Malware Analysis Report

2024-09-11 15:46

Sample ID 240617-tsdvzazdjq
Target #!~#0PEn_9797_P@$SW0rd~!^!!$.zip
SHA256 02cdfef8bcb577fb36ca108e6884b0ab7408d7f3ccacbedcaa5686fa636f138e
Tags
stealc vidar stealer xmrig discovery execution miner spyware upx amadey ffb1b9 trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

02cdfef8bcb577fb36ca108e6884b0ab7408d7f3ccacbedcaa5686fa636f138e

Threat Level: Known bad

The file #!~#0PEn_9797_P@$SW0rd~!^!!$.zip was found to be: Known bad.

Malicious Activity Summary

stealc vidar stealer xmrig discovery execution miner spyware upx amadey ffb1b9 trojan

Vidar

Stealc

Detect Vidar Stealer

xmrig

Amadey

XMRig Miner payload

Blocklisted process makes network request

UPX packed file

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Reads data files stored by FTP clients

Downloads MZ/PE file

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Checks computer location settings

Drops file in Windows directory

Checks installed software on the system

Loads dropped DLL

Executes dropped EXE

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Program crash

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-17 16:18

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 16:18

Reported

2024-06-17 16:21

Platform

win7-20240220-en

Max time kernel

119s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2672 set thread context of 2852 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2672 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2672 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2672 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2672 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2672 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2852 wrote to memory of 2456 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 2852 wrote to memory of 2456 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 2852 wrote to memory of 2456 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 2852 wrote to memory of 2456 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 2852 wrote to memory of 2456 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 2852 wrote to memory of 2456 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 2456 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2456 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2456 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2456 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\dcom.au3

C:\Users\Admin\AppData\Local\Temp\dcom.au3

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 148

Network

N/A

Files

memory/2672-0-0x0000000074150000-0x00000000742C4000-memory.dmp

memory/2672-1-0x0000000077030000-0x00000000771D9000-memory.dmp

memory/2672-10-0x0000000074162000-0x0000000074164000-memory.dmp

memory/2672-11-0x0000000074150000-0x00000000742C4000-memory.dmp

memory/2672-12-0x0000000074150000-0x00000000742C4000-memory.dmp

memory/2672-14-0x0000000000400000-0x0000000000698000-memory.dmp

memory/2672-19-0x0000000057800000-0x0000000057812000-memory.dmp

memory/2672-20-0x0000000050310000-0x0000000050349000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\91a828bf

MD5 21182e076d299d4cafa5dafaa79a86e6
SHA1 db5cf743829fe476175d4e1098975035256db696
SHA256 4b08095361a5ccad86e44ccf0811ec0427107d3cb0d325c4dcebd62f95133267
SHA512 d6b24a699b159780a94ce8ccbd81091d8d57abe951b248339eb224537b6334217ea246db3abae3dfd6138b5768957d55f4904634c291036b9c6829c8a4d71015

memory/2852-22-0x0000000074150000-0x00000000742C4000-memory.dmp

memory/2672-18-0x0000000050120000-0x000000005030D000-memory.dmp

memory/2672-17-0x0000000057000000-0x000000005703F000-memory.dmp

memory/2672-16-0x0000000059800000-0x000000005986E000-memory.dmp

memory/2672-15-0x0000000050000000-0x0000000050116000-memory.dmp

memory/2852-23-0x0000000077030000-0x00000000771D9000-memory.dmp

memory/2852-25-0x0000000074150000-0x00000000742C4000-memory.dmp

memory/2852-26-0x0000000074150000-0x00000000742C4000-memory.dmp

\Users\Admin\AppData\Local\Temp\dcom.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/2456-32-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2456-31-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2456-34-0x00000000006E0000-0x0000000000E2C000-memory.dmp

memory/2456-41-0x00000000006E0000-0x0000000000E2C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 16:18

