Malware Analysis Report

2024-09-11 09:56

Sample ID 240619-bdtnrsvekj
Target a86c3fc17ce2011b277a937078aa1cba9d8c52e8869a15535d6cfd3db196755e
SHA256 a86c3fc17ce2011b277a937078aa1cba9d8c52e8869a15535d6cfd3db196755e
Tags
agenttesla keylogger persistence spyware stealer trojan execution redline sectoprat cheat infostealer rat gcleaner loader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a86c3fc17ce2011b277a937078aa1cba9d8c52e8869a15535d6cfd3db196755e

Threat Level: Known bad

The file a86c3fc17ce2011b277a937078aa1cba9d8c52e8869a15535d6cfd3db196755e was found to be: Known bad.

Malicious Activity Summary

agenttesla keylogger persistence spyware stealer trojan execution redline sectoprat cheat infostealer rat gcleaner loader

RedLine payload

SectopRAT

RedLine

SectopRAT payload

AgentTesla

GCleaner

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Executes dropped EXE

Deletes itself

Loads dropped DLL

Checks computer location settings

Looks up external IP address via web service

Adds Run key to start application

AutoIT Executable

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Enumerates physical storage devices

Kills process with taskkill

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Scheduled Task/Job: Scheduled Task

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious behavior: MapViewOfSection

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-19 01:02

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-19 01:02

Reported

2024-06-19 01:04

Platform

win10v2004-20240508-en

Max time kernel

103s

Max time network

105s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DtcHF = "C:\\Users\\Admin\\AppData\\Roaming\\DtcHF\\DtcHF.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A ip-api.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 228 set thread context of 3924 N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 228 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 228 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 228 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 228 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe

"C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 228 -ip 228

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 716

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 172.67.74.152:443 api.ipify.org tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 152.74.67.172.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 138.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/228-10-0x0000000000C40000-0x0000000000C44000-memory.dmp

memory/3924-11-0x0000000000400000-0x0000000000442000-memory.dmp

memory/3924-12-0x000000007406E000-0x000000007406F000-memory.dmp

memory/3924-13-0x00000000057B0000-0x0000000005D54000-memory.dmp

memory/3924-14-0x0000000005200000-0x0000000005266000-memory.dmp

memory/3924-15-0x0000000074060000-0x0000000074810000-memory.dmp

memory/3924-18-0x00000000066A0000-0x00000000066F0000-memory.dmp

memory/3924-19-0x0000000006790000-0x0000000006822000-memory.dmp

memory/3924-20-0x0000000006720000-0x000000000672A000-memory.dmp

memory/3924-21-0x000000007406E000-0x000000007406F000-memory.dmp

memory/3924-22-0x0000000074060000-0x0000000074810000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-19 01:02

Reported

2024-06-19 01:04

Platform

win7-20240508-en

Max time kernel

118s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1636 set thread context of 2588 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1636 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\schtasks.exe
PID 1636 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\schtasks.exe
PID 1636 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\schtasks.exe
PID 1636 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\schtasks.exe
PID 1636 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1636 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1636 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1636 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1636 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1636 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1636 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1636 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1636 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1636 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1636 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1636 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe

"C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\niPCCh.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\niPCCh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp59F2.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

N/A

Files

memory/1636-0-0x000000007464E000-0x000000007464F000-memory.dmp

memory/1636-1-0x0000000000B10000-0x0000000000BFE000-memory.dmp

memory/1636-2-0x0000000074640000-0x0000000074D2E000-memory.dmp

memory/1636-3-0x0000000000570000-0x000000000058A000-memory.dmp

memory/1636-4-0x00000000003A0000-0x00000000003B0000-memory.dmp

memory/1636-5-0x0000000005420000-0x00000000054A4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp59F2.tmp

MD5 5d783b55df046ccc6ca219d0a049d30e
SHA1 1cd4d29676a8ffac4e952c9751231bc414a23430
SHA256 083c08cadfc934a166cf0a58a24e7f518d72dd2c7480c2f09c97ffd9ff5f8ae6
SHA512 975dd2c4072f26365b4e9899de2ea5da15b91a8b7b235595dfcec9a3d6b4bc55ded30d5396d19514c3d1789ed34c901d109638d6473f0394118739b1ed4a31ae

