 wrote to memory of 2312	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2156 wrote to memory of 2312	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2156 wrote to memory of 628	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2156 wrote to memory of 628	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2156 wrote to memory of 628	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2156 wrote to memory of 628	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2156 wrote to memory of 1888	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2156 wrote to memory of 1888	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2156 wrote to memory of 1888	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2156 wrote to memory of 1888	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2156 wrote to memory of 2908	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2156 wrote to memory of 2908	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2156 wrote to memory of 2908	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2156 wrote to memory of 2908	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2156 wrote to memory of 1924	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 2156 wrote to memory of 1924	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 2156 wrote to memory of 1924	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 2156 wrote to memory of 1924	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 2908 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2908 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2908 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2908 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2908 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2908 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2472 wrote to memory of 1912	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\FHCGCFHDHI.exe
PID 2472 wrote to memory of 1912	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\FHCGCFHDHI.exe
PID 2472 wrote to memory of 1912	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\FHCGCFHDHI.exe
PID 2472 wrote to memory of 1912	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\FHCGCFHDHI.exe
PID 2472 wrote to memory of 1376	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\GCBKFBFCGI.exe
PID 2472 wrote to memory of 1376	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\GCBKFBFCGI.exe
PID 2472 wrote to memory of 1376	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\GCBKFBFCGI.exe
PID 2472 wrote to memory of 1376	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\GCBKFBFCGI.exe
PID 1912 wrote to memory of 2240	N/A	C:\ProgramData\FHCGCFHDHI.exe	C:\Windows\SysWOW64\ftp.exe
PID 1912 wrote to memory of 2240	N/A	C:\ProgramData\FHCGCFHDHI.exe	C:\Windows\SysWOW64\ftp.exe
PID 1912 wrote to memory of 2240	N/A	C:\ProgramData\FHCGCFHDHI.exe	C:\Windows\SysWOW64\ftp.exe
PID 1912 wrote to memory of 2240	N/A	C:\ProgramData\FHCGCFHDHI.exe	C:\Windows\SysWOW64\ftp.exe
PID 1376 wrote to memory of 2300	N/A	C:\ProgramData\GCBKFBFCGI.exe	C:\Windows\SysWOW64\ftp.exe
PID 1376 wrote to memory of 2300	N/A	C:\ProgramData\GCBKFBFCGI.exe	C:\Windows\SysWOW64\ftp.exe
PID 1376 wrote to memory of 2300	N/A	C:\ProgramData\GCBKFBFCGI.exe	C:\Windows\SysWOW64\ftp.exe
PID 1376 wrote to memory of 2300	N/A	C:\ProgramData\GCBKFBFCGI.exe	C:\Windows\SysWOW64\ftp.exe
PID 1912 wrote to memory of 2240	N/A	C:\ProgramData\FHCGCFHDHI.exe	C:\Windows\SysWOW64\ftp.exe
PID 1376 wrote to memory of 2300	N/A	C:\ProgramData\GCBKFBFCGI.exe	C:\Windows\SysWOW64\ftp.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k copy Revenues Revenues.cmd & Revenues.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 366279

C:\Windows\SysWOW64\findstr.exe

findstr /V "RingtoneRentMicrosoftFocuses" Editors

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Isle 366279\m

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

366279\Suspect.pif 366279\m

C:\Windows\SysWOW64\timeout.exe

timeout 5

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

C:\ProgramData\FHCGCFHDHI.exe

"C:\ProgramData\FHCGCFHDHI.exe"

C:\ProgramData\GCBKFBFCGI.exe

"C:\ProgramData\GCBKFBFCGI.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KECFIDGCBFBA" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	eijWYJUUWJTVUfljdtx.eijWYJUUWJTVUfljdtx	udp
US	8.8.8.8:53	theemir.xyz	udp
US	172.67.192.32:443	theemir.xyz	tcp
US	172.67.192.32:443	theemir.xyz	tcp
US	172.67.192.32:443	theemir.xyz	tcp
US	8.8.8.8:53	c.pki.goog	udp
DE	172.217.18.3:80	c.pki.goog	tcp
US	172.67.192.32:443	theemir.xyz	tcp
US	172.67.192.32:443	theemir.xyz	tcp
US	172.67.192.32:443	theemir.xyz	tcp
US	172.67.192.32:443	theemir.xyz	tcp
US	172.67.192.32:443	theemir.xyz	tcp
US	172.67.192.32:443	theemir.xyz	tcp
US	172.67.192.32:443	theemir.xyz	tcp
US	172.67.192.32:443	theemir.xyz	tcp
US	8.8.8.8:53	businessdownloads.ltd	udp
US	104.21.16.123:443	businessdownloads.ltd	tcp
US	172.67.192.32:443	theemir.xyz	tcp
US	8.8.8.8:53	i.imgur.com	udp
US	199.232.192.193:443	i.imgur.com	tcp
US	172.67.192.32:443	theemir.xyz	tcp
US	172.67.192.32:443	theemir.xyz	tcp
US	172.67.192.32:443	theemir.xyz	tcp
US	172.67.192.32:443	theemir.xyz	tcp
US	8.8.8.8:53		udp
US	172.67.192.32:443	theemir.xyz	tcp
US	172.67.192.32:443	theemir.xyz	tcp

Files

C:\Users\Admin\AppData\Local\Temp\Revenues

MD5	774a97f2c63a28f5b795e0c7f3a1e797
SHA1	2ab25671bd5a2b253d54594301b765f171aa0cd5
SHA256	a08c17ffca06c08afa2bf6ee98a09c08a2cc22a78596497635cb372d644f140d
SHA512	e6c576edbfc972a9272d4fd969dc4e4f82f5ec61be2c526a1e2686cd4ee0734a649c78673f10efd3e3d9ae7b329a440adcd830fcb6bf3f53d30f678e001518d6

C:\Users\Admin\AppData\Local\Temp\Editors

MD5	c06b582d8286115b48f81ec53f36b383
SHA1	4f925d9b551cebda3f898ad18c62925979bcda7e
SHA256	70290025a0c87bcbd58ea8caf22e2dc0104e726ef3a7f9d9649758869def4189
SHA512	c98e48feca40abf3fc22803dcc80c3f7dc11bc8f3ff6fd03a3d733c1acf438294347169887bcbce82ff20fa9a6cbf0a0d94c76dc15bb5989093d1c2f7903864a

C:\Users\Admin\AppData\Local\Temp\Comparisons

MD5	4e292eb85ce9e016ff5a01c719c027c2
SHA1	61b3995398ed8390e8b8dc1a262eb94d55d6b80f
SHA256	6492ab6cd6f8f028f0824e026ed7c5401136f203f7de953bc60f61b32de4b41f
SHA512	9a19f0345059e401fa82e1d90a103438a04b579ccab2667d609f3d7c0764fd91553e6dda65e771fbf3fb059b0e460ad885c22cf39562bacd7e44b4e7bea43ad7