Reported

2024-06-17 16:21

Platform

win10v2004-20240508-en

Max time kernel

118s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3200 set thread context of 1588 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 3260 set thread context of 4728 N/A C:\ProgramData\BKKKFCFIIJ.exe C:\Windows\SysWOW64\ftp.exe
PID 116 set thread context of 400 N/A C:\ProgramData\AKFCFBAAEH.exe C:\Windows\SysWOW64\ftp.exe
PID 4728 set thread context of 1528 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 1528 set thread context of 4348 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Watcher Com SH.job C:\Windows\SysWOW64\ftp.exe N/A
File created C:\Windows\Tasks\TWI Cloud Host.job C:\Windows\SysWOW64\ftp.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\AKFCFBAAEH.exe N/A
N/A N/A C:\ProgramData\BKKKFCFIIJ.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A
N/A N/A C:\ProgramData\AKFCFBAAEH.exe N/A
N/A N/A C:\ProgramData\BKKKFCFIIJ.exe N/A
N/A N/A C:\ProgramData\BKKKFCFIIJ.exe N/A
N/A N/A C:\ProgramData\AKFCFBAAEH.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\ProgramData\BKKKFCFIIJ.exe N/A
N/A N/A C:\ProgramData\AKFCFBAAEH.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3200 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 3200 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 3200 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 3200 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1588 wrote to memory of 1500 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 1588 wrote to memory of 1500 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 1588 wrote to memory of 1500 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 1588 wrote to memory of 1500 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 1588 wrote to memory of 1500 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 1500 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\ProgramData\AKFCFBAAEH.exe
PID 1500 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\ProgramData\AKFCFBAAEH.exe
PID 1500 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\ProgramData\AKFCFBAAEH.exe
PID 1500 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\ProgramData\BKKKFCFIIJ.exe
PID 1500 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\ProgramData\BKKKFCFIIJ.exe
PID 1500 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\ProgramData\BKKKFCFIIJ.exe
PID 3260 wrote to memory of 4728 N/A C:\ProgramData\BKKKFCFIIJ.exe C:\Windows\SysWOW64\ftp.exe
PID 3260 wrote to memory of 4728 N/A C:\ProgramData\BKKKFCFIIJ.exe C:\Windows\SysWOW64\ftp.exe
PID 3260 wrote to memory of 4728 N/A C:\ProgramData\BKKKFCFIIJ.exe C:\Windows\SysWOW64\ftp.exe
PID 116 wrote to memory of 400 N/A C:\ProgramData\AKFCFBAAEH.exe C:\Windows\SysWOW64\ftp.exe
PID 116 wrote to memory of 400 N/A C:\ProgramData\AKFCFBAAEH.exe C:\Windows\SysWOW64\ftp.exe
PID 116 wrote to memory of 400 N/A C:\ProgramData\AKFCFBAAEH.exe C:\Windows\SysWOW64\ftp.exe
PID 3260 wrote to memory of 4728 N/A C:\ProgramData\BKKKFCFIIJ.exe C:\Windows\SysWOW64\ftp.exe
PID 116 wrote to memory of 400 N/A C:\ProgramData\AKFCFBAAEH.exe C:\Windows\SysWOW64\ftp.exe
PID 1500 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\Windows\SysWOW64\cmd.exe
PID 1500 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\Windows\SysWOW64\cmd.exe
PID 1500 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\Windows\SysWOW64\cmd.exe
PID 5060 wrote to memory of 884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 5060 wrote to memory of 884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 5060 wrote to memory of 884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 400 wrote to memory of 4792 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 400 wrote to memory of 4792 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 400 wrote to memory of 4792 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 4728 wrote to memory of 1528 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4728 wrote to memory of 1528 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 400 wrote to memory of 4792 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 4728 wrote to memory of 1528 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4728 wrote to memory of 1528 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 1528 wrote to memory of 4348 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 1528 wrote to memory of 4348 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 1528 wrote to memory of 4348 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 1528 wrote to memory of 4348 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 1528 wrote to memory of 4348 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 1528 wrote to memory of 4348 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 1528 wrote to memory of 4348 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 4792 wrote to memory of 3532 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 3532 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 3532 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\dcom.au3

C:\Users\Admin\AppData\Local\Temp\dcom.au3

C:\ProgramData\AKFCFBAAEH.exe

"C:\ProgramData\AKFCFBAAEH.exe"

