Malware Analysis Report

2024-09-11 09:47

Sample ID 240705-cwd7gasflg
Target d6291f04688e967d0b4eb08effefcf3de896b2511684b5f57dd7bdb6a2921404
SHA256 d6291f04688e967d0b4eb08effefcf3de896b2511684b5f57dd7bdb6a2921404
Tags
redline sectoprat cheat execution infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d6291f04688e967d0b4eb08effefcf3de896b2511684b5f57dd7bdb6a2921404

Threat Level: Known bad

The file d6291f04688e967d0b4eb08effefcf3de896b2511684b5f57dd7bdb6a2921404 was found to be: Known bad.

Malicious Activity Summary

redline sectoprat cheat execution infostealer rat trojan

RedLine

RedLine payload

SectopRAT payload

SectopRAT

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Suspicious use of SetThreadContext

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Persistence
TA0003
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-05 02:25

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-05 02:25

Reported

2024-07-05 02:28

Platform

win7-20240704-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2408 set thread context of 2736 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2408 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2408 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2408 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2408 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2408 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2408 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2408 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2408 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2408 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\schtasks.exe
PID 2408 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\schtasks.exe
PID 2408 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\schtasks.exe
PID 2408 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\schtasks.exe
PID 2408 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
PID 2408 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
PID 2408 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
PID 2408 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
PID 2408 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
PID 2408 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
PID 2408 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
PID 2408 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
PID 2408 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe

"C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TmfmVKU.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF3B2.tmp"

C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe

"C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"

Network

Country Destination Domain Proto
NL 185.222.58.91:55615 185.222.58.91 tcp
US 8.8.8.8:53 api.ip.sb udp
US 172.67.75.172:443 api.ip.sb tcp

Files

memory/2408-0-0x000000007498E000-0x000000007498F000-memory.dmp

memory/2408-1-0x0000000000BB0000-0x0000000000C64000-memory.dmp

memory/2408-2-0x00000000004E0000-0x00000000004F0000-memory.dmp

memory/2408-3-0x0000000074980000-0x000000007506E000-memory.dmp

memory/2408-4-0x0000000000680000-0x000000000068C000-memory.dmp

memory/2408-5-0x0000000004790000-0x00000000047F0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 c8ad1da37b78b4dc105cc480bcc9e751
SHA1 d6cd76feb91b491172f1485f4200ba6aaf44ba28
SHA256 ebf7696278e38fc4e02e572240418e89d4e5d1efdf58f6e668de03ab44ea62db
SHA512 625387eb9f010b69eecc076b014612b854eca11061c1c6a0f8830c0a349c3cb839d24ae5205db905215413134177d191dc63ae85ece8bdfbf1e37c988f7698b9

C:\Users\Admin\AppData\Local\Temp\tmpF3B2.tmp

MD5 d7fbe42bd6766fb1af96671938ba2232
SHA1 a77caa10488b92e02a56fc0dac42976cf3209f22
SHA256 c395331ab7095305c3526b6f7736adc08466b5a0becbf18ac5bbde06f0ebf16f
SHA512 3cbedcfe7511312decc9d3cc2285099ad1dd2c3e9a01299ee173f8901d9c009e0de4074e6ea42512336c567076e538c82f801d8302873e873d65d2cbff645c03

memory/2736-27-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2736-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2736-24-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2736-22-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2736-20-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2736-18-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2736-28-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2736-29-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2408-30-0x0000000074980000-0x000000007506E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-05 02:25

Reported

2024-07-05 02:28

Platform

win10v2004-20240704-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5052 set thread context of 4436 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5052 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5052 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5052 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5052 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5052 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5052 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5052 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\schtasks.exe
PID 5052 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\schtasks.exe
PID 5052 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Windows\SysWOW64\schtasks.exe
PID 5052 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
PID 5052 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
PID 5052 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
PID 5052 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
PID 5052 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
PID 5052 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
PID 5052 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
PID 5052 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe

"C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TmfmVKU.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE261.tmp"

C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe

"C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
NL 185.222.58.91:55615 185.222.58.91 tcp
US 8.8.8.8:53 91.58.222.185.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 172.67.75.172:443 api.ip.sb tcp
US 8.8.8.8:53 172.75.67.172.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 215.143.182.52.in-addr.arpa udp

