Malware Analysis Report

2025-01-02 15:18

Sample ID 240625-vh8g9ssarf
Target e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3
SHA256 e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3
Tags
gh0strat purplefox persistence rat rootkit trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3

Threat Level: Known bad

The file e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3 was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox persistence rat rootkit trojan upx

Gh0st RAT payload

Gh0strat

PurpleFox

Detect PurpleFox Rootkit

Sets service image path in registry

Server Software Component: Terminal Services DLL

Drops file in Drivers directory

Executes dropped EXE

Checks computer location settings

UPX packed file

Loads dropped DLL

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 17:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 17:00

Reported

2024-06-25 17:03

Platform

win7-20240508-en

Max time kernel

150s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatfor.exe N/A

Server Software Component: Terminal Services DLL

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\259404437.txt" C:\Users\Admin\AppData\Local\Temp\R.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatfor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File created C:\Windows\SysWOW64\259404437.txt C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\R.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74DC8411-3314-11EF-9DB4-7A4B76010719} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425496710" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000d9d001d44dd5f5b4d0def80e994ad5885cc78b54db7e0c429f5eface7487d396000000000e800000000200002000000057f38ff139df8aeaf844898808a3992ffd1816b4b0a5ad3ef73d1e73b79bfad12000000008e2725233cbda1f45f9812a0abd2adc27cf801dbf54ac09cdf2c2c6c7019262400000003afb08cf82ab8a244149e6dd7b838430ba42986ed03db62d0145ac74c95abc860f6dac74abfb1c3455aea3626ed8fc66e3fe9cabfc0b362fc10e5c7418211a9c C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e65e8821c7da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000004beda06d790df11aa0e1e7951f5393c6829a5639727eedd10ef0e2196d788353000000000e8000000002000020000000ee504da1452201a7f74a37581a83b2dd94725ba44ad25c5804eace52f1fc7465900000005aab6c01d3a90baf32f1086baa374e2a44ca94b8b932389c8ad8d9e496738bf10484a390f2961094fa8fbd3d1333549e336f1edcfc627d54375a3fa17c43e07ca697d99d23b7bf27eb1d5c08a00ef6355f6c2d0dfd7ca0bd081c9aebddd00c4bcc180fa29fd51064bd29c9133b3d38e929c1224faf94d1643788158e8747c664d3b518659a3abb0f177b2ec6152a9dfd40000000b59f420d8c385480148bd7c9a4123e94b568daa440eea537aa981c1fee19e4709b179103296027840c35a14ee711b9650924350d1245f475b207322857f021fe C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1192 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 1192 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 1192 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 1192 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 1192 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 1192 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 1192 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 1192 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 1192 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 1192 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 1192 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 1312 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 1312 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 1312 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 1312 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 1192 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe
PID 1192 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe
PID 1192 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe
PID 1192 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe
PID 2364 wrote to memory of 2504 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2364 wrote to memory of 2504 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2364 wrote to memory of 2504 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2364 wrote to memory of 2504 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2364 wrote to memory of 2504 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2364 wrote to memory of 2504 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2364 wrote to memory of 2504 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2732 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2732 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2732 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2732 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2928 wrote to memory of 2896 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 2928 wrote to memory of 2896 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 2928 wrote to memory of 2896 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 2928 wrote to memory of 2896 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 2820 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2820 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2820 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1960 wrote to memory of 1568 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1960 wrote to memory of 1568 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1960 wrote to memory of 1568 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1960 wrote to memory of 1568 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe

"C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe"

C:\Users\Admin\AppData\Local\Temp\R.exe

C:\Users\Admin\AppData\Local\Temp\\R.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Users\Admin\AppData\Local\Temp\N.exe

C:\Users\Admin\AppData\Local\Temp\\N.exe

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul

C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe

C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\SysWOW64\Remote Data.exe

"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\259404437.txt",MainThread

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://chrome.360.cn/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 chrome.360.cn udp
US 8.8.8.8:53 chrome.360.cn udp
GB 174.35.118.62:80 chrome.360.cn tcp
GB 174.35.118.62:80 chrome.360.cn tcp
US 8.8.8.8:53 browser.360.cn udp
CN 111.6.185.228:80 browser.360.cn tcp
CN 111.6.185.228:80 browser.360.cn tcp
CN 120.226.0.228:80 browser.360.cn tcp
CN 120.226.0.228:80 browser.360.cn tcp
CN 111.47.229.228:80 browser.360.cn tcp
CN 111.47.229.228:80 browser.360.cn tcp
CN 1.193.215.228:80 browser.360.cn tcp
CN 1.193.215.228:80 browser.360.cn tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
CN 120.226.150.228:80 browser.360.cn tcp
CN 120.226.150.228:80 browser.360.cn tcp