C:\ProgramData\BKKKFCFIIJ.exe

"C:\ProgramData\BKKKFCFIIJ.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DBGHJEBKJEGH" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe -a rx/0 --url=65.109.127.181:3333 -u PLAYA -p PLAYA -R --variant=-1 --max-cpu-usage=70 --donate-level=1 -opencl

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000003041\run.ps1"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 poocoin.online udp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 8.8.8.8:53 137.63.21.104.in-addr.arpa udp
US 104.21.63.137:443 poocoin.online tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.67:80 c.pki.goog tcp
US 104.21.63.137:443 poocoin.online tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 8.8.8.8:53 businessdownloads.ltd udp
US 104.21.16.123:443 businessdownloads.ltd tcp
US 8.8.8.8:53 123.16.21.104.in-addr.arpa udp
US 104.21.63.137:443 poocoin.online tcp
US 8.8.8.8:53 i.imgur.com udp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 199.232.192.193:443 i.imgur.com tcp
US 104.21.63.137:443 poocoin.online tcp
US 8.8.8.8:53 193.192.232.199.in-addr.arpa udp
US 104.21.63.137:443 poocoin.online tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 104.21.63.137:443 poocoin.online tcp
FI 135.181.22.88:80 135.181.22.88 tcp
US 8.8.8.8:53 88.22.181.135.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
FI 65.109.127.181:3333 tcp
US 8.8.8.8:53 proresupdate.com udp
US 45.152.112.146:80 proresupdate.com tcp
US 8.8.8.8:53 contur2fa.recipeupdates.rest udp
US 172.67.197.250:443 contur2fa.recipeupdates.rest tcp
US 8.8.8.8:53 146.112.152.45.in-addr.arpa udp
US 8.8.8.8:53 250.197.67.172.in-addr.arpa udp
US 172.67.197.250:443 contur2fa.recipeupdates.rest tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp

Files

memory/3200-0-0x0000000074730000-0x00000000748AB000-memory.dmp

memory/3200-1-0x00007FFC15A10000-0x00007FFC15C05000-memory.dmp

memory/3200-10-0x0000000074742000-0x0000000074744000-memory.dmp

memory/3200-11-0x0000000074730000-0x00000000748AB000-memory.dmp

memory/3200-12-0x0000000074730000-0x00000000748AB000-memory.dmp

memory/3200-15-0x0000000000400000-0x0000000000698000-memory.dmp

memory/3200-21-0x0000000050310000-0x0000000050349000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9f6932a4

MD5 62364a1769790a748f4f5fd8432adaf1
SHA1 e4c88f3758cfdea7a315441a96bd5d9b3d4661db
SHA256 6e462f3101f70e0f790dfe337c93a3b0f12ada7b0734f12a42e4dd15fb92b6b9
SHA512 63af5b5a044ca46d1efba827c6497d08a2348fd4e3f4ee22ff51ec15cb60c6e30baeaed13cbb9d4f6d63d2d1ffea3a7dca3bca5506406a087d60e4955bc6f5a4

memory/3200-20-0x0000000050120000-0x000000005030D000-memory.dmp

memory/3200-19-0x0000000057800000-0x0000000057812000-memory.dmp

memory/3200-18-0x0000000057000000-0x000000005703F000-memory.dmp

memory/3200-17-0x0000000050000000-0x0000000050116000-memory.dmp

memory/3200-16-0x0000000059800000-0x000000005986E000-memory.dmp

memory/1588-14-0x0000000074731000-0x000000007473F000-memory.dmp

memory/1588-23-0x00007FFC15A10000-0x00007FFC15C05000-memory.dmp

memory/1588-26-0x0000000074731000-0x000000007473F000-memory.dmp

memory/1588-25-0x000000007473E000-0x0000000074740000-memory.dmp

memory/1588-30-0x0000000074731000-0x000000007473F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dcom.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/1500-32-0x0000000000A00000-0x000000000114C000-memory.dmp

memory/1500-34-0x00007FFC15A10000-0x00007FFC15C05000-memory.dmp

memory/1500-41-0x0000000000A00000-0x000000000114C000-memory.dmp

memory/1500-42-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\ProgramData\DBGHJEBKJEGH\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\DBGHJEBKJEGH\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\AKFCFBAAEH.exe