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 0d821a67046bba75af2468e63accfeef
SHA1 bd005ec0232aacf4d7a0588d28a5807893bf67c4
SHA256 dd9fe58a31a13831e99201cd6643f6349f41daa0309b427cf5197c5198f3396d
SHA512 0a242adfd832516a53856b0ddb34e04e3b9d786fa501d101baccec33ee02b70489968ff907fb1d32cdc400b27d0cc45960c00a3edf588cbdac8c42189c955728

memory/2588-18-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2588-27-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2588-29-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2588-28-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2588-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2588-24-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2588-22-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2588-20-0x0000000000400000-0x0000000000442000-memory.dmp

memory/1636-30-0x0000000074640000-0x0000000074D2E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-19 01:02

Reported

2024-06-19 01:04

Platform

win10v2004-20240508-en

Max time kernel

52s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4880 set thread context of 3272 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4880 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4880 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4880 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4880 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4880 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4880 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4880 wrote to memory of 4276 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\schtasks.exe
PID 4880 wrote to memory of 4276 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\schtasks.exe
PID 4880 wrote to memory of 4276 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\SysWOW64\schtasks.exe
PID 4880 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4880 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4880 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4880 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4880 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4880 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4880 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4880 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4880 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4880 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4880 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe

"C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\niPCCh.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\niPCCh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8443.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Files

memory/4880-0-0x00000000751FE000-0x00000000751FF000-memory.dmp

memory/4880-1-0x0000000000CC0000-0x0000000000DAE000-memory.dmp

memory/4880-2-0x0000000005D50000-0x00000000062F4000-memory.dmp

memory/4880-3-0x00000000057A0000-0x0000000005832000-memory.dmp

memory/4880-4-0x00000000751F0000-0x00000000759A0000-memory.dmp

memory/4880-5-0x0000000005950000-0x000000000595A000-memory.dmp

memory/4880-6-0x0000000005A30000-0x0000000005ACC000-memory.dmp

memory/4880-7-0x0000000005B10000-0x0000000005B2A000-memory.dmp

memory/4880-8-0x0000000006A00000-0x0000000006A10000-memory.dmp

memory/4880-9-0x0000000006EE0000-0x0000000006F64000-memory.dmp

memory/924-14-0x0000000002310000-0x0000000002346000-memory.dmp

memory/924-15-0x00000000751F0000-0x00000000759A0000-memory.dmp

memory/924-16-0x0000000004D90000-0x00000000053B8000-memory.dmp

memory/924-17-0x00000000751F0000-0x00000000759A0000-memory.dmp

memory/3524-18-0x00000000751F0000-0x00000000759A0000-memory.dmp

memory/924-20-0x00000000053C0000-0x00000000053E2000-memory.dmp

memory/3524-19-0x00000000751F0000-0x00000000759A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8443.tmp

MD5 69de49eeeb761e5c0dac225e8d3b7b58
SHA1 0cb7e13b6a71ba900e5a63cb13ea826abfb47bf7
SHA256 22a8bee4b7cef4213b13c3ed21a77f3d7a3e51b4520c3f396cb7794aa4870ae2
SHA512 ea409c655e5f205e53d5b173c8f642a9c1c13ce0f4e1791198cad465d82385ae8d1bf83b895a12896d956698c77b03252d1b91ed4453ffca190950c92fc12d5d

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nvhm3lkq.gnt.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/924-22-0x0000000005600000-0x0000000005666000-memory.dmp