C:\Users\Admin\AppData\Local\Temp\Terminology

MD5	bc54db6ebb67ee3a2e3c127758bc2884
SHA1	4068d9984c207545e62ad464e2134cac265bf9f7
SHA256	8c1e83e582baf2b8232a7ab8e81a751b45d260f4ff01bab2e42783d0e24d6b43
SHA512	a03330c03209d8ef28707854fda4ce7b2b680a374d820d8e699ef980cc6b1e5548eec7c8c86608e3507b3490f38d61f067b25d99d725f10158b9837666aef3cc

C:\Users\Admin\AppData\Local\Temp\Arg

MD5	d4c42c532dceb34e65d7defc682e77dc
SHA1	7584981bc314640ba1b92da552ffeaedc4ea3a21
SHA256	3e7706b03275975037e49a1a7f29e67bce822086f90630948d9528d9c4b68182
SHA512	67ca5bf547b9bda235c44166681cac7e12515fa49b78ee8d7f564fc094c1509e8fe2f2f029a99ec96ab1fbfb1b9c2d501e4e1d65b4855b75639f2974ac804a4b

C:\Users\Admin\AppData\Local\Temp\July

MD5	d71ce9af90d20d69dc3de9bc70f9cacd
SHA1	3b5737986225b7358b909f43a201d4872cd3a294
SHA256	fbbc13426ec699ffd56f6c53bc5e5259e25af602205c3d04beac1d4c578f85da
SHA512	85dfe8e9705b97c6a877b0785394171768dc33effa3a37b9969d35ead669172e6e4eb1357d8c231db778a0b37b2d8253b9e6d170e45959ba24a6b2fac868399e

C:\Users\Admin\AppData\Local\Temp\Wb

MD5	901d26287ebe3e866d15b610764c49c1
SHA1	13793e6f446a09511642a4f3085cb029a4b853ff
SHA256	c74030e343c6fde4a1f1cf54010c186f9e80b457662bab5500848597c2e19504
SHA512	19ae02941a1a17cbe12c653b3067e10e91e5fe8dd73e0ff2373355eb9ee41af3767ae06885a3fb35bb06e411ec8ac0f291d24e717c01adfcb802539b3cf1f15a

C:\Users\Admin\AppData\Local\Temp\Bt

MD5	cf6a6e9c0b825f2b1ced20b4ab200db6
SHA1	8d1987c13c8dc1287f0eb631201ca6eee12b4cd0
SHA256	6e4b33cc9c80b969af96b31b1e95588f9cf79e3670951c63172d60d4e1324f95
SHA512	337bca6e3e8e323821d3767feacc10faefb52b4664968e99c1ab62a72f6770f41bc338bfb672e6602249266b141c4e99d004e48adcd87ea308bdec493674dfdc

C:\Users\Admin\AppData\Local\Temp\Ns

MD5	67546d73dfe4d66538a7ac7dc030238f
SHA1	1a3450f06ac594739db273e3eb0155018fccc88e
SHA256	71f45ed46fbd47494a7ecb9b31c07214d99133e35b974f5cf2beceabb639217d
SHA512	f3ceb864801ddb2d7f8298950dd76a0738ab4586796d16290c1c8c11579b9017a9b14c94341c24ac024f89a38e402c81903fcabaa2dddd21ca681af173bf5bb3

C:\Users\Admin\AppData\Local\Temp\Choose

MD5	fb2cc8e690d82366990f2f20a4a5ab75
SHA1	5556232996e954f981144129298e298c75f8c2fe
SHA256	51982155baed7d5006ebc4446a417f320f8d754ec99911fcfa97ee5d37ce7756
SHA512	e8ae811d270bd2de39d0578e84b0001bffaf34969a1fabaedbe804d96eb79919c13578f41af339ce9af26f5cb6cb107bd6d79c1af9aee8a9e359b4b885fde823

C:\Users\Admin\AppData\Local\Temp\Objects

MD5	f2f3a8cb98474080fdcca6a39b6b3915
SHA1	49f7327ca65d969203be51ccbf9f4033579923d0
SHA256	ca682c8dcdca30548120b6d3194eebf36a9208bef0e9b611da828bd912a38260
SHA512	cde92ed6e3ad806f0acd220990b46168862511222ae3667c62084f93622cc7ba2e91ed3b1e489f5721b8eeba9fc25b5a718febe3718c1afb74fcc6b4f8c0b1b9

C:\Users\Admin\AppData\Local\Temp\Marcus

MD5	16fcba5d9aed0ef000c886f56cba85ee
SHA1	22584f6b7227ea3e0898233325be3ecb3c7bef6a
SHA256	35d270b74aa68781c8e0bc3cd008718ce362fe9fd32c9ba1ad52b82fe37d07aa
SHA512	7beb4a5207087b0e37f16df84702e4cac8699f951f6a92c7185bc83582766a43ef18bc93af24827793951f2417dd39bdf0717876f75f32feacec93fdfb2896f7

C:\Users\Admin\AppData\Local\Temp\Gc

MD5	f446974fde635cadfcc03c9a25fd3780
SHA1	b59e1202f13139f21db4274d65ac51d2a0f8b856
SHA256	5bc7072917151653d7c40e272d8a95a86bbe7ad027eb30a811331a6f7df7ba51
SHA512	cc1a13562df99e2e2a240ad8d8e8d948846c6c5be0c995d87785e3cf73b54824ee7318c423972ea362dafbaac986f19d0117bc7e5192af5a2ff9fc8430bcc1e7

C:\Users\Admin\AppData\Local\Temp\Thus

MD5	08c077a34051a75c2b915a517c5d7d54
SHA1	ecb5cef32ca27ea5542b7416bc550601721f4a32
SHA256	3ed1a12fde96bc80c62d54a0647000dff23a63b987fe8c3faa9e11b4357321a0
SHA512	8746dae03892cee35b1a4463a7765399f2d1d1d989c53d0881043991c4187f7b4b1765376c435ff13722ec6dff2da98287efca0b335508f24d6f1805034e0f70

C:\Users\Admin\AppData\Local\Temp\Broadway

MD5	abfa29a29931ff6299126aed8dd08859
SHA1	c436e000edcc042f7f7889950a610c94d590d36c
SHA256	dd57cfa1ec84ac01cd4aab6dd18046b3a49daf0445ae29d6695c4a25c0bcd59d
SHA512	c0941a5de5fe072ba81b41b555ffdb59c6e0d2b9bed66a0cbb899699c38792cda0bb9857ab0752dbe0b3c966688ccb523989677803bf637675ec435a8c12406e