Files

\Users\Admin\AppData\Local\Temp\R.exe

MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

\Windows\SysWOW64\259404437.txt

MD5 da7a54773743d8584f9562cdfa7835df
SHA1 947612f47cca725809e4de0ea359fcd12d08a05d
SHA256 3cd457fb92077b42bc38761cb5697b66e76d8c4057a41d90559008b77d52de5a
SHA512 42ab71e771e9d7f2d029210c22150821e3cb38eb5166c8f64c0ea0d147d3bb058b61897f14a473a33648631b1cdaa577cef19ea5710d136f54930eb50e34bd76

\Users\Admin\AppData\Local\Temp\N.exe

MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

memory/1312-20-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1312-21-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1312-18-0x0000000010000000-0x00000000101B6000-memory.dmp

\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe

MD5 45561734384d752ae2d42aafd3095371
SHA1 2d13332e1d7c7d7c05b83fd9661c1a9a1b863a06
SHA256 4ba5b26161e71cc1651beb0f2e6d707522e53e1799e7e9ef4ee37c995070266c
SHA512 12eb4c565e0443ab533bac4286ad39259b2b0deb033539dba7970e60bf88803c77dfe3c87e3251aa0dd13618a165f1948b980aa7cea5fad4f86ddd398c51a516

memory/2504-44-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2504-43-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2504-42-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2504-40-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2504-47-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2504-49-0x0000000010000000-0x00000000101B6000-memory.dmp

\Windows\SysWOW64\Remote Data.exe

MD5 51138beea3e2c21ec44d0932c71762a8
SHA1 8939cf35447b22dd2c6e6f443446acc1bf986d58
SHA256 5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512 794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

C:\Users\Admin\AppData\Local\Temp\Cab4D38.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar4DBC.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ef78c914246d25ae6ff2be534583044c
SHA1 7672d40c4250a31208fe024c93abed5ba7d6527d
SHA256 d324d6733b8ae985152bd6ba6fe8096a61b1a8d876355cf1e13f38fe877720e2
SHA512 cd6d3bd1480fcb248acd2b3d1bf937f35122a302c5d9042ef053d1a3df6361668857da6676656bf13207c460b01e6e9fe0eef51eeb7a68d0234ec954c21cd538

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c7332c52cd90243d1b36c34940466875
SHA1 5b859f07a6e5f0ba2c0d6fe4dd8cd9a9222488cf
SHA256 298575e7ce6ffc53ffdd72b0f9222f801d5ed48e15870a135cf68731afad63a7
SHA512 5f277c59a3ea20ad2108fe2129da35b3e2a1afdfb1b75d56456b83b99f4e190b848cab6d928269ec64fd73f89690de2593eba0b81d31a107c8e911713dbd04c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 685a2d2501b0519bef4ffbeedd2760f6
SHA1 bc046386f785ece733096c6931148e7929c66a7f
SHA256 cd7083a73bafe6dfa5593f997869519c11ef96ce34588c6ce2d543e768fbe18a
SHA512 afbf0c1b554543b1da880d82ca5fe3f96ec59e024859806146d5bf3a73051dd671df2a037632a30991aa338df1663950aae36b7c8abda637b5c2cfe8d7f24692

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 453f1a21e288efdf3be5bc00df254635
SHA1 0cfb443a061503be85eaa0a9cbf3c9ce2e31d9dc
SHA256 987dd3522da24b008a41eccc34c1f8a1611f6767444cfca0f60670d4bd4ad224
SHA512 08df872a0856e3b5edb8ae1edf41cebbc6b468a6ffa28de7ec4f39558d74ce0d6f28c873075fe4643ea3de99e02033751a986d647863a67aecc48c300ed8b38a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c07908b1640e16704d8c47dadd7cbf21
SHA1 81035c99222ed57a84e5825452ef35ee58616c13
SHA256 21f923c4bfd3267b8bfad45e1225269a21dabe2367297d3a426aeef9f3987ff1
SHA512 73b757d52d442691412e68914839fc06d986d6a83dbc288736af98d02c1c3f760489bea2a57dbed0a6f41a8e39a9bbde24d0a3eb868d451e380dc308eb454af1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2e84d0ad13834c343d68804aa82ced60
SHA1 93e6d6b8db28bc52379cffc81d0b4015932711ca
SHA256 71394d271c2d32170ba8979e9bca7bd68c169b917e1ade8e44b9362a8b85ae0a
SHA512 1dec56ea1cfc3d6512c9c1bf7074a0a7be84f6a45dbcbc0c2b5139cbd34895eaf6aec7f0e0dd16ed357453d8af25eef0256e633dc8153c6267b3bf331673d154