memory/924-21-0x0000000005520000-0x0000000005586000-memory.dmp

memory/3524-40-0x0000000005A60000-0x0000000005DB4000-memory.dmp

memory/3524-39-0x00000000751F0000-0x00000000759A0000-memory.dmp

memory/3272-44-0x0000000000400000-0x0000000000442000-memory.dmp

memory/4880-46-0x00000000751F0000-0x00000000759A0000-memory.dmp

memory/3524-47-0x0000000006030000-0x000000000604E000-memory.dmp

memory/3524-48-0x00000000060C0000-0x000000000610C000-memory.dmp

memory/3524-60-0x0000000007200000-0x000000000721E000-memory.dmp

memory/3524-50-0x0000000075AA0000-0x0000000075AEC000-memory.dmp

memory/3524-49-0x0000000006600000-0x0000000006632000-memory.dmp

memory/924-61-0x0000000075AA0000-0x0000000075AEC000-memory.dmp

memory/3524-71-0x0000000007220000-0x00000000072C3000-memory.dmp

memory/3524-72-0x0000000007990000-0x000000000800A000-memory.dmp

memory/3524-73-0x0000000007350000-0x000000000736A000-memory.dmp

memory/3524-75-0x00000000073C0000-0x00000000073CA000-memory.dmp

memory/3524-76-0x00000000075D0000-0x0000000007666000-memory.dmp

memory/3524-77-0x0000000007550000-0x0000000007561000-memory.dmp

memory/924-78-0x0000000007180000-0x000000000718E000-memory.dmp

memory/3524-79-0x0000000007590000-0x00000000075A4000-memory.dmp

memory/924-80-0x0000000007290000-0x00000000072AA000-memory.dmp

memory/3524-81-0x0000000007670000-0x0000000007678000-memory.dmp

memory/3272-82-0x0000000006090000-0x00000000060E0000-memory.dmp

memory/924-87-0x00000000751F0000-0x00000000759A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 03988d2d1bf73e9f7e6bbbb76e4bc7ed
SHA1 3023ce8eb74b8280679ff7df08ae9431fdab1f9a
SHA256 52062b004fe1336ca294651362e50bf38eb0f5e0061c33c5106e6bf06a823178
SHA512 903739f60a60360c8723242dc507d573d528993c0ca030cceeebfed05cc6b3905bb81b1d915d13876eeed58bc189fec08f2b0324482430d04be334c9f0759640

memory/3524-89-0x00000000751F0000-0x00000000759A0000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-19 01:02

Reported

2024-06-19 01:04

Platform

win7-20240220-en

Max time kernel

147s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2652 set thread context of 780 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2036 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2036 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2036 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2036 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2652 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2652 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2652 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2652 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2652 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2652 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2652 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2652 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2652 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2652 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2652 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2652 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2652 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2652 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2652 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2652 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2652 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Processes

C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe

"C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gsGRKUB.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gsGRKUB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp58EE.tmp"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

Network

Country Destination Domain Proto
NL 45.137.22.68:55615 tcp
NL 45.137.22.68:55615 tcp
NL 45.137.22.68:55615 tcp
NL 45.137.22.68:55615 tcp
NL 45.137.22.68:55615 tcp
NL 45.137.22.68:55615 tcp

Files

memory/2576-5-0x0000000000140000-0x0000000000142000-memory.dmp

memory/2036-4-0x0000000000E00000-0x0000000000E02000-memory.dmp

memory/2576-7-0x0000000000220000-0x0000000000221000-memory.dmp

\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

MD5 6da58e4a005e57e0eee2faf662dfd4ae
SHA1 2146c9d021ac262c918c4cdf5d5c842568ee2c87
SHA256 364a57fff4c2f5d8f2b35945016f4660ea9e583250e81c13d3da523d21cf33cf
SHA512 f0895ce9160e05c434f3b3bb5ab6907dd4a767b38ea19f276de446e1d62476b00b912f4fb432bb12a4cadf19e25310b5c7a716b6d51a0156a47bc6c31a10ceeb

memory/2652-24-0x0000000000FB0000-0x0000000001064000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpg

MD5 e83ccb51ee74efd2a221be293d23c69a
SHA1 4365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256 da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA512 0252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar1B45.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/2652-123-0x00000000009B0000-0x00000000009C6000-memory.dmp

memory/2652-124-0x0000000000AF0000-0x0000000000AFE000-memory.dmp

memory/2652-125-0x0000000000B00000-0x0000000000B10000-memory.dmp

memory/2652-126-0x0000000000EB0000-0x0000000000F10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp58EE.tmp

MD5 e454a1426c70effa82894c54096d3abb
SHA1 94d0ef330de0482aec2dc205f0ec20408096c815
SHA256 fc4df0cb427e56387f82531dc752f90dc396146e8d3cf61c70e56182d12f2016
SHA512 62cf7aa6ab129a062f833fa527ffd82ba59e5390cfc8f39618b71195ae009a66af9118cc46ff1e87133b0cb5cdeb8e24bab8ddffb4da1ef20570fe321aefd503

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JG1CVSST7G30NF2PCFKQ.temp

MD5 1f6731fb17b0252c56d3678677574efe
SHA1 24a2db5d6a2d60f22ab6153952a3b518515e8cd5
SHA256 8c358711f50eccfa414382b6956f400c16a5130eca0cf1c46fb66197059cf7d9
SHA512 65c9121ee40600c7d14c0c983f8880ee9d610e4cbf16665ff30b5c81f28e539483b6dc9397ea8ed13aa9b7be59addb801a35e945b9a3b84716658d9e0c091435

memory/780-150-0x0000000000400000-0x000000000041E000-memory.dmp

memory/780-149-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/780-147-0x0000000000400000-0x000000000041E000-memory.dmp

memory/780-145-0x0000000000400000-0x000000000041E000-memory.dmp

memory/780-143-0x0000000000400000-0x000000000041E000-memory.dmp

memory/780-141-0x0000000000400000-0x000000000041E000-memory.dmp

memory/780-153-0x0000000000400000-0x000000000041E000-memory.dmp

memory/780-155-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2576-156-0x0000000000220000-0x0000000000221000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-19 01:02

Reported

2024-06-19 01:04

Platform

win10v2004-20240611-en

Max time kernel

135s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1164 set thread context of 3432 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3164 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 3164 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 3164 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1164 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1164 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1164 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1164 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1164 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1164 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1164 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 1164 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 1164 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 1164 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1164 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1164 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1164 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1164 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1164 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1164 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1164 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1164 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1164 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1164 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Processes

C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe

"C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4416,i,4778049104057176787,6631751660692402210,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gsGRKUB.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gsGRKUB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2A09.tmp"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
NL 45.137.22.68:55615 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
NL 52.111.243.30:443 tcp
NL 45.137.22.68:55615 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 45.137.22.68:55615 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
NL 45.137.22.68:55615 tcp
NL 45.137.22.68:55615 tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

MD5 6da58e4a005e57e0eee2faf662dfd4ae
SHA1 2146c9d021ac262c918c4cdf5d5c842568ee2c87
SHA256 364a57fff4c2f5d8f2b35945016f4660ea9e583250e81c13d3da523d21cf33cf
SHA512 f0895ce9160e05c434f3b3bb5ab6907dd4a767b38ea19f276de446e1d62476b00b912f4fb432bb12a4cadf19e25310b5c7a716b6d51a0156a47bc6c31a10ceeb

memory/1164-14-0x00000000726CE000-0x00000000726CF000-memory.dmp

memory/1164-15-0x0000000000730000-0x00000000007E4000-memory.dmp

memory/1164-16-0x00000000057B0000-0x0000000005D54000-memory.dmp

memory/1164-17-0x0000000005200000-0x0000000005292000-memory.dmp

memory/1164-18-0x00000000052A0000-0x00000000055F4000-memory.dmp

memory/1164-19-0x00000000726C0000-0x0000000072E70000-memory.dmp

memory/1164-20-0x0000000005D60000-0x0000000005D6A000-memory.dmp

memory/1164-21-0x0000000006C50000-0x0000000006C66000-memory.dmp

memory/1164-22-0x0000000006C70000-0x0000000006C7E000-memory.dmp

memory/1164-23-0x0000000006C80000-0x0000000006C90000-memory.dmp

memory/1164-24-0x0000000006CB0000-0x0000000006D10000-memory.dmp

memory/1164-25-0x00000000093A0000-0x000000000943C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpg

MD5 e83ccb51ee74efd2a221be293d23c69a
SHA1 4365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256 da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA512 0252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46

memory/2352-31-0x00000000020E0000-0x0000000002116000-memory.dmp

memory/2352-32-0x0000000004B50000-0x0000000005178000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2A09.tmp

MD5 85e524cb1aac2e74fdd85af360903ff4
SHA1 309791f6a363bfa30114e431dac57ce72c8ab741
SHA256 57e799276e47aa1118575267b09f39424165ce815ebf47c9d5ec9a1a708039af
SHA512 22ea22681c737f28a123568781d927b936356d9015b3b2d9a40ef8b7e8835809dca308c696bf50e05358f2167b36b01d2d293ce0d5f688872fe22f54eae6b22d

memory/2352-34-0x0000000004A40000-0x0000000004A62000-memory.dmp

memory/2352-36-0x0000000005280000-0x00000000052E6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0xtgit14.ra0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3432-43-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1164-59-0x00000000726C0000-0x0000000072E70000-memory.dmp

memory/2352-35-0x0000000004AE0000-0x0000000004B46000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO.exe.log