C:\Users\Admin\AppData\Local\Temp\Shares

MD5	8715208e25afa7a73918e84ee8b27f50
SHA1	61935bc176db5586053d1d5a22dae8092e6a3f7e
SHA256	f0eba5c2f4c9998b0a491a7ec4fc953e601235709b3536ba1a928e8d5021d3f1
SHA512	461d9e809ede59c71cd7fd9aa90a8ad991c5c9504d5c9c53659604e7e0e25b02d2135fbc0b2c4ab0e4a60bd43c38fa1109559d5f19f58a387dbe8e03424230c8

C:\Users\Admin\AppData\Local\Temp\Talk

MD5	bb769ef1b8aa0b58d0b94c4804bcd418
SHA1	e6f4dc5a736038e5604e282046d1234ccabebf68
SHA256	ae766919ddefe1340cea9b4ae3acfc041e8d079baa7fcf7dca59dfa3330c2d59
SHA512	2d0e600f59a545b1d19f299a8b756bab334b02be8e9f6e1ff2d3f64c18362bcb60239b0786358023728be88c8e033219e9df500d30b3121921d356055c60bb05

C:\Users\Admin\AppData\Local\Temp\Russian

MD5	91be5c23d6db4ea3e47b0259475cdd4b
SHA1	07cee20085effe581fddb260a65473c130e88e21
SHA256	8e6d9c7c4069ed6ea1fa346238ce48cf4479df04d1871e874f8c31e8ffede898
SHA512	e4f536a4f9b60098abd7212f82cacf6d9729a89c207a74a7dfcf8b9069a64eb024d60f0d506c1a50726d60c267222d200a50a6cc3a31a06ea1ef9ab3fce887e3

C:\Users\Admin\AppData\Local\Temp\Gis

MD5	e5e509038d8029cc95879ae96199093c
SHA1	18fceacd1cf5c57c6c2f1dc59a05906b740323a0
SHA256	bfa2b066ea73af4b0296b130a7c1927a4723864502ec646809aca415677844a6
SHA512	359d9dc6751abf5dbbede201409e77652f595f40148f987272aacb50e320c43562f93db179727d05120c7bb8edb45c3fb81c30aebc91422f33ca7c70466b34b1

C:\Users\Admin\AppData\Local\Temp\Atlanta

MD5	05bf6c32a8d3cb1025a4e8baca686fc5
SHA1	e32584b21803cf8bed34367c8e4f34ff6104d6c4
SHA256	61460bebb1a3ada4d197a869a8d9637eaf03656b32509e5a4606240d06ab3361
SHA512	c93b4c23daf481e9ebcb8d19d1381e3a7ab49b1708e0340a9455a11fc26b3209577cc831e7610d212a0e677b8f6217855038b1cf0b2379f397549b92cbf89b03

C:\Users\Admin\AppData\Local\Temp\Roy

MD5	6310218145bc5ec965e5953fb0305d19
SHA1	b6043e6b47ea99b13efea5b2b7c523248379f6af
SHA256	ae7d0d86b3505a9c5c40bce3fd2554102e4f7d21aa5bdcc10451ce1019606629
SHA512	ae82e5721644c9f51852c5973dec9e250b83593b4079c7d3360e55700c75e43f9cac36de508654831c37e4d4ffdfcc8aabe8d681bcfd7a3a72d8d3f3df0fe6ec

C:\Users\Admin\AppData\Local\Temp\Pda

MD5	0766c0db71d9a82456e72ca071518676
SHA1	be36286b20cc0aeff00bdca079dfa9f4047e1ac0
SHA256	5553cf5ed1753ab9749bb7f3057f0db8cb9f19b8f673fa977b038ca0fef8b3d1
SHA512	032dad0b91b5482d5d1e558ba9e4dfea6f16c71725d21865f411f888fe631628f7a16a3e9fc367d88c02fde7f6ef7fd56a717c23feb45eb1ff5968605fb7fb77

C:\Users\Admin\AppData\Local\Temp\Wallpaper

MD5	98d91341d4e754f361bbedeb35242a36
SHA1	4718235cf9242f7250700af2a3411357d2a2525c
SHA256	42d670d3dd28bc4597b71a9373763029451d0da5efe1288c774f6b512fae9f0e
SHA512	1e877510d91e6f62790b7f15c7ffa00c31e18f24bc3ec72dcd63e9c2b0031817bbf87e1f9d3359f50dd25f1d6e53eeea61fc9331ebc58f88361fcd2353e32fa9

C:\Users\Admin\AppData\Local\Temp\Tomorrow

MD5	b348e7db88d0e52cfb6c7adb43628390
SHA1	5daa60ea78be614a992e88a60b655601cb45ebb6
SHA256	fa61763479671d7aa59798ccd20a2ae48102e24f2fdbc11e753c2141b3e0d135
SHA512	9d3018d203bad94e6a6efb2f5c5dfb55b14d5a6e1885cc60a34f0c647771cede2626e448f2fc194e3d17795c97ebb0bf283cb2a24a7db71f5e7fd15bdab01eff

C:\Users\Admin\AppData\Local\Temp\Pct

MD5	5021070dbffa36d9053699bee3f88806
SHA1	00ce3f117ffe45372c27af5f920ebacdeac92f93
SHA256	41757cf277d0f40e48e2bfc6d963db78308fdfe0b054f67685e2a6473e25327b
SHA512	628268ba6d7c30f1d03f84ff3955782ed23f426645fb8a914b83514f1de9ef23b5060f57e8c6f38dc8071adf063971f050989cab5eb2ef300072ccb58bd7183a

C:\Users\Admin\AppData\Local\Temp\Serving

MD5	d0fa08b94bca138551c4b274ade27a75
SHA1	acaa349e9d6f03d622c2f0280247a43fbc078f3a
SHA256	4e9de0fd78447786652a61ab8339253c2ec4c671d3a9dd956d3aca384a7ee4a1
SHA512	bc17fd7b4b79f96d7adbf35c96919c49ace59ac0e2807fb31e7e88871218b5f0ad6f9183087c451675c16f24a16ed278fa78b325a3b631068e2fee16b3a84622

C:\Users\Admin\AppData\Local\Temp\Word

MD5	ca2ac61ab298e06c4d8f07792708705c
SHA1	35547141d3593d89746a4de38e809388de7b224f
SHA256	cabef77014cb90d5e896c046830742852edb20adcd1da71f88f8f8805d476607
SHA512	c6f0fccfaa08ef6f4d17698eb07cf27fa116b94bab2a25afe392acb2fecb1fb9d58301288e80839dadf834245a614846d72d1243693b40a56d7be45745f90218