MD5 6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1 424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA256 376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
SHA512 d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8

memory/116-120-0x0000000000E50000-0x0000000001363000-memory.dmp

C:\ProgramData\BKKKFCFIIJ.exe

MD5 daaff76b0baf0a1f9cec253560c5db20
SHA1 0311cf0eeb4beddd2c69c6e97462595313a41e78
SHA256 5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
SHA512 987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3

memory/3260-131-0x0000000000C50000-0x0000000000E98000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\882e7ae6

MD5 c62f812e250409fbd3c78141984270f2
SHA1 9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA256 d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
SHA512 7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092

memory/3260-137-0x0000000072DA0000-0x0000000072F1B000-memory.dmp

memory/3260-138-0x00007FFC15A10000-0x00007FFC15C05000-memory.dmp

memory/1500-142-0x0000000000A00000-0x000000000114C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\997a55fc

MD5 8d443e7cb87cacf0f589ce55599e008f
SHA1 c7ff0475a3978271e0a8417ac4a826089c083772
SHA256 e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
SHA512 c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5

memory/116-148-0x0000000072DA0000-0x0000000072F1B000-memory.dmp

memory/116-149-0x00007FFC15A10000-0x00007FFC15C05000-memory.dmp

memory/1500-150-0x0000000000A00000-0x000000000114C000-memory.dmp

memory/3260-151-0x0000000072DA0000-0x0000000072F1B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8b690cee

MD5 fab0a6e67d75230569168d2fe98fbe10
SHA1 c58b882b5fc7c33dd990cf5bf35603613fb6e953
SHA256 49dd9aeb4e93c25a5108e43ad5edab9a2252dfcb735b815fe77e6fd290c11ec8
SHA512 470d0f6cd4c445c8d0a53fd7c07af01dc70755a0247e8c3443b24d85a8d0b90f83349250181a83c72c32bd2fb396334e565ab00313124d148f964722f64f9923

memory/1500-154-0x0000000000A00000-0x000000000114C000-memory.dmp

memory/116-159-0x0000000072DA0000-0x0000000072F1B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9c05cc27

MD5 6d37ce78222f007e0b28584002c8e2b2
SHA1 8cc7b469a7483db6cf9a13e502da9a3611c00bfc
SHA256 c75332250174596876abad5ffde67e408c13d8d16dc305d5bd6834dfd25bc3c3
SHA512 cf2b36149208bd7cc8aef2f7c9cd714f0098bfd47055717e762549026d139d1a4020d564a45b85229687dacaaacadaee493c4c30348a51a76c4d2c531ee7a439

memory/1500-166-0x0000000000A00000-0x000000000114C000-memory.dmp

memory/4728-167-0x00007FFC15A10000-0x00007FFC15C05000-memory.dmp

memory/400-168-0x00007FFC15A10000-0x00007FFC15C05000-memory.dmp

memory/4728-169-0x0000000072DA0000-0x0000000072F1B000-memory.dmp

C:\ProgramData\DBGHJEBKJEGH\VCRUNT~1.DLL

MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\DBGHJEBKJEGH\softokn3.dll

MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

C:\ProgramData\DBGHJEBKJEGH\msvcp140.dll

MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

memory/400-184-0x0000000072DA0000-0x0000000072F1B000-memory.dmp

memory/1528-188-0x00007FFBF5170000-0x00007FFBF67E7000-memory.dmp

memory/4792-191-0x00007FFC15A10000-0x00007FFC15C05000-memory.dmp

memory/1528-192-0x0000000000400000-0x000000000040A000-memory.dmp

memory/4348-196-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/4348-200-0x000002090CD40000-0x000002090CD60000-memory.dmp

memory/4348-199-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/4348-198-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/4348-203-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/4348-204-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/4348-205-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/4348-201-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/4348-202-0x0000000140000000-0x00000001407DC000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 91a13ddf71fae885dd81cae4a79b3d95
SHA1 811c30a8c34137c5a0f5e90fcaf7554c6316f665
SHA256 ccf475e627accf63e60fd58ba40822a210360f9110f4930cf05e7975841be53a
SHA512 34ed36aebef8a0461310996bc5de3c62f3aa614e5ee7ee6bd97de809a3b90e6b5c26b55cf9d16d26fda3cf93d8d512b999adfdecd3bc47147c67863cafc18b34

