Malware Analysis Report

2024-08-06 13:18

Sample ID 240704-x7zb1axdkb
Target 1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd
SHA256 1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd
Tags
azorult quasar ebayprofiles infostealer spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd

Threat Level: Known bad

The file 1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd was found to be: Known bad.

Malicious Activity Summary

azorult quasar ebayprofiles infostealer spyware trojan

Quasar family

Quasar payload

Azorult

Quasar RAT

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Maps connected drives based on registry

Looks up external IP address via web service

Enumerates connected drives

AutoIT Executable

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Runs ping.exe

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Persistence
TA0003
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Peripheral Device Discovery
T1120
Remote System Discovery
T1018
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-04 19:30

Signatures

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-04 19:30

Reported

2024-07-04 19:33

Platform

win10v2004-20240704-en

Max time kernel

4s

Max time network

69s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe"

Signatures

Azorult

trojan infostealer azorult

Quasar RAT

trojan spyware quasar
Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A ip-api.com N/A N/A

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\windef.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2904 set thread context of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\windef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2904 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 2904 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 2904 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 5076 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 5076 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 2904 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 2904 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 2904 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 5076 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 2904 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe
PID 2904 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe
PID 2904 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe
PID 2904 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe
PID 2904 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe
PID 2904 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2904 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2904 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1420 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\windef.exe C:\Windows\SysWOW64\schtasks.exe
PID 1420 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\windef.exe C:\Windows\SysWOW64\schtasks.exe
PID 1420 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\windef.exe C:\Windows\SysWOW64\schtasks.exe
PID 1420 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\windef.exe C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe
PID 1420 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\windef.exe C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe
PID 1420 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\windef.exe C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe
PID 1536 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe C:\Windows\SysWOW64\schtasks.exe
PID 1536 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe C:\Windows\SysWOW64\schtasks.exe
PID 1536 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe

"C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe"

C:\Users\Admin\AppData\Local\Temp\vnc.exe

"C:\Users\Admin\AppData\Local\Temp\vnc.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k

C:\Users\Admin\AppData\Local\Temp\windef.exe

"C:\Users\Admin\AppData\Local\Temp\windef.exe"

C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe

"C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5076 -ip 5076

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 548

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe

"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xR3Dpo7P6p9h.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1536 -ip 1536

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 2276

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe

"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

C:\Users\Admin\AppData\Local\Temp\vnc.exe

"C:\Users\Admin\AppData\Local\Temp\vnc.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k

C:\Users\Admin\AppData\Local\Temp\windef.exe

"C:\Users\Admin\AppData\Local\Temp\windef.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4528 -ip 4528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 520

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\sihost.exe

sihost.exe

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

Network

Country Destination Domain Proto
US 8.8.8.8:53 0x21.in udp
US 44.221.84.105:8000 0x21.in tcp
US 8.8.8.8:53 0x21.in udp
US 44.221.84.105:8000 0x21.in tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
RU 5.8.88.191:443 tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 sockartek.icu udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
RU 5.8.88.191:443 tcp
US 8.8.8.8:53 sockartek.icu udp

Files

C:\Users\Admin\AppData\Local\Temp\vnc.exe

MD5 b8ba87ee4c3fc085a2fed0d839aadce1
SHA1 b3a2e3256406330e8b1779199bb2b9865122d766
SHA256 4e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA512 7a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2

C:\Users\Admin\AppData\Local\Temp\windef.exe

MD5 b4a202e03d4135484d0e730173abcc72
SHA1 01b30014545ea526c15a60931d676f9392ea0c70
SHA256 7050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512 632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb

memory/4824-27-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2904-28-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

memory/4824-19-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1420-29-0x0000000072FCE000-0x0000000072FCF000-memory.dmp

memory/1420-32-0x0000000000860000-0x00000000008BE000-memory.dmp

memory/1420-33-0x00000000058C0000-0x0000000005E64000-memory.dmp

memory/1420-34-0x0000000005200000-0x0000000005292000-memory.dmp

memory/1420-35-0x0000000005310000-0x0000000005376000-memory.dmp

memory/1420-36-0x0000000005E90000-0x0000000005EA2000-memory.dmp

memory/1420-37-0x00000000063D0000-0x000000000640C000-memory.dmp

memory/1536-45-0x0000000006980000-0x000000000698A000-memory.dmp

memory/2904-46-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xR3Dpo7P6p9h.bat

MD5 f96cc771fea336419e0bbcfdd4f80116
SHA1 3acb62b23791a7a84f7491d76949e296d7157ba2
SHA256 4fff2face606b18284ff0dadbb318a3b7b2d06d008f41dc3634674f8fcb6e403
SHA512 4a49facf6325d2559d599841b11f0ab2489fef0c6ab76cb17a084fd500852834cda60a77a40d95292374fe932a34c8d56327ef3cd545d30ec8609f118cff7a24

C:\Users\Admin\AppData\Roaming\Logs\07-04-2024

MD5 1541832304ffda40d3fda142f2f62ada
SHA1 77c5623453476e2ef2417f863bdb7d437d3297cb
SHA256 30b31387895ab73cbbf19e58abc380234d115fc1573a02345c41dd2c63d3add5
SHA512 4673793e126a32cfc276366c59243cf15fb25a4f215c301cac67b46043a4d899d3d0a5db7f64537c53ea5a74a71511b3e97ceeae54f77423b9cc189af25fa776