C:\Users\Admin\AppData\Local\Temp\Shaft

MD5	4a29dcfa87b47e37e8b4447b840ccd91
SHA1	cd56012f27e7ece5545b6b07172f8f0169a852f5
SHA256	dbf049319595a1a9faf8c8dbc70814c4562c4b9dd10f18e56b0cb83e37cdce5c
SHA512	79b69684e7a72eb7fa24f36745f42370acc6655e44fbbd93dda679ed676c010a38a530b3b210196b6962e36ca1756fedb4341f867bdeb2e86c6ded23b7dde91f

C:\Users\Admin\AppData\Local\Temp\Colleagues

MD5	8a6af62b964e899f2fdb5b08bb70fe1d
SHA1	74d97553398f4952fc7244db53a54c5c9418680b
SHA256	621b098f227833dd3d62d4b181bf751e76d9688237ae27ba4475947863775103
SHA512	be082ccae47ebb4bb28f9d9fc9ffb089e081ab95d41232be5bd998fdfcb6995816141e46289f7fb15acf890bc97ce77fb413c8a56424a411dcce03354d093186

C:\Users\Admin\AppData\Local\Temp\Isle

MD5	c7edd1b120ffd89a03bb13f43248c03f
SHA1	70cdf64d0b1f9ddeed567599ed2b4ea6c0fad204
SHA256	84e53bfccccd03c162214a5b47741945c029afd23ec7ca307f1a66bc292ff3f8
SHA512	9d760c5455f7daa4ee1aeb3070d33cc43ec933f843333ae9d89f15d62f3840939bb83ad39420bf3fc9f800c8dcdde3f39085e7fcdfbedeeb999382ac1f9e75e2

\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

MD5	b06e67f9767e5023892d9698703ad098
SHA1	acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256	8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512	7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

memory/2472-583-0x0000000000A60000-0x00000000011AA000-memory.dmp

memory/2472-584-0x0000000000A60000-0x00000000011AA000-memory.dmp

memory/2472-586-0x0000000000A60000-0x00000000011AA000-memory.dmp

memory/2472-602-0x0000000000A60000-0x00000000011AA000-memory.dmp

memory/2472-604-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/2472-603-0x0000000000A60000-0x00000000011AA000-memory.dmp

memory/2472-617-0x0000000000A60000-0x00000000011AA000-memory.dmp

memory/2472-618-0x0000000000A60000-0x00000000011AA000-memory.dmp

memory/2472-626-0x0000000000A60000-0x00000000011AA000-memory.dmp

memory/2472-627-0x0000000000A60000-0x00000000011AA000-memory.dmp

\ProgramData\KECFIDGCBFBA\nss3.dll

MD5	1cc453cdf74f31e4d913ff9c10acdde2
SHA1	6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256	ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512	dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\KECFIDGCBFBA\mozglue.dll

MD5	c8fd9be83bc728cc04beffafc2907fe9
SHA1	95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256	ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512	fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/2472-650-0x0000000000A60000-0x00000000011AA000-memory.dmp

memory/2472-651-0x0000000000A60000-0x00000000011AA000-memory.dmp

\ProgramData\FHCGCFHDHI.exe

MD5	6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1	424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA256	376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
SHA512	d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8

memory/1912-677-0x0000000000400000-0x0000000000913000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabED5B.tmp

MD5	49aebf8cbd62d92ac215b2923fb1b9f5
SHA1	1723be06719828dda65ad804298d0431f6aff976
SHA256	b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512	bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	5aea6748e27e283e948c9bfe14f5671b
SHA1	d7de7f4fdc78d3623a2b4965a8e70af3d4bab793
SHA256	faf4abb96d6c61e6c8cb442cdf33202b65856f248ce890545cce49422d33b5db
SHA512	5bc77b7813975105593c7f1e2a79b09985e2c72de47b55b61e90be4988b0f8e1f6934ca5393d642347e66305b9d374d50e7012ebf12aac6021b43dc5c7b6a060

\ProgramData\GCBKFBFCGI.exe

MD5	daaff76b0baf0a1f9cec253560c5db20
SHA1	0311cf0eeb4beddd2c69c6e97462595313a41e78
SHA256	5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
SHA512	987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3

C:\Users\Admin\AppData\Local\Temp\TarEFAF.tmp

MD5	4ea6026cf93ec6338144661bf1202cd1
SHA1	a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256	8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512	6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/1376-710-0x0000000000400000-0x0000000000648000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\28d42951

MD5	8d443e7cb87cacf0f589ce55599e008f
SHA1	c7ff0475a3978271e0a8417ac4a826089c083772
SHA256	e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
SHA512	c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5

memory/1912-742-0x0000000073750000-0x00000000738C4000-memory.dmp

memory/1912-743-0x0000000077580000-0x0000000077729000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\28b24ebc

MD5	c62f812e250409fbd3c78141984270f2
SHA1	9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA256	d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
SHA512	7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092

memory/1376-745-0x0000000073750000-0x00000000738C4000-memory.dmp

memory/1376-746-0x0000000077580000-0x0000000077729000-memory.dmp

memory/2472-750-0x0000000000A60000-0x00000000011AA000-memory.dmp

memory/2472-755-0x0000000000A60000-0x00000000011AA000-memory.dmp

memory/2472-751-0x0000000000A60000-0x00000000011AA000-memory.dmp

memory/2472-756-0x0000000000A60000-0x00000000011AA000-memory.dmp

memory/1912-757-0x0000000073750000-0x00000000738C4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\28ee0b46

MD5	319612aabbd368f14fe7d64b8514c43c
SHA1	0b5edca5ed3d13bf2430cfbbbce209b6baf52077
SHA256	83acae76e74d977cd70277e8c295b7e29ca28dd501193d2473a19a0bbb736b57
SHA512	9131c6e13e3c8f2bb5bc1c93908119d1b45e7009f40a49c37a6c24f205c1c3ce8a7342f2bcc8e6075b2ae7847f92c629232edc629332c15936e124cc56c3a04e

memory/1376-760-0x0000000073750000-0x00000000738C4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2911ab76

MD5	72d3818a98f68654ef9b0751bfecc4e6
SHA1	d5767420ebba5a174cb7130644938b68eb8323fd
SHA256	e15d758369e0ac71a4fc1d9d0bc0c3116432e3e2fa2d56ecf90e221f8a1152a1
SHA512	7198da90c49fcf838fe6e74604bcdcaf2b1ea3446a23678d85c8877514a96edecedaee77e980a920c7a0f0aa4bd6e9aee49966cc6a51076c668702902781d8b2

memory/2240-763-0x0000000077580000-0x0000000077729000-memory.dmp

memory/2300-764-0x0000000077580000-0x0000000077729000-memory.dmp

memory/2240-765-0x0000000073750000-0x00000000738C4000-memory.dmp

memory/2240-775-0x0000000073750000-0x00000000738C4000-memory.dmp

memory/2472-785-0x0000000000A60000-0x00000000011AA000-memory.dmp

memory/2472-786-0x0000000000A60000-0x00000000011AA000-memory.dmp

memory/1168-796-0x0000000077580000-0x0000000077729000-memory.dmp

memory/1168-797-0x00000000000C0000-0x0000000000131000-memory.dmp

C:\ProgramData\KECFIDGCBFBA\msvcp140.dll

MD5	5ff1fca37c466d6723ec67be93b51442
SHA1	34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256	5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512	4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