MD5 b7b9acb869ccc7f7ecb5304ec0384dee
SHA1 6a90751c95817903ee833d59a0abbef425a613b3
SHA256 8cb00a15cd942a1861c573d86d6fb430512c8e2f80f6349f48b16b8709ca7aa4
SHA512 7bec881ac5f59ac26f1be1e7e26d63f040c06369de10c1c246e531a4395d27c335d9acc647ecdedb48ed37bdc2dc405a4cfc11762e1c00659a49be259eaf8764

memory/3432-61-0x0000000005F30000-0x0000000006548000-memory.dmp

memory/3432-62-0x00000000057D0000-0x00000000057E2000-memory.dmp

memory/3432-63-0x0000000005830000-0x000000000586C000-memory.dmp

memory/3432-64-0x0000000005870000-0x00000000058BC000-memory.dmp

memory/2352-65-0x00000000059F0000-0x0000000005A0E000-memory.dmp

memory/3432-66-0x0000000005AE0000-0x0000000005BEA000-memory.dmp

memory/2352-68-0x000000006FA60000-0x000000006FAAC000-memory.dmp

memory/2352-67-0x0000000006030000-0x0000000006062000-memory.dmp

memory/2352-78-0x0000000005FB0000-0x0000000005FCE000-memory.dmp

memory/412-80-0x000000006FA60000-0x000000006FAAC000-memory.dmp

memory/2352-79-0x0000000006C20000-0x0000000006CC3000-memory.dmp

memory/2352-90-0x0000000007350000-0x00000000079CA000-memory.dmp

memory/2352-91-0x0000000006D10000-0x0000000006D2A000-memory.dmp

memory/2352-92-0x0000000006D80000-0x0000000006D8A000-memory.dmp

memory/412-93-0x0000000007D50000-0x0000000007DE6000-memory.dmp

memory/2352-94-0x0000000006F10000-0x0000000006F21000-memory.dmp

memory/2352-95-0x0000000006F40000-0x0000000006F4E000-memory.dmp

memory/412-96-0x0000000007D10000-0x0000000007D24000-memory.dmp

memory/412-97-0x0000000007E10000-0x0000000007E2A000-memory.dmp

memory/2352-98-0x0000000007030000-0x0000000007038000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-19 01:02

Reported

2024-06-19 01:04

Platform

win7-20240221-en

Max time kernel

118s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe"

Signatures

GCleaner

loader gcleaner

Downloads MZ/PE file

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2156 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe C:\Windows\SysWOW64\cmd.exe
PID 2156 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe C:\Windows\SysWOW64\cmd.exe
PID 2156 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe C:\Windows\SysWOW64\cmd.exe
PID 2156 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe C:\Windows\SysWOW64\cmd.exe
PID 1600 wrote to memory of 2876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1600 wrote to memory of 2876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1600 wrote to memory of 2876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1600 wrote to memory of 2876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe

"C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c taskkill /im "a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe" & exit

C:\Windows\SysWOW64\taskkill.exe

taskkill /im "a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe" /f

Network

Country Destination Domain Proto
DE 185.172.128.90:80 185.172.128.90 tcp
RU 5.42.64.56:80 5.42.64.56 tcp
DE 185.172.128.69:80 185.172.128.69 tcp
RU 5.42.64.56:80 5.42.64.56 tcp

Files

memory/2156-1-0x00000000005D0000-0x00000000006D0000-memory.dmp

memory/2156-3-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2156-2-0x0000000000220000-0x000000000025C000-memory.dmp

memory/2156-5-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2156-9-0x0000000010000000-0x000000001001C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\advdlc[1].htm

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

memory/2156-17-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2156-21-0x00000000005D0000-0x00000000006D0000-memory.dmp

memory/2156-25-0x0000000000400000-0x0000000000440000-memory.dmp

\Users\Admin\AppData\Local\Temp\77O88e5DN0UO\Y-Cleaner.exe

MD5 0151e006443174af2f2ea167eb3317fe
SHA1 4867584b2bb6a5d5b9082a5a1b5d2d571eed7ce2
SHA256 af722c86835a47bbb5913361b0cedd00288aa23edd04709460902e4cc04be497
SHA512 f8ab571eece442e2c50574420165cb5beeeced3d8561b645c7f771fd28d499fb77bede7c49be1777ee6edf57f86efb6f43614415aa69837cfc1620cca9211d7b

memory/2156-35-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2156-37-0x00000000005D0000-0x00000000006D0000-memory.dmp

memory/2156-36-0x0000000000400000-0x0000000000440000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-19 01:02