C:\Users\Admin\AppData\Local\Temp\1000003041\run.ps1

MD5 1e49c49df1e9bb5a3646fbdd72fff72d
SHA1 ca3b2f92797030ad96341c5551812e679e9746d3
SHA256 df52ed4a147cad99aec03614368f8781e806c45be6e046ec4a73a26e7ec9cd10
SHA512 b0c96599de30f1822ddc99d1fed6341ae06f25a171c52b9a78f6304d02a30f8da41738d4af4b4c8365b0b52739b3df03be99dddf764f12f724bd24a91b59c82d

memory/3532-220-0x0000000004650000-0x0000000004686000-memory.dmp

memory/3532-221-0x0000000004CC0000-0x00000000052E8000-memory.dmp

memory/3532-222-0x0000000004C50000-0x0000000004C72000-memory.dmp

memory/3532-223-0x00000000054E0000-0x0000000005546000-memory.dmp

memory/3532-224-0x00000000055C0000-0x0000000005626000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cjg23ghp.g1v.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3532-234-0x0000000005730000-0x0000000005A84000-memory.dmp

memory/3532-235-0x0000000005BE0000-0x0000000005BFE000-memory.dmp

memory/3532-236-0x0000000005C10000-0x0000000005C5C000-memory.dmp

memory/3532-238-0x0000000006E40000-0x0000000006ED6000-memory.dmp

memory/3532-239-0x0000000006120000-0x000000000613A000-memory.dmp

memory/3532-240-0x00000000061B0000-0x00000000061D2000-memory.dmp

memory/3532-241-0x0000000007490000-0x0000000007A34000-memory.dmp

memory/3532-242-0x00000000080C0000-0x000000000873A000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-17 16:18

Reported

2024-06-17 16:21

Platform

win11-20240508-en

Max time kernel

119s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe"

Signatures

Amadey

trojan amadey

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5060 set thread context of 4604 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1628 set thread context of 3884 N/A C:\ProgramData\ECAKKKKJDB.exe C:\Windows\SysWOW64\ftp.exe
PID 784 set thread context of 660 N/A C:\ProgramData\JJJKFBAAAF.exe C:\Windows\SysWOW64\ftp.exe
PID 660 set thread context of 2316 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 2316 set thread context of 2684 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Watcher Com SH.job C:\Windows\SysWOW64\ftp.exe N/A
File created C:\Windows\Tasks\TWI Cloud Host.job C:\Windows\SysWOW64\ftp.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\ECAKKKKJDB.exe N/A
N/A N/A C:\ProgramData\JJJKFBAAAF.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A
N/A N/A C:\ProgramData\ECAKKKKJDB.exe N/A
N/A N/A C:\ProgramData\ECAKKKKJDB.exe N/A
N/A N/A C:\ProgramData\JJJKFBAAAF.exe N/A
N/A N/A C:\ProgramData\JJJKFBAAAF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\ProgramData\ECAKKKKJDB.exe N/A
N/A N/A C:\ProgramData\JJJKFBAAAF.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5060 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 5060 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 5060 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 5060 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 4604 wrote to memory of 5004 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 4604 wrote to memory of 5004 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 4604 wrote to memory of 5004 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 4604 wrote to memory of 5004 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 4604 wrote to memory of 5004 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\dcom.au3
PID 5004 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\ProgramData\ECAKKKKJDB.exe
PID 5004 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\ProgramData\ECAKKKKJDB.exe
PID 5004 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\ProgramData\ECAKKKKJDB.exe
PID 1628 wrote to memory of 3884 N/A C:\ProgramData\ECAKKKKJDB.exe C:\Windows\SysWOW64\ftp.exe
PID 1628 wrote to memory of 3884 N/A C:\ProgramData\ECAKKKKJDB.exe C:\Windows\SysWOW64\ftp.exe
PID 1628 wrote to memory of 3884 N/A C:\ProgramData\ECAKKKKJDB.exe C:\Windows\SysWOW64\ftp.exe
PID 5004 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\ProgramData\JJJKFBAAAF.exe
PID 5004 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\ProgramData\JJJKFBAAAF.exe
PID 5004 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\ProgramData\JJJKFBAAAF.exe
PID 784 wrote to memory of 660 N/A C:\ProgramData\JJJKFBAAAF.exe C:\Windows\SysWOW64\ftp.exe
PID 784 wrote to memory of 660 N/A C:\ProgramData\JJJKFBAAAF.exe C:\Windows\SysWOW64\ftp.exe
PID 784 wrote to memory of 660 N/A C:\ProgramData\JJJKFBAAAF.exe C:\Windows\SysWOW64\ftp.exe
PID 5004 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\Windows\SysWOW64\cmd.exe
PID 5004 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\Windows\SysWOW64\cmd.exe
PID 5004 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\dcom.au3 C:\Windows\SysWOW64\cmd.exe
PID 3516 wrote to memory of 4656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3516 wrote to memory of 4656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3516 wrote to memory of 4656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1628 wrote to memory of 3884 N/A C:\ProgramData\ECAKKKKJDB.exe C:\Windows\SysWOW64\ftp.exe
PID 784 wrote to memory of 660 N/A C:\ProgramData\JJJKFBAAAF.exe C:\Windows\SysWOW64\ftp.exe
PID 3884 wrote to memory of 2916 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 3884 wrote to memory of 2916 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 3884 wrote to memory of 2916 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 660 wrote to memory of 2316 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 660 wrote to memory of 2316 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 3884 wrote to memory of 2916 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 660 wrote to memory of 2316 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 660 wrote to memory of 2316 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 2316 wrote to memory of 2684 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 2316 wrote to memory of 2684 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 2316 wrote to memory of 2684 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 2316 wrote to memory of 2684 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 2316 wrote to memory of 2684 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 2316 wrote to memory of 2684 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 2316 wrote to memory of 2684 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 2916 wrote to memory of 4972 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2916 wrote to memory of 4972 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2916 wrote to memory of 4972 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\dcom.au3

C:\Users\Admin\AppData\Local\Temp\dcom.au3

C:\ProgramData\ECAKKKKJDB.exe

"C:\ProgramData\ECAKKKKJDB.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\ProgramData\JJJKFBAAAF.exe

"C:\ProgramData\JJJKFBAAAF.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CBFIIEHJDBKJ" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe -a rx/0 --url=65.109.127.181:3333 -u PLAYA -p PLAYA -R --variant=-1 --max-cpu-usage=70 --donate-level=1 -opencl

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000003041\run.ps1"

Network

Country Destination Domain Proto
US 8.8.8.8:53 poocoin.online udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.16.123:443 businessdownloads.ltd tcp
US 104.21.63.137:443 poocoin.online tcp
US 199.232.192.193:443 i.imgur.com tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
US 104.21.63.137:443 poocoin.online tcp
FI 135.181.22.88:80 135.181.22.88 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
US 172.67.197.250:443 contur2fa.recipeupdates.rest tcp
FI 65.109.127.181:3333 tcp
US 172.67.197.250:443 contur2fa.recipeupdates.rest tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp

Files

memory/5060-0-0x0000000073EB0000-0x000000007402D000-memory.dmp

memory/5060-1-0x00007FFF82700000-0x00007FFF82909000-memory.dmp

memory/5060-10-0x0000000073EC2000-0x0000000073EC4000-memory.dmp

memory/5060-11-0x0000000073EB0000-0x000000007402D000-memory.dmp

memory/5060-12-0x0000000073EB0000-0x000000007402D000-memory.dmp

memory/4604-14-0x0000000073EB1000-0x0000000073EBF000-memory.dmp

memory/5060-21-0x0000000050310000-0x0000000050349000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\c7685667

MD5 839cd3fbb32ee1cc214bf03bd5dba37f
SHA1 6919db6b48069f4f387da32d9ae12634d769ef60
SHA256 bb8e1861a20892b1c143e5c4ac24545741aab5b6c93f4feafa82950a2646ba39
SHA512 6e2a6b9b5b79e427523a44d1aca716f779fb8499e6d9353832e18e362898ac08733393b9cb5ffed2538a47ffed3e0c687b86e16449dacfb26cd11c1c5a35fc36

memory/5060-20-0x0000000050120000-0x000000005030D000-memory.dmp

memory/5060-19-0x0000000057800000-0x0000000057812000-memory.dmp

memory/5060-18-0x0000000059800000-0x000000005986E000-memory.dmp

memory/5060-17-0x0000000050000000-0x0000000050116000-memory.dmp

memory/5060-16-0x0000000057000000-0x000000005703F000-memory.dmp

memory/5060-15-0x0000000000400000-0x0000000000698000-memory.dmp

memory/4604-23-0x00007FFF82700000-0x00007FFF82909000-memory.dmp

memory/4604-27-0x0000000073EB1000-0x0000000073EBF000-memory.dmp

memory/4604-26-0x0000000073EBE000-0x0000000073EC0000-memory.dmp

memory/4604-30-0x0000000073EB1000-0x0000000073EBF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dcom.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/5004-32-0x0000000001600000-0x0000000001D4C000-memory.dmp

memory/5004-34-0x00007FFF82700000-0x00007FFF82909000-memory.dmp

memory/5004-43-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\ProgramData\CBFIIEHJDBKJ\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\CBFIIEHJDBKJ\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/5004-98-0x0000000001600000-0x0000000001D4C000-memory.dmp

C:\ProgramData\ECAKKKKJDB.exe

MD5 6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1 424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA256 376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
SHA512 d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8

memory/1628-122-0x00000000004F0000-0x0000000000A03000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\983affd0

MD5 8d443e7cb87cacf0f589ce55599e008f
SHA1 c7ff0475a3978271e0a8417ac4a826089c083772
SHA256 e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
SHA512 c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5

memory/1628-128-0x0000000072300000-0x000000007247D000-memory.dmp

memory/1628-136-0x00007FFF82700000-0x00007FFF82909000-memory.dmp

C:\ProgramData\JJJKFBAAAF.exe

MD5 daaff76b0baf0a1f9cec253560c5db20
SHA1 0311cf0eeb4beddd2c69c6e97462595313a41e78
SHA256 5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
SHA512 987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3

memory/784-140-0x0000000000920000-0x0000000000B68000-memory.dmp

memory/784-146-0x0000000072300000-0x000000007247D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9ccb7581

MD5 c62f812e250409fbd3c78141984270f2
SHA1 9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA256 d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
SHA512 7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092

memory/784-147-0x00007FFF82700000-0x00007FFF82909000-memory.dmp

C:\ProgramData\CBFIIEHJDBKJ\AKKEGH

MD5 59071590099d21dd439896592338bf95
SHA1 6a521e1d2a632c26e53b83d2cc4b0edecfc1e68c
SHA256 07854d2fef297a06ba81685e660c332de36d5d18d546927d30daad6d7fda1541
SHA512 eedb6cadbceb2c991fc6f68dccb80463b3f660c5358acd7d705398ae2e3df2b4327f0f6c6746486848bd2992b379776483a98063ae96edb45877bb0314874668

memory/5004-185-0x0000000001600000-0x0000000001D4C000-memory.dmp

memory/5004-192-0x0000000001600000-0x0000000001D4C000-memory.dmp

C:\ProgramData\CBFIIEHJDBKJ\GHDHJE

MD5 17c68f413cd198954a32a8ae4e72314c
SHA1 e46d1da0ae38baa702a92553ffeb6e8a40fade62
SHA256 63b05ad30d875c3d9f0225556cd7de950d2b9bdeb763886e35ab721a24e9c454
SHA512 cad1aacc64e60a65a80654c5af61caa9b2db12fb63e2bf2d34641dfb9c713507022e613e3d1aec1c662546bae164d63b84ca43083beee06e2e83a422fbdeddf3

memory/5004-203-0x0000000001600000-0x0000000001D4C000-memory.dmp

memory/1628-204-0x0000000072300000-0x000000007247D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9bf812a0

MD5 35aa033e245be987c2487dd78a08cc41
SHA1 782df53e5b62f3ac9e6c4739f3f3e60574b3a61b
SHA256 6dbebfbdaef255066c22a7ea27eac32bf04f7cc9f9f69e75b0ece6834e6b2127
SHA512 4927c10d802683691e36218e887b68334f221dad2ccedc5542b7b0b19395131378f176ebd3bcb54aa8bfdd89ade05721e89c8c27ab52ca2e1bbbd2c9384e2138

memory/784-207-0x0000000072300000-0x000000007247D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a03f94dc