C:\ProgramData\KECFIDGCBFBA\VCRUNT~1.DLL

MD5	a37ee36b536409056a86f50e67777dd7
SHA1	1cafa159292aa736fc595fc04e16325b27cd6750
SHA256	8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512	3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\KECFIDGCBFBA\softokn3.dll

MD5	4e52d739c324db8225bd9ab2695f262f
SHA1	71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256	74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512	2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:54

Platform

win10v2004-20240226-en

Max time kernel

165s

Max time network

177s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description	Indicator	Process	Target
PID 2320 created 3512	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Windows\Explorer.EXE

Vidar

stealer vidar

Downloads MZ/PE file

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\ProgramData\DBFBFBGDBK.exe	N/A
N/A	N/A	C:\ProgramData\CBFCBKKFBA.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2320 set thread context of 1836	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Enumerates processes with tasklist

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\ProgramData\DBFBFBGDBK.exe	N/A
N/A	N/A	C:\ProgramData\CBFCBKKFBA.exe	N/A
N/A	N/A	C:\ProgramData\CBFCBKKFBA.exe	N/A
N/A	N/A	C:\ProgramData\DBFBFBGDBK.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4688 wrote to memory of 4684	N/A	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	C:\Windows\SysWOW64\cmd.exe
PID 4688 wrote to memory of 4684	N/A	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	C:\Windows\SysWOW64\cmd.exe
PID 4688 wrote to memory of 4684	N/A	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 2116	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 4684 wrote to memory of 2116	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 4684 wrote to memory of 2116	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 4684 wrote to memory of 2472	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 4684 wrote to memory of 2472	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 4684 wrote to memory of 2472	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 4684 wrote to memory of 2540	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 4684 wrote to memory of 2540	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 4684 wrote to memory of 2540	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 4684 wrote to memory of 4612	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 4684 wrote to memory of 4612	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 4684 wrote to memory of 4612	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 4684 wrote to memory of 628	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 628	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 628	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 1620	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 4684 wrote to memory of 1620	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 4684 wrote to memory of 1620	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 4684 wrote to memory of 4908	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 4908	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 4908	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 2320	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 4684 wrote to memory of 2320	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 4684 wrote to memory of 2320	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 4684 wrote to memory of 2304	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 4684 wrote to memory of 2304	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 4684 wrote to memory of 2304	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 2320 wrote to memory of 1836	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2320 wrote to memory of 1836	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2320 wrote to memory of 1836	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2320 wrote to memory of 1836	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2320 wrote to memory of 1836	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 1836 wrote to memory of 4108	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\DBFBFBGDBK.exe
PID 1836 wrote to memory of 4108	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\DBFBFBGDBK.exe
PID 1836 wrote to memory of 4108	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\DBFBFBGDBK.exe
PID 1836 wrote to memory of 3888	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\CBFCBKKFBA.exe
PID 1836 wrote to memory of 3888	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\CBFCBKKFBA.exe
PID 1836 wrote to memory of 3888	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\CBFCBKKFBA.exe
PID 4108 wrote to memory of 2508	N/A	C:\ProgramData\DBFBFBGDBK.exe	C:\Windows\SysWOW64\ftp.exe
PID 3888 wrote to memory of 4836	N/A	C:\ProgramData\CBFCBKKFBA.exe	C:\Windows\SysWOW64\ftp.exe
PID 4108 wrote to memory of 2508	N/A	C:\ProgramData\DBFBFBGDBK.exe	C:\Windows\SysWOW64\ftp.exe
PID 4108 wrote to memory of 2508	N/A	C:\ProgramData\DBFBFBGDBK.exe	C:\Windows\SysWOW64\ftp.exe
PID 3888 wrote to memory of 4836	N/A	C:\ProgramData\CBFCBKKFBA.exe	C:\Windows\SysWOW64\ftp.exe
PID 3888 wrote to memory of 4836	N/A	C:\ProgramData\CBFCBKKFBA.exe	C:\Windows\SysWOW64\ftp.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k copy Revenues Revenues.cmd & Revenues.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 366279

C:\Windows\SysWOW64\findstr.exe

findstr /V "RingtoneRentMicrosoftFocuses" Editors

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Isle 366279\m

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

366279\Suspect.pif 366279\m

C:\Windows\SysWOW64\timeout.exe

timeout 5

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5056 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3060 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:3

C:\ProgramData\DBFBFBGDBK.exe

"C:\ProgramData\DBFBFBGDBK.exe"

C:\ProgramData\CBFCBKKFBA.exe

"C:\ProgramData\CBFCBKKFBA.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

Network

Country	Destination	Domain	Proto
GB	96.16.110.114:80		tcp
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	215.169.36.23.in-addr.arpa	udp
GB	142.250.187.234:443		tcp
US	8.8.8.8:53	72.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	eijWYJUUWJTVUfljdtx.eijWYJUUWJTVUfljdtx	udp
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	29.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	theemir.xyz	udp
US	104.21.81.243:443	theemir.xyz	tcp
US	8.8.8.8:53	243.81.21.104.in-addr.arpa	udp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	8.8.8.8:53	c.pki.goog	udp
DE	172.217.18.3:80	c.pki.goog	tcp
US	8.8.8.8:53	3.18.217.172.in-addr.arpa	udp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	8.8.8.8:53	businessdownloads.ltd	udp
US	104.21.16.123:443	businessdownloads.ltd	tcp
US	8.8.8.8:53	123.16.21.104.in-addr.arpa	udp
US	8.8.8.8:53	23.173.189.20.in-addr.arpa	udp
US	104.21.81.243:443	theemir.xyz	tcp
US	8.8.8.8:53	i.imgur.com	udp
US	199.232.196.193:443	i.imgur.com	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	8.8.8.8:53	193.196.232.199.in-addr.arpa	udp
US	104.21.81.243:443	theemir.xyz	tcp

Files

C:\Users\Admin\AppData\Local\Temp\Revenues

MD5	774a97f2c63a28f5b795e0c7f3a1e797
SHA1	2ab25671bd5a2b253d54594301b765f171aa0cd5
SHA256	a08c17ffca06c08afa2bf6ee98a09c08a2cc22a78596497635cb372d644f140d
SHA512	e6c576edbfc972a9272d4fd969dc4e4f82f5ec61be2c526a1e2686cd4ee0734a649c78673f10efd3e3d9ae7b329a440adcd830fcb6bf3f53d30f678e001518d6