Reported

2024-06-19 01:04

Platform

win10v2004-20240508-en

Max time kernel

141s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe"

Signatures

GCleaner

loader gcleaner

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe

"C:\Users\Admin\AppData\Local\Temp\a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 488

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 768

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 800

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 808

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1016

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 752

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
DE 185.172.128.90:80 tcp
DE 185.172.128.90:80 tcp
DE 185.172.128.90:80 tcp
DE 185.172.128.90:80 tcp
DE 185.172.128.90:80 tcp
DE 185.172.128.90:80 tcp

Files

memory/2484-2-0x00000000005C0000-0x00000000005FC000-memory.dmp

memory/2484-1-0x00000000007C0000-0x00000000008C0000-memory.dmp

memory/2484-3-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2484-4-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2484-6-0x00000000007C0000-0x00000000008C0000-memory.dmp

memory/2484-7-0x00000000005C0000-0x00000000005FC000-memory.dmp

memory/2484-8-0x0000000000400000-0x0000000000440000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-19 01:02

Reported

2024-06-19 01:04

Platform

win7-20240508-en

Max time kernel

119s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\DtcHF = "C:\\Users\\Admin\\AppData\\Roaming\\DtcHF\\DtcHF.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A ip-api.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2008 set thread context of 2984 N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2008 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2008 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2008 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2008 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2008 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2008 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2008 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2008 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe

"C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 8.8.8.8:53 ip-api.com udp

Files

memory/2008-10-0x0000000000120000-0x0000000000124000-memory.dmp

memory/2984-11-0x0000000000090000-0x00000000000D2000-memory.dmp

memory/2984-20-0x0000000000090000-0x00000000000D2000-memory.dmp

memory/2984-17-0x0000000000090000-0x00000000000D2000-memory.dmp

memory/2984-13-0x0000000000090000-0x00000000000D2000-memory.dmp

memory/2984-21-0x000000007462E000-0x000000007462F000-memory.dmp

memory/2984-22-0x0000000074620000-0x0000000074D0E000-memory.dmp

memory/2984-23-0x000000007462E000-0x000000007462F000-memory.dmp

memory/2984-24-0x0000000074620000-0x0000000074D0E000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-19 01:02

Reported

2024-06-19 01:04

Platform

win7-20240611-en

Max time kernel

118s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2228 set thread context of 2512 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2228 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\SysWOW64\schtasks.exe
PID 2228 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\SysWOW64\schtasks.exe
PID 2228 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\SysWOW64\schtasks.exe
PID 2228 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\SysWOW64\schtasks.exe
PID 2228 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2228 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2228 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2228 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2228 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2228 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2228 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2228 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2228 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe

"C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\INbHjZ.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\INbHjZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9DE5.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 104.26.12.205:443 api.ipify.org tcp

Files

memory/2228-0-0x00000000748AE000-0x00000000748AF000-memory.dmp

memory/2228-1-0x0000000000330000-0x00000000003EA000-memory.dmp

memory/2228-2-0x00000000748A0000-0x0000000074F8E000-memory.dmp

memory/2228-3-0x00000000003F0000-0x000000000040A000-memory.dmp

memory/2228-4-0x00000000002A0000-0x00000000002B0000-memory.dmp

memory/2228-5-0x0000000005400000-0x0000000005484000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp9DE5.tmp

MD5 59856fb046d60c00af715e210842795a
SHA1 ffa548095e5c7399cb0fa3047fb7877f34dbce6e
SHA256 7b2a41f72c5f402ceeda8c1852f1b6f525f571385f09a1f2b651d9ee343d8ee1
SHA512 7b4e2fde5d5bb0eca84654f1cf81d4aa9f7ca24c9a1acf0121d79a8df7557d69b291cbc3fcec9c3cbab5515ba78c57089e4b06450e3a399e119a74fbf3deaa5f

memory/2512-13-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2512-22-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2512-24-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2512-23-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2512-21-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2512-19-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2512-17-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2512-15-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2228-25-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-19 01:02

Reported

2024-06-19 01:04

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3920 set thread context of 2620 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3920 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3920 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3920 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3920 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\SysWOW64\schtasks.exe
PID 3920 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\SysWOW64\schtasks.exe
PID 3920 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\SysWOW64\schtasks.exe
PID 3920 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3920 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3920 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3920 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3920 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3920 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3920 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3920 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe

"C:\Users\Admin\AppData\Local\Temp\f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\INbHjZ.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\INbHjZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7DFA.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 52.111.229.48:443 tcp

Files

memory/3920-0-0x000000007501E000-0x000000007501F000-memory.dmp

memory/3920-1-0x00000000001E0000-0x000000000029A000-memory.dmp

memory/3920-2-0x0000000005270000-0x0000000005814000-memory.dmp

memory/3920-3-0x0000000004CC0000-0x0000000004D52000-memory.dmp

memory/3920-4-0x0000000004CA0000-0x0000000004CAA000-memory.dmp

memory/3920-6-0x0000000075010000-0x00000000757C0000-memory.dmp

memory/3920-5-0x0000000004F50000-0x0000000004FEC000-memory.dmp

memory/3920-7-0x0000000005060000-0x000000000507A000-memory.dmp

memory/3920-8-0x0000000004F20000-0x0000000004F30000-memory.dmp

memory/3920-9-0x00000000062C0000-0x0000000006344000-memory.dmp

memory/4672-14-0x0000000000E30000-0x0000000000E66000-memory.dmp

memory/4672-16-0x0000000004D50000-0x0000000005378000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp7DFA.tmp

MD5 bb7602c401a7e79919dd0bfe616e679a
SHA1 eca9550984818b7342ba1417edc4d902ec585bdf
SHA256 a049b863895639152506761d03dda99d1c2bae9eb6b64457d0710e9aaeb1a7c4
SHA512 e5b8aa290a5261136e6c16a64438c1a4bf21aa2d646da18d61b82192f0395c0084c9a201d4edbf8601910604ebd9aed0de176d37c86dd79a16630e16faacccee

memory/4672-17-0x0000000075010000-0x00000000757C0000-memory.dmp

memory/4672-18-0x0000000075010000-0x00000000757C0000-memory.dmp

memory/4672-19-0x0000000075010000-0x00000000757C0000-memory.dmp

memory/2620-20-0x0000000000400000-0x0000000000442000-memory.dmp

memory/4672-23-0x0000000005590000-0x00000000055F6000-memory.dmp

memory/4672-22-0x0000000005470000-0x00000000054D6000-memory.dmp

memory/2620-25-0x0000000075010000-0x00000000757C0000-memory.dmp

memory/3920-27-0x0000000075010000-0x00000000757C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ct0310q3.ery.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4672-26-0x0000000005600000-0x0000000005954000-memory.dmp

memory/4672-21-0x0000000004C00000-0x0000000004C22000-memory.dmp

memory/2620-37-0x0000000075010000-0x00000000757C0000-memory.dmp

memory/4672-38-0x0000000005BC0000-0x0000000005BDE000-memory.dmp

memory/4672-39-0x0000000005C50000-0x0000000005C9C000-memory.dmp

memory/4672-41-0x0000000071300000-0x000000007134C000-memory.dmp

memory/4672-40-0x0000000006BA0000-0x0000000006BD2000-memory.dmp

memory/4672-51-0x0000000006180000-0x000000000619E000-memory.dmp

memory/4672-52-0x0000000006BE0000-0x0000000006C83000-memory.dmp

memory/4672-54-0x0000000006EE0000-0x0000000006EFA000-memory.dmp

memory/4672-53-0x0000000007520000-0x0000000007B9A000-memory.dmp

memory/4672-55-0x0000000006F50000-0x0000000006F5A000-memory.dmp

memory/4672-56-0x0000000007160000-0x00000000071F6000-memory.dmp

memory/4672-57-0x00000000070E0000-0x00000000070F1000-memory.dmp

memory/4672-58-0x0000000007120000-0x000000000712E000-memory.dmp

memory/4672-59-0x0000000007130000-0x0000000007144000-memory.dmp

memory/4672-60-0x0000000007220000-0x000000000723A000-memory.dmp

memory/4672-61-0x0000000007200000-0x0000000007208000-memory.dmp

memory/4672-64-0x0000000075010000-0x00000000757C0000-memory.dmp

memory/2620-65-0x0000000006870000-0x00000000068C0000-memory.dmp

memory/2620-66-0x0000000075010000-0x00000000757C0000-memory.dmp