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

MD5 afa7d6eefbd231a43811eac2ba9e91af
SHA1 c1ad459a373844024a5255b672f344ac40315d0c
SHA256 e3f973cb48daf691517a81aed9db4c2a5d10701570891beb2cd54607ab2c5eb7
SHA512 9b92ccf0a024ef5248c52d761f97558b597636bec40f10bd81050f3d410b96bbd896763c4f9ac39a812f0e9bbcb9f22dc63dff83934fafa4aad76975a5d141c5

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windef.exe.log

MD5 10eab9c2684febb5327b6976f2047587
SHA1 a12ed54146a7f5c4c580416aecb899549712449e
SHA256 f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA512 7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-04 19:30

Reported

2024-07-04 19:33

Platform

win7-20240508-en

Max time kernel

4s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe"

Signatures

Azorult

trojan infostealer azorult

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\windef.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\windef.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Windows\system32\svchost.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2164 set thread context of 2080 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 1700 set thread context of 2696 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\windef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1700 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 1700 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 1700 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 1700 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 2164 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 2164 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 2164 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 2164 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 1700 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 1700 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 1700 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 2164 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe
PID 1700 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe
PID 1700 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe
PID 1700 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe
PID 1700 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe
PID 2164 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe
PID 1700 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1700 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1700 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1700 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2164 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 2316 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\windef.exe C:\Windows\SysWOW64\schtasks.exe
PID 2316 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\windef.exe C:\Windows\SysWOW64\schtasks.exe
PID 2316 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\windef.exe C:\Windows\SysWOW64\schtasks.exe
PID 2316 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\windef.exe C:\Windows\SysWOW64\schtasks.exe
PID 2316 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\windef.exe C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe
PID 2316 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\windef.exe C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe
PID 2316 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\windef.exe C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe
PID 2316 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\windef.exe C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe

"C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe"

C:\Users\Admin\AppData\Local\Temp\vnc.exe

"C:\Users\Admin\AppData\Local\Temp\vnc.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k

C:\Users\Admin\AppData\Local\Temp\windef.exe

"C:\Users\Admin\AppData\Local\Temp\windef.exe"

C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe

"C:\Users\Admin\AppData\Local\Temp\1db1e0377cc6b828f9ddd191788d026e657e7d15c304aad019f8d746dfc9bfdd.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe

"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f

C:\Windows\system32\taskeng.exe

taskeng.exe {4E5FC7EE-1699-4612-973E-AB53BCBF6128} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

C:\Users\Admin\AppData\Local\Temp\vnc.exe

"C:\Users\Admin\AppData\Local\Temp\vnc.exe"

C:\Users\Admin\AppData\Local\Temp\windef.exe

"C:\Users\Admin\AppData\Local\Temp\windef.exe"

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k

Network

Country Destination Domain Proto
RU 5.8.88.191:8080 tcp
US 8.8.8.8:53 0x21.in udp
US 44.221.84.105:8000 0x21.in tcp
US 8.8.8.8:53 0x21.in udp
US 44.221.84.105:8000 0x21.in tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
RU 5.8.88.191:443 tcp
RU 5.8.88.191:8080 tcp
RU 5.8.88.191:8080 tcp
RU 5.8.88.191:8080 tcp
RU 5.8.88.191:8080 tcp
RU 5.8.88.191:8080 tcp

Files

\Users\Admin\AppData\Local\Temp\vnc.exe

MD5 b8ba87ee4c3fc085a2fed0d839aadce1
SHA1 b3a2e3256406330e8b1779199bb2b9865122d766
SHA256 4e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA512 7a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2

\Users\Admin\AppData\Local\Temp\windef.exe

MD5 b4a202e03d4135484d0e730173abcc72
SHA1 01b30014545ea526c15a60931d676f9392ea0c70
SHA256 7050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512 632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb

memory/2316-30-0x00000000742AE000-0x00000000742AF000-memory.dmp

memory/2316-31-0x0000000000F50000-0x0000000000FAE000-memory.dmp

memory/2080-54-0x0000000000420000-0x00000000004BC000-memory.dmp

memory/2080-53-0x0000000000420000-0x00000000004BC000-memory.dmp

memory/2080-52-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2080-46-0x0000000000420000-0x00000000004BC000-memory.dmp

memory/2696-43-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2080-41-0x000007FFFFFDA000-0x000007FFFFFDB000-memory.dmp

memory/2080-37-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2696-34-0x0000000000080000-0x00000000000A0000-memory.dmp

memory/2696-32-0x0000000000080000-0x00000000000A0000-memory.dmp

memory/2696-51-0x0000000000080000-0x00000000000A0000-memory.dmp

memory/2904-66-0x00000000003D0000-0x000000000042E000-memory.dmp

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

MD5 0da80bf97e2a3b77cd46f1042300e0a3
SHA1 f9426a6004c52561fd875c9f9db4010789fb74f0
SHA256 f123061ff6f733d7c0b9742b8b2b2d83fba769d962a4f9355fe9582e4dc198d6
SHA512 e186396cfdc9797b336050f177c787afff93aef90ed4051ad8f6ad307ff1e4ac5ed0e21ff762ef1e7ced5fd4230b84ba71edbe0d8d01c67983d1e6d1f04001fa

C:\Users\Admin\AppData\Local\Temp\vnc.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2024-107-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/3012-101-0x0000000001060000-0x00000000010BE000-memory.dmp