C:\Users\Admin\AppData\Local\Temp\Editors

MD5	c06b582d8286115b48f81ec53f36b383
SHA1	4f925d9b551cebda3f898ad18c62925979bcda7e
SHA256	70290025a0c87bcbd58ea8caf22e2dc0104e726ef3a7f9d9649758869def4189
SHA512	c98e48feca40abf3fc22803dcc80c3f7dc11bc8f3ff6fd03a3d733c1acf438294347169887bcbce82ff20fa9a6cbf0a0d94c76dc15bb5989093d1c2f7903864a

C:\Users\Admin\AppData\Local\Temp\Comparisons

MD5	4e292eb85ce9e016ff5a01c719c027c2
SHA1	61b3995398ed8390e8b8dc1a262eb94d55d6b80f
SHA256	6492ab6cd6f8f028f0824e026ed7c5401136f203f7de953bc60f61b32de4b41f
SHA512	9a19f0345059e401fa82e1d90a103438a04b579ccab2667d609f3d7c0764fd91553e6dda65e771fbf3fb059b0e460ad885c22cf39562bacd7e44b4e7bea43ad7

C:\Users\Admin\AppData\Local\Temp\Terminology

MD5	bc54db6ebb67ee3a2e3c127758bc2884
SHA1	4068d9984c207545e62ad464e2134cac265bf9f7
SHA256	8c1e83e582baf2b8232a7ab8e81a751b45d260f4ff01bab2e42783d0e24d6b43
SHA512	a03330c03209d8ef28707854fda4ce7b2b680a374d820d8e699ef980cc6b1e5548eec7c8c86608e3507b3490f38d61f067b25d99d725f10158b9837666aef3cc

C:\Users\Admin\AppData\Local\Temp\July

MD5	d71ce9af90d20d69dc3de9bc70f9cacd
SHA1	3b5737986225b7358b909f43a201d4872cd3a294
SHA256	fbbc13426ec699ffd56f6c53bc5e5259e25af602205c3d04beac1d4c578f85da
SHA512	85dfe8e9705b97c6a877b0785394171768dc33effa3a37b9969d35ead669172e6e4eb1357d8c231db778a0b37b2d8253b9e6d170e45959ba24a6b2fac868399e

C:\Users\Admin\AppData\Local\Temp\Arg

MD5	d4c42c532dceb34e65d7defc682e77dc
SHA1	7584981bc314640ba1b92da552ffeaedc4ea3a21
SHA256	3e7706b03275975037e49a1a7f29e67bce822086f90630948d9528d9c4b68182
SHA512	67ca5bf547b9bda235c44166681cac7e12515fa49b78ee8d7f564fc094c1509e8fe2f2f029a99ec96ab1fbfb1b9c2d501e4e1d65b4855b75639f2974ac804a4b

C:\Users\Admin\AppData\Local\Temp\Bt

MD5	cf6a6e9c0b825f2b1ced20b4ab200db6
SHA1	8d1987c13c8dc1287f0eb631201ca6eee12b4cd0
SHA256	6e4b33cc9c80b969af96b31b1e95588f9cf79e3670951c63172d60d4e1324f95
SHA512	337bca6e3e8e323821d3767feacc10faefb52b4664968e99c1ab62a72f6770f41bc338bfb672e6602249266b141c4e99d004e48adcd87ea308bdec493674dfdc

C:\Users\Admin\AppData\Local\Temp\Wb

MD5	901d26287ebe3e866d15b610764c49c1
SHA1	13793e6f446a09511642a4f3085cb029a4b853ff
SHA256	c74030e343c6fde4a1f1cf54010c186f9e80b457662bab5500848597c2e19504
SHA512	19ae02941a1a17cbe12c653b3067e10e91e5fe8dd73e0ff2373355eb9ee41af3767ae06885a3fb35bb06e411ec8ac0f291d24e717c01adfcb802539b3cf1f15a

C:\Users\Admin\AppData\Local\Temp\Choose

MD5	fb2cc8e690d82366990f2f20a4a5ab75
SHA1	5556232996e954f981144129298e298c75f8c2fe
SHA256	51982155baed7d5006ebc4446a417f320f8d754ec99911fcfa97ee5d37ce7756
SHA512	e8ae811d270bd2de39d0578e84b0001bffaf34969a1fabaedbe804d96eb79919c13578f41af339ce9af26f5cb6cb107bd6d79c1af9aee8a9e359b4b885fde823

C:\Users\Admin\AppData\Local\Temp\Ns

MD5	67546d73dfe4d66538a7ac7dc030238f
SHA1	1a3450f06ac594739db273e3eb0155018fccc88e
SHA256	71f45ed46fbd47494a7ecb9b31c07214d99133e35b974f5cf2beceabb639217d
SHA512	f3ceb864801ddb2d7f8298950dd76a0738ab4586796d16290c1c8c11579b9017a9b14c94341c24ac024f89a38e402c81903fcabaa2dddd21ca681af173bf5bb3

C:\Users\Admin\AppData\Local\Temp\Objects

MD5	f2f3a8cb98474080fdcca6a39b6b3915
SHA1	49f7327ca65d969203be51ccbf9f4033579923d0
SHA256	ca682c8dcdca30548120b6d3194eebf36a9208bef0e9b611da828bd912a38260
SHA512	cde92ed6e3ad806f0acd220990b46168862511222ae3667c62084f93622cc7ba2e91ed3b1e489f5721b8eeba9fc25b5a718febe3718c1afb74fcc6b4f8c0b1b9

C:\Users\Admin\AppData\Local\Temp\Gc

MD5	f446974fde635cadfcc03c9a25fd3780
SHA1	b59e1202f13139f21db4274d65ac51d2a0f8b856
SHA256	5bc7072917151653d7c40e272d8a95a86bbe7ad027eb30a811331a6f7df7ba51
SHA512	cc1a13562df99e2e2a240ad8d8e8d948846c6c5be0c995d87785e3cf73b54824ee7318c423972ea362dafbaac986f19d0117bc7e5192af5a2ff9fc8430bcc1e7

C:\Users\Admin\AppData\Local\Temp\Marcus

MD5	16fcba5d9aed0ef000c886f56cba85ee
SHA1	22584f6b7227ea3e0898233325be3ecb3c7bef6a
SHA256	35d270b74aa68781c8e0bc3cd008718ce362fe9fd32c9ba1ad52b82fe37d07aa
SHA512	7beb4a5207087b0e37f16df84702e4cac8699f951f6a92c7185bc83582766a43ef18bc93af24827793951f2417dd39bdf0717876f75f32feacec93fdfb2896f7

C:\Users\Admin\AppData\Local\Temp\Thus

MD5	08c077a34051a75c2b915a517c5d7d54
SHA1	ecb5cef32ca27ea5542b7416bc550601721f4a32
SHA256	3ed1a12fde96bc80c62d54a0647000dff23a63b987fe8c3faa9e11b4357321a0
SHA512	8746dae03892cee35b1a4463a7765399f2d1d1d989c53d0881043991c4187f7b4b1765376c435ff13722ec6dff2da98287efca0b335508f24d6f1805034e0f70

C:\Users\Admin\AppData\Local\Temp\Broadway

MD5	abfa29a29931ff6299126aed8dd08859
SHA1	c436e000edcc042f7f7889950a610c94d590d36c
SHA256	dd57cfa1ec84ac01cd4aab6dd18046b3a49daf0445ae29d6695c4a25c0bcd59d
SHA512	c0941a5de5fe072ba81b41b555ffdb59c6e0d2b9bed66a0cbb899699c38792cda0bb9857ab0752dbe0b3c966688ccb523989677803bf637675ec435a8c12406e

C:\Users\Admin\AppData\Local\Temp\Shares

MD5	8715208e25afa7a73918e84ee8b27f50
SHA1	61935bc176db5586053d1d5a22dae8092e6a3f7e
SHA256	f0eba5c2f4c9998b0a491a7ec4fc953e601235709b3536ba1a928e8d5021d3f1
SHA512	461d9e809ede59c71cd7fd9aa90a8ad991c5c9504d5c9c53659604e7e0e25b02d2135fbc0b2c4ab0e4a60bd43c38fa1109559d5f19f58a387dbe8e03424230c8

C:\Users\Admin\AppData\Local\Temp\Talk

MD5	bb769ef1b8aa0b58d0b94c4804bcd418
SHA1	e6f4dc5a736038e5604e282046d1234ccabebf68
SHA256	ae766919ddefe1340cea9b4ae3acfc041e8d079baa7fcf7dca59dfa3330c2d59
SHA512	2d0e600f59a545b1d19f299a8b756bab334b02be8e9f6e1ff2d3f64c18362bcb60239b0786358023728be88c8e033219e9df500d30b3121921d356055c60bb05

C:\Users\Admin\AppData\Local\Temp\Pda

MD5	0766c0db71d9a82456e72ca071518676
SHA1	be36286b20cc0aeff00bdca079dfa9f4047e1ac0
SHA256	5553cf5ed1753ab9749bb7f3057f0db8cb9f19b8f673fa977b038ca0fef8b3d1
SHA512	032dad0b91b5482d5d1e558ba9e4dfea6f16c71725d21865f411f888fe631628f7a16a3e9fc367d88c02fde7f6ef7fd56a717c23feb45eb1ff5968605fb7fb77

C:\Users\Admin\AppData\Local\Temp\Roy

MD5	6310218145bc5ec965e5953fb0305d19
SHA1	b6043e6b47ea99b13efea5b2b7c523248379f6af
SHA256	ae7d0d86b3505a9c5c40bce3fd2554102e4f7d21aa5bdcc10451ce1019606629
SHA512	ae82e5721644c9f51852c5973dec9e250b83593b4079c7d3360e55700c75e43f9cac36de508654831c37e4d4ffdfcc8aabe8d681bcfd7a3a72d8d3f3df0fe6ec

C:\Users\Admin\AppData\Local\Temp\Atlanta

MD5	05bf6c32a8d3cb1025a4e8baca686fc5
SHA1	e32584b21803cf8bed34367c8e4f34ff6104d6c4
SHA256	61460bebb1a3ada4d197a869a8d9637eaf03656b32509e5a4606240d06ab3361
SHA512	c93b4c23daf481e9ebcb8d19d1381e3a7ab49b1708e0340a9455a11fc26b3209577cc831e7610d212a0e677b8f6217855038b1cf0b2379f397549b92cbf89b03

C:\Users\Admin\AppData\Local\Temp\Gis

MD5	e5e509038d8029cc95879ae96199093c
SHA1	18fceacd1cf5c57c6c2f1dc59a05906b740323a0
SHA256	bfa2b066ea73af4b0296b130a7c1927a4723864502ec646809aca415677844a6
SHA512	359d9dc6751abf5dbbede201409e77652f595f40148f987272aacb50e320c43562f93db179727d05120c7bb8edb45c3fb81c30aebc91422f33ca7c70466b34b1

C:\Users\Admin\AppData\Local\Temp\Wallpaper

MD5	98d91341d4e754f361bbedeb35242a36
SHA1	4718235cf9242f7250700af2a3411357d2a2525c
SHA256	42d670d3dd28bc4597b71a9373763029451d0da5efe1288c774f6b512fae9f0e
SHA512	1e877510d91e6f62790b7f15c7ffa00c31e18f24bc3ec72dcd63e9c2b0031817bbf87e1f9d3359f50dd25f1d6e53eeea61fc9331ebc58f88361fcd2353e32fa9

C:\Users\Admin\AppData\Local\Temp\Russian

MD5	91be5c23d6db4ea3e47b0259475cdd4b
SHA1	07cee20085effe581fddb260a65473c130e88e21
SHA256	8e6d9c7c4069ed6ea1fa346238ce48cf4479df04d1871e874f8c31e8ffede898
SHA512	e4f536a4f9b60098abd7212f82cacf6d9729a89c207a74a7dfcf8b9069a64eb024d60f0d506c1a50726d60c267222d200a50a6cc3a31a06ea1ef9ab3fce887e3

C:\Users\Admin\AppData\Local\Temp\Serving

MD5	d0fa08b94bca138551c4b274ade27a75
SHA1	acaa349e9d6f03d622c2f0280247a43fbc078f3a
SHA256	4e9de0fd78447786652a61ab8339253c2ec4c671d3a9dd956d3aca384a7ee4a1
SHA512	bc17fd7b4b79f96d7adbf35c96919c49ace59ac0e2807fb31e7e88871218b5f0ad6f9183087c451675c16f24a16ed278fa78b325a3b631068e2fee16b3a84622

C:\Users\Admin\AppData\Local\Temp\Pct

MD5	5021070dbffa36d9053699bee3f88806
SHA1	00ce3f117ffe45372c27af5f920ebacdeac92f93
SHA256	41757cf277d0f40e48e2bfc6d963db78308fdfe0b054f67685e2a6473e25327b
SHA512	628268ba6d7c30f1d03f84ff3955782ed23f426645fb8a914b83514f1de9ef23b5060f57e8c6f38dc8071adf063971f050989cab5eb2ef300072ccb58bd7183a