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c484aeb685be0c0cde92c21a3c722dad
SHA1 194b43d0040a2a7ee3052c0cadaa4020e8b8e38e
SHA256 d036092bd5da6ba808d0e7da310c9fdb245984a4b9636821afee08ddc829bd0e
SHA512 241c3e2f4661fb8ee7ea7748d91953a9d48fa5f9cb35dc8b883084076883235b8feda3e5c01aba42025fd4fa7b348de78830daccaaaec466077223c50640fcd0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3e9b4aae9b58d86b1af39952fee7e5d0
SHA1 64dfe63cedde81afe1b873c2cb52625c5f29befd
SHA256 abaa00100ef15e9a940a949ae5e2ae9a8cd419326eecf267cef8151c4505274e
SHA512 b3f680e5a9944b2db7639368c78826f08c8609834e61914e5456de35f2e8bbd36f756332f11a0fc13c8f832ed3e7269a80abb31b52b2fd464e9036390a6da864

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 4a5bd4c8fff453a9f17d69b33d81a6f4
SHA1 4cd023f66549978efa6a8abeccddcbfd4b856de5
SHA256 1114c73158da100c2bca046fe0e1d6b62759cd875071092ca5ec1176218fe46e
SHA512 6b5190080c916a770ac696f4d2b535848b55201439d399a613e69c01188fce6dea0c1af626d6e60851300d634968d4c17da4df21208754a6d1054a71dbc2c923

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 51a02da54acccb2fa1461725acc8d3d6
SHA1 3ad83dda4bab182bca574183b305f02f37575c95
SHA256 120f09a7b49eb235239bd2d497023d4f439f1be3a0bdda022d1188d3cbd8d1c5
SHA512 f7da0514f82b7b0f3fd644f211a2b0e00ff179e2425e145b7fde4e9e4b97bb5d6422f77d4052c0a7bf32cf0bef9196f815e7085a0f4bcf72188b84ff632cae97

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0aa88bfc8b9f0e6dff17924d38c25c4b
SHA1 e85f9a7dc56fa7b13d7d5b3dbf3c3252da326d68
SHA256 8a84b4ab4e55ced18928d508c51b469d2f4d54031bc5691020c905890b7551b9
SHA512 7ae7cbeda092cfccc08914a2fe691b06de822fbedfaa0faa67090b95819c7ef790d79b0c8d3f9e5cbd4c29865d143f506f8147eeca61e2759824a301eaca1a47

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6c8a917378c8c3bfe32e104a4c0c0239
SHA1 ebe73a1b25f1c937d633546e88345d61a20e2abd
SHA256 75a21cbcc1206f54bfd316174bb74530114b3384b6a5029e1549ce216c17216a
SHA512 e73582bcd991a831f9116943ebad6621a349f2db571b75097ed33d4e26cf4828b71da2193bc107d7a9b0723d40c754b241a0ca5dc280713af67c1a3aedcabfa1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f76df7aaa16e480527cb75f5040582b0
SHA1 e5dd72d41a5567bbb7f0781842f324ac75b1840e
SHA256 9e70aea4def9f6d0c875008e6ba572e9c96e7299fd45b2dbda136426d59ae65b
SHA512 b3f7921067041090d0dc15afba7f2a9899d65e451d722401dec4d2155b96a583e507dcf5ffb2d7e96233f1ccfbd5b7b76fdee675f7281e0c406138ac6630c0ed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bd48a591da06630f78147150d02e9a51
SHA1 c8ee4b1a9acfb31bb8c2b0429936c29e6ecdc226
SHA256 10d016f3939c74101103fa994154acd149f725e07fccc90dd15fb3b71e82abed
SHA512 b676a0233ace01bf0584868df1398b9e31f1c0a90843a3f4940533c7e08127a5f84ee7c92ea71ae12019355f83c75e84fd59defae5ff0e86c06dad92280711fe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 14cd9b4cf96910d67c960c2798efc5bb
SHA1 f2d3c96c558941f02ffd81e0ae8b233f4cfe032d
SHA256 53628284b5a7000b3857f35120e08b8f31c0b271b952b48e3838939e647e2b10
SHA512 747505b643793672dc986c3b20a33f93450e2fd0a65c02eb4644accdc40a0503bcb2a9c5713c76908c1c7fd9885e977582a6dd721e5031b77f2d07c0f06e7a2a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9226f100607ea9ae0c927107a16edb87
SHA1 34843d7fe9385f327edd50e59abbbda959ca09bc
SHA256 bcd7cc7d29e2dd0a5b7398a84182d3879a09c8acdb5843001272a61e0ad5d03f
SHA512 eb10773467a189a7ccf659bb58246bef705e148ec08251a4b500cd85fb95c190db7e258eb7148e519be15b44464ba9f5974cdaebfb9778f31e1b8db41ace6115