Files

memory/5052-0-0x00000000747BE000-0x00000000747BF000-memory.dmp

memory/5052-1-0x0000000000C60000-0x0000000000D14000-memory.dmp

memory/5052-2-0x0000000005C60000-0x0000000006204000-memory.dmp

memory/5052-3-0x0000000005750000-0x00000000057E2000-memory.dmp

memory/5052-4-0x0000000005720000-0x000000000572A000-memory.dmp

memory/5052-5-0x00000000747B0000-0x0000000074F60000-memory.dmp

memory/5052-6-0x0000000005910000-0x0000000005920000-memory.dmp

memory/5052-7-0x0000000005BA0000-0x0000000005BAC000-memory.dmp

memory/5052-8-0x0000000005BC0000-0x0000000005C20000-memory.dmp

memory/5052-9-0x0000000008830000-0x00000000088CC000-memory.dmp

memory/4148-14-0x0000000002960000-0x0000000002996000-memory.dmp

memory/4148-15-0x00000000747B0000-0x0000000074F60000-memory.dmp

memory/4148-16-0x0000000005550000-0x0000000005B78000-memory.dmp

memory/4148-18-0x0000000005260000-0x00000000052C6000-memory.dmp

memory/4148-17-0x00000000051C0000-0x00000000051E2000-memory.dmp

memory/4148-19-0x00000000053D0000-0x0000000005436000-memory.dmp

memory/4148-20-0x00000000747B0000-0x0000000074F60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpE261.tmp

MD5 e284dc2c5f5bd341fa24405889918bb2
SHA1 c1f12342eafd8e1a77a4be5461049deb947b3934
SHA256 c2b9d5d23695fdb57d4b778bc14800897e7dd624772a0f80b88095b198db6126
SHA512 40cdf79cb357fa6ed62657f6f04fa92e26205378564b922a592b9426d14038356a996c7587aaafdafc25ec3496dffca77682131e2cc429b62ccb47745fac8773

memory/4148-22-0x0000000005C40000-0x0000000005F94000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wxhr4xgg.zgw.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4148-28-0x00000000747B0000-0x0000000074F60000-memory.dmp

memory/1732-33-0x00000000747B0000-0x0000000074F60000-memory.dmp

memory/4436-35-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1732-34-0x00000000747B0000-0x0000000074F60000-memory.dmp

memory/5052-46-0x00000000747B0000-0x0000000074F60000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe.log

MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

memory/4148-48-0x0000000006270000-0x000000000628E000-memory.dmp

memory/4436-49-0x00000000057F0000-0x0000000005E08000-memory.dmp

memory/4436-50-0x0000000005030000-0x0000000005042000-memory.dmp

memory/4436-52-0x00000000050D0000-0x000000000510C000-memory.dmp

memory/4148-51-0x0000000006300000-0x000000000634C000-memory.dmp

memory/4436-53-0x0000000005370000-0x000000000547A000-memory.dmp

memory/4148-65-0x0000000075040000-0x000000007508C000-memory.dmp

memory/1732-55-0x0000000075040000-0x000000007508C000-memory.dmp

memory/1732-71-0x0000000006B20000-0x0000000006B3E000-memory.dmp

memory/1732-54-0x00000000075D0000-0x0000000007602000-memory.dmp

memory/1732-76-0x0000000007810000-0x00000000078B3000-memory.dmp

memory/1732-77-0x0000000007F40000-0x00000000085BA000-memory.dmp

memory/4148-78-0x00000000075B0000-0x00000000075CA000-memory.dmp

memory/1732-79-0x0000000007960000-0x000000000796A000-memory.dmp

memory/4148-80-0x0000000007830000-0x00000000078C6000-memory.dmp

memory/4148-81-0x00000000077B0000-0x00000000077C1000-memory.dmp

memory/4148-82-0x00000000077E0000-0x00000000077EE000-memory.dmp

memory/1732-83-0x0000000007B30000-0x0000000007B44000-memory.dmp

memory/1732-84-0x0000000007C30000-0x0000000007C4A000-memory.dmp

memory/4148-85-0x00000000078D0000-0x00000000078D8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d97a6b66f9f8504a38d61e767e06734c
SHA1 077bdb4b29a8cc843800b8c353eebaff7abce9b6
SHA256 4ea0b7ebd1094fc5c73f2609ea9f6e255a7e0f11d0f3201a0673b556f6e398b5
SHA512 0e7756718b62242b83e9de90981e718245d9486b3cd7d36ea2a36fd082c1323b912e85b21f32838759a5296343576b05575d18908d26af460e46382aa812446a

memory/1732-90-0x00000000747B0000-0x0000000074F60000-memory.dmp

memory/4148-89-0x00000000747B0000-0x0000000074F60000-memory.dmp

memory/4436-91-0x0000000006660000-0x0000000006822000-memory.dmp

memory/4436-92-0x0000000006D60000-0x000000000728C000-memory.dmp