C:\Users\Admin\AppData\Local\Temp\Word

MD5	ca2ac61ab298e06c4d8f07792708705c
SHA1	35547141d3593d89746a4de38e809388de7b224f
SHA256	cabef77014cb90d5e896c046830742852edb20adcd1da71f88f8f8805d476607
SHA512	c6f0fccfaa08ef6f4d17698eb07cf27fa116b94bab2a25afe392acb2fecb1fb9d58301288e80839dadf834245a614846d72d1243693b40a56d7be45745f90218

C:\Users\Admin\AppData\Local\Temp\Tomorrow

MD5	b348e7db88d0e52cfb6c7adb43628390
SHA1	5daa60ea78be614a992e88a60b655601cb45ebb6
SHA256	fa61763479671d7aa59798ccd20a2ae48102e24f2fdbc11e753c2141b3e0d135
SHA512	9d3018d203bad94e6a6efb2f5c5dfb55b14d5a6e1885cc60a34f0c647771cede2626e448f2fc194e3d17795c97ebb0bf283cb2a24a7db71f5e7fd15bdab01eff

C:\Users\Admin\AppData\Local\Temp\Shaft

MD5	4a29dcfa87b47e37e8b4447b840ccd91
SHA1	cd56012f27e7ece5545b6b07172f8f0169a852f5
SHA256	dbf049319595a1a9faf8c8dbc70814c4562c4b9dd10f18e56b0cb83e37cdce5c
SHA512	79b69684e7a72eb7fa24f36745f42370acc6655e44fbbd93dda679ed676c010a38a530b3b210196b6962e36ca1756fedb4341f867bdeb2e86c6ded23b7dde91f

C:\Users\Admin\AppData\Local\Temp\Colleagues

MD5	8a6af62b964e899f2fdb5b08bb70fe1d
SHA1	74d97553398f4952fc7244db53a54c5c9418680b
SHA256	621b098f227833dd3d62d4b181bf751e76d9688237ae27ba4475947863775103
SHA512	be082ccae47ebb4bb28f9d9fc9ffb089e081ab95d41232be5bd998fdfcb6995816141e46289f7fb15acf890bc97ce77fb413c8a56424a411dcce03354d093186

C:\Users\Admin\AppData\Local\Temp\Isle

MD5	c7edd1b120ffd89a03bb13f43248c03f
SHA1	70cdf64d0b1f9ddeed567599ed2b4ea6c0fad204
SHA256	84e53bfccccd03c162214a5b47741945c029afd23ec7ca307f1a66bc292ff3f8
SHA512	9d760c5455f7daa4ee1aeb3070d33cc43ec933f843333ae9d89f15d62f3840939bb83ad39420bf3fc9f800c8dcdde3f39085e7fcdfbedeeb999382ac1f9e75e2

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

MD5	b06e67f9767e5023892d9698703ad098
SHA1	acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256	8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512	7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

memory/1836-580-0x0000000001400000-0x0000000001B4A000-memory.dmp

memory/1836-581-0x0000000001400000-0x0000000001B4A000-memory.dmp

memory/1836-583-0x0000000001400000-0x0000000001B4A000-memory.dmp

memory/1836-590-0x0000000001400000-0x0000000001B4A000-memory.dmp

memory/1836-592-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/1836-591-0x0000000001400000-0x0000000001B4A000-memory.dmp

memory/1836-612-0x0000000001400000-0x0000000001B4A000-memory.dmp

memory/1836-613-0x0000000001400000-0x0000000001B4A000-memory.dmp

memory/1836-629-0x0000000001400000-0x0000000001B4A000-memory.dmp

memory/1836-630-0x0000000001400000-0x0000000001B4A000-memory.dmp

C:\ProgramData\HJDHCFCBGIDG\nss3.dll

MD5	1cc453cdf74f31e4d913ff9c10acdde2
SHA1	6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256	ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512	dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\HJDHCFCBGIDG\mozglue.dll

MD5	c8fd9be83bc728cc04beffafc2907fe9
SHA1	95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256	ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512	fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

MD5	d751713988987e9331980363e24189ce
SHA1	97d170e1550eee4afc0af065b78cda302a97674c
SHA256	4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512	b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

memory/1836-658-0x0000000001400000-0x0000000001B4A000-memory.dmp

memory/1836-659-0x0000000001400000-0x0000000001B4A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

MD5	20d4b8fa017a12a108c87f540836e250
SHA1	1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA256	6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512	507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

C:\ProgramData\DBFBFBGDBK.exe

MD5	6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1	424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA256	376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
SHA512	d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8

memory/4108-692-0x0000000000290000-0x00000000007A3000-memory.dmp

C:\ProgramData\CBFCBKKFBA.exe

MD5	daaff76b0baf0a1f9cec253560c5db20
SHA1	0311cf0eeb4beddd2c69c6e97462595313a41e78
SHA256	5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
SHA512	987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3

memory/3888-698-0x0000000000880000-0x0000000000AC8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8477e5c1

MD5	8d443e7cb87cacf0f589ce55599e008f
SHA1	c7ff0475a3978271e0a8417ac4a826089c083772
SHA256	e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
SHA512	c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5

memory/4108-708-0x0000000072C70000-0x0000000072DEB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\84791569

MD5	c62f812e250409fbd3c78141984270f2
SHA1	9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA256	d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
SHA512	7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092

memory/3888-710-0x0000000072C70000-0x0000000072DEB000-memory.dmp

memory/4108-712-0x00007FF98FED0000-0x00007FF9900C5000-memory.dmp

memory/3888-711-0x00007FF98FED0000-0x00007FF9900C5000-memory.dmp

memory/1836-716-0x0000000001400000-0x0000000001B4A000-memory.dmp

memory/1836-717-0x0000000001400000-0x0000000001B4A000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-16 12:50

Reported

2024-06-16 12:53

Platform

win7-20240508-en

Max time kernel

120s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2984 wrote to memory of 1452	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2984 wrote to memory of 1452	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2984 wrote to memory of 1452	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2984 wrote to memory of 1452	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2984 wrote to memory of 1452	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2984 wrote to memory of 1452	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2984 wrote to memory of 1452	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1452 wrote to memory of 2068	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1452 wrote to memory of 2068	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1452 wrote to memory of 2068	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1452 wrote to memory of 2068	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 220

Network

N/A

Files

N/A

Sample ID	240616-p266naterf
Target	9bcb71d1d6693753c79d1635b5caaa7cf4d189828397434a4799c2de9b454d34.zip
SHA256	9bcb71d1d6693753c79d1635b5caaa7cf4d189828397434a4799c2de9b454d34
Tags	amadey stealc vidar ffb1b9 discovery spyware stealer trojan

Malware Analysis Report

2024-09-11 16:05

Table of Contents