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2f733887b6ed423cc446c529c3675371
SHA1 55bc177e6d28d74a7434e81021c901630271bf4f
SHA256 7b1588a177f30b4fca6de458aeeaba9981228542337bc2044686dd56c3d81367
SHA512 b9f4cd11949156bcd2a110084b9e998176578a42431f837af135d67b38547f09c25c54e8f4acfb6ddd3b6f1f987e68b89790416460b9ef1b91d65a5899bcf8a7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eff5398e881716513fc01eecf64b5bc6
SHA1 370288d3291cb372c336b59f5fbb32822182e795
SHA256 40a0af387e209a85f0ff5cf3fcd89ddcd57552ffe2b1f4deaedc461e4209e9af
SHA512 21497271139df3571729398fc6aaa46b3092f2507b7b6f86c0675afdb08e592d6e27bb051f68fb04fd63b105570cbcfedbf05a4753015c822547527fb0d5bc3e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 69b5dad900f8bb1c6c7aba3b6d45fbde
SHA1 b70967d311410439d9d6c0772e2e02056e9364a4
SHA256 0e511c8730a53dca0d1dcecf56543a3a768b59864ce11764b209907c1b4115dc
SHA512 eb973e0c1c6b0c4b39d6509294affcdc1fda5e815b636c6112f32e0820b21edd703fb354763a83600d14f3050a27cfa522c4569a143ac57bb2257570da480de1

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 17:00

Reported

2024-06-25 17:03

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatfor.exe N/A

Server Software Component: Terminal Services DLL

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240602828.txt" C:\Users\Admin\AppData\Local\Temp\R.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatfor.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\R.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\Remote Data.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File created C:\Windows\SysWOW64\240602828.txt C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File created C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d651e1763920bb4d949d709c9307976a00000000020000000000106600000001000020000000d5597eedba1409161eda506e9135a9a41bb1e41f44d753c8ca24c9ea95afa596000000000e8000000002000020000000e7caf158d8f9c74e4ab9ad2c74d05e594d5ba5af90482a5a5a62d48d694dcb9220000000daafe9fd4f2a55f39e04a13e9ab072a8303d32ae48a1881eef3bb0914c94079a40000000383904cfed8273d2a427841bd1243fddc9c611289a6b541872d2025753a9707ecd004d8e1f095eabaa0dea7fb3eb693ecce441d84ff0de6f78401f63190ae76c C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1241330714" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115041" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115041" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{75796E55-3314-11EF-B1BA-5AE3054E25D0} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115041" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426099818" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115041" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1243205706" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1241330714" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1243205706" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b6f05f21c7da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d651e1763920bb4d949d709c9307976a000000000200000000001066000000010000200000001bca62a6c7415b135dd1f93c39b041c2df73ced74ba0a927b76d4d8599e9bcc7000000000e80000000020000200000006e0e95e89a92e8cac7296a4c88fa03d2a6f888619c85b16ce17c7b5ef0ac9104200000008855d5a679e1e1d7468ab5ffb008c11b2e20ec1d97e76baf7631252aed5ac3374000000061057c4b4bdc0a21d181a0b9111b4574a12b339c08f10b4ebb21881f9e59149da461c459281387f5e4dac09bf5184f52ddd410b703536f34c1d03e3d8f1f77bd C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e7fe5f21c7da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2552 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2552 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2552 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2552 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2552 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2552 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 436 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 436 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 436 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 4100 wrote to memory of 4496 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 4100 wrote to memory of 4496 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 4100 wrote to memory of 4496 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2552 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe
PID 2552 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe
PID 4960 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4960 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4960 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4160 wrote to memory of 3504 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 4160 wrote to memory of 3504 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 4160 wrote to memory of 3504 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 2460 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2460 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3060 wrote to memory of 3216 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3060 wrote to memory of 3216 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3060 wrote to memory of 3216 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe

"C:\Users\Admin\AppData\Local\Temp\e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe"