MD5 d70a1c90b2a094731607c462a02904e9
SHA1 6a3486cf417da59835104a51fa9b5eba85fa54d7
SHA256 6fd1dd699b27dba0e8eb6bb369b49d5554fcefab9be05917791d6a583ef8a1da
SHA512 8b1a5caba2c821ca43e911a1da1b74a18bfb9b555cada97ea558fea9887d8a4da2bd538e47c6ac763c9138072cc3634902077014849dd54db879edbe43e92b5b

memory/3884-210-0x00007FFF82700000-0x00007FFF82909000-memory.dmp

memory/660-211-0x00007FFF82700000-0x00007FFF82909000-memory.dmp

C:\ProgramData\CBFIIEHJDBKJ\VCRUNT~1.DLL

MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\CBFIIEHJDBKJ\msvcp140.dll

MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

C:\ProgramData\CBFIIEHJDBKJ\softokn3.dll

MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

memory/660-217-0x0000000072300000-0x000000007247D000-memory.dmp

memory/3884-227-0x0000000072300000-0x000000007247D000-memory.dmp

memory/2316-231-0x00007FFF60CE0000-0x00007FFF62380000-memory.dmp

memory/2916-234-0x00007FFF82700000-0x00007FFF82909000-memory.dmp

memory/2316-235-0x0000000000400000-0x000000000040A000-memory.dmp

memory/2916-238-0x0000000000760000-0x00000000007D1000-memory.dmp

memory/2684-240-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2684-242-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2684-244-0x000001BC8E3B0000-0x000001BC8E3D0000-memory.dmp

memory/2684-243-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2684-246-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2684-249-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2684-248-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2684-247-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2684-245-0x0000000140000000-0x00000001407DC000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 239812be4d1914d066c06f569ba5689e
SHA1 fc83458b57bda51b9d08ab0bdda40283a5019280
SHA256 53cf9ffdc9c8244afc0bd8c84d6036aac7e7e8eaeb62c32706634722e35cc40f
SHA512 782d64c7b2a24c824bb7c7bffe57420c0f4613a6d28ab061e8f13b12769ed1276085c84927e4722d2383522d280226c67b0c4445fcabcdee2e56a38d870ad40e

C:\Users\Admin\AppData\Local\Temp\1000003041\run.ps1

MD5 1e49c49df1e9bb5a3646fbdd72fff72d
SHA1 ca3b2f92797030ad96341c5551812e679e9746d3
SHA256 df52ed4a147cad99aec03614368f8781e806c45be6e046ec4a73a26e7ec9cd10
SHA512 b0c96599de30f1822ddc99d1fed6341ae06f25a171c52b9a78f6304d02a30f8da41738d4af4b4c8365b0b52739b3df03be99dddf764f12f724bd24a91b59c82d

memory/4972-264-0x0000000005090000-0x00000000050C6000-memory.dmp

memory/4972-265-0x0000000005700000-0x0000000005D2A000-memory.dmp

memory/4972-266-0x0000000005E90000-0x0000000005EB2000-memory.dmp

memory/4972-267-0x0000000005F50000-0x0000000005FB6000-memory.dmp

memory/4972-268-0x0000000005FC0000-0x0000000006026000-memory.dmp

memory/4972-277-0x0000000006030000-0x0000000006387000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2l5iriop.lw0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4972-278-0x0000000006510000-0x000000000652E000-memory.dmp

memory/4972-279-0x0000000006540000-0x000000000658C000-memory.dmp

memory/4972-281-0x0000000007570000-0x0000000007606000-memory.dmp

memory/4972-282-0x0000000006A80000-0x0000000006A9A000-memory.dmp

memory/4972-283-0x0000000006AF0000-0x0000000006B12000-memory.dmp

memory/4972-284-0x0000000007BC0000-0x0000000008166000-memory.dmp

memory/4972-285-0x00000000087F0000-0x0000000008E6A000-memory.dmp