C:\Users\Admin\AppData\Local\Temp\R.exe

C:\Users\Admin\AppData\Local\Temp\\R.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Users\Admin\AppData\Local\Temp\N.exe

C:\Users\Admin\AppData\Local\Temp\\N.exe

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe

C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\SysWOW64\Remote Data.exe

"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240602828.txt",MainThread

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://chrome.360.cn/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:17410 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
BE 88.221.83.210:443 www.bing.com tcp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 210.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 chrome.360.cn udp
GB 174.35.118.62:80 chrome.360.cn tcp
GB 174.35.118.62:80 chrome.360.cn tcp
US 8.8.8.8:53 browser.360.cn udp
CN 61.184.9.227:80 browser.360.cn tcp
CN 61.184.9.227:80 browser.360.cn tcp
US 8.8.8.8:53 62.118.35.174.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
CN 111.6.185.228:80 browser.360.cn tcp
CN 111.6.185.228:80 browser.360.cn tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
CN 120.226.150.228:80 browser.360.cn tcp
CN 120.226.150.228:80 browser.360.cn tcp
CN 61.163.171.161:80 browser.360.cn tcp
CN 61.163.171.161:80 browser.360.cn tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 3.166.122.92.in-addr.arpa udp
CN 36.158.204.228:80 browser.360.cn tcp
CN 36.158.204.228:80 browser.360.cn tcp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 chrome.360.cn udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 179.77.117.104.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 187.77.117.104.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp

Files

C:\Users\Admin\AppData\Local\Temp\R.exe

MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

C:\Windows\SysWOW64\240602828.txt

MD5 da7a54773743d8584f9562cdfa7835df
SHA1 947612f47cca725809e4de0ea359fcd12d08a05d
SHA256 3cd457fb92077b42bc38761cb5697b66e76d8c4057a41d90559008b77d52de5a
SHA512 42ab71e771e9d7f2d029210c22150821e3cb38eb5166c8f64c0ea0d147d3bb058b61897f14a473a33648631b1cdaa577cef19ea5710d136f54930eb50e34bd76

C:\Users\Admin\AppData\Local\Temp\N.exe

MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

memory/436-19-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/436-23-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/436-17-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/436-20-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4100-29-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4100-28-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4100-26-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_e5ee3b533022f8fbb04f061a3cc0be2a0c792d8e9db0e7fcce27b4f5419b7dd3.exe

MD5 45561734384d752ae2d42aafd3095371
SHA1 2d13332e1d7c7d7c05b83fd9661c1a9a1b863a06
SHA256 4ba5b26161e71cc1651beb0f2e6d707522e53e1799e7e9ef4ee37c995070266c
SHA512 12eb4c565e0443ab533bac4286ad39259b2b0deb033539dba7970e60bf88803c77dfe3c87e3251aa0dd13618a165f1948b980aa7cea5fad4f86ddd398c51a516

memory/4496-39-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4496-42-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4496-44-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 4a5bd4c8fff453a9f17d69b33d81a6f4
SHA1 4cd023f66549978efa6a8abeccddcbfd4b856de5
SHA256 1114c73158da100c2bca046fe0e1d6b62759cd875071092ca5ec1176218fe46e
SHA512 6b5190080c916a770ac696f4d2b535848b55201439d399a613e69c01188fce6dea0c1af626d6e60851300d634968d4c17da4df21208754a6d1054a71dbc2c923

C:\Windows\SysWOW64\Remote Data.exe

MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5 47ecaab3677b5f040df1651a5e519d62
SHA1 da7bd1738d96cec50e5920118425e878c9a2a4e9
SHA256 a98714f70e31110cdfedfbd5ab0825a964c718632a00b2ccb2e9eb8bd568dc3f
SHA512 18c2d5a3cfb905378a8f3ccd8f94267e41d3d10a8cd06929cc7d2abe0f3e0a4eb3127cffcef7e3d92371c88d67036f6c4b824b482569720109f75fa3d1543cfd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5 b9b9f42ce6d2b20bf169d05480d239d4
SHA1 32b094cc2ff79f07fcd68d585846b919bc350e4d
SHA256 4d16bb8c9a34d4de9d39bb5f0e87095617b5ad551112db17b38b6cb752fbdae4
SHA512 36b45c544439c6b1fab4c2fa58712475a65ad467e3da61086c4a953d6587d35f5c6ae7de740863295ae0d3534cbf67d0bed6843d95b6786b50431bfeebcf1010

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verE271.tmp

MD5 1a545d0052b581fbb2ab4c52133846bc
SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LU15KQ7Y\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee