Malware Analysis Report

2024-09-11 09:51

Sample ID 240707-fkn43sthmj
Target 114f1c23daae885f851b9cf1fdaf8457.exe
SHA256 b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32
Tags
redline sectoprat cheat discovery execution infostealer rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b77fc538e119d7b94ac123c2fe21b5d403316cbc4510479130f195a18dc61f32

Threat Level: Known bad

The file 114f1c23daae885f851b9cf1fdaf8457.exe was found to be: Known bad.

Malicious Activity Summary

redline sectoprat cheat discovery execution infostealer rat spyware stealer trojan

SectopRAT

RedLine payload

RedLine

SectopRAT payload

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Checks computer location settings

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Persistence
TA0003
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Defense Evasion
TA0005
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-07 04:56

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-07 04:56

Reported

2024-07-07 04:58

Platform

win7-20240705-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2632 set thread context of 884 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2632 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2632 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2632 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2632 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2632 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2632 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2632 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2632 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2632 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\schtasks.exe
PID 2632 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\schtasks.exe
PID 2632 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\schtasks.exe
PID 2632 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\schtasks.exe
PID 2632 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 2632 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 2632 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 2632 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 2632 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 2632 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 2632 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 2632 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 2632 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe

Processes

C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe

"C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vQYTRFwVF.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vQYTRFwVF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC320.tmp"

C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe

"C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe"

Network

Country Destination Domain Proto
NL 45.137.22.78:55615 45.137.22.78 tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp

Files

memory/2632-0-0x000000007433E000-0x000000007433F000-memory.dmp

memory/2632-1-0x0000000000FC0000-0x000000000108A000-memory.dmp

memory/2632-2-0x0000000074330000-0x0000000074A1E000-memory.dmp

memory/2632-3-0x00000000009C0000-0x00000000009DA000-memory.dmp

memory/2632-4-0x00000000006A0000-0x00000000006A8000-memory.dmp

memory/2632-5-0x0000000000970000-0x000000000097C000-memory.dmp

memory/2632-6-0x0000000004490000-0x000000000452A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpC320.tmp

MD5 8058edbb8feaf4655a5d1496bf78de93
SHA1 a15a476735b2d3af3682346159e33866f8c313e4
SHA256 6bdc8357f1362f0809b158dced562b08e7344aebe48d40932e3f30c525153034
SHA512 0bfcffe0093517e84f2055761107ae3927d4953d3420fc66dd7aa0a58db16123e518bc6bdc590224bdb14dcf1a9b595f869062f6a523b2ca47d8374d9e1e2a10

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 2c8eb4968282de8480a7fea29e3ad66c
SHA1 2ac1cb7be5d337baeeb8a5c797ab1185aad537cb
SHA256 302279a8119c383ef2c6b47f05e960f004a7677ac0c978b1dd15aac04d873685
SHA512 f24d10a40390f9eacf5b599c69413c71e2989bace5efc6892b40e9b4070c57f637217ef1a70c1641a304eb2770e68495447fba627f71cb8135d996a1711ee346

memory/884-19-0x0000000000400000-0x000000000041E000-memory.dmp

memory/884-28-0x0000000000400000-0x000000000041E000-memory.dmp

memory/884-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/884-25-0x0000000000400000-0x000000000041E000-memory.dmp

memory/884-23-0x0000000000400000-0x000000000041E000-memory.dmp

memory/884-21-0x0000000000400000-0x000000000041E000-memory.dmp

memory/884-30-0x0000000000400000-0x000000000041E000-memory.dmp

memory/884-29-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2632-31-0x0000000074330000-0x0000000074A1E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpDE93.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmpDEA9.tmp

MD5 de7d702f13db499233da2c87959d7696
SHA1 8d51283dc6b41cae89ac01928cd0460604ff1d3e
SHA256 78e689d13f1ff71daeb36634831fa7457a8c90ea465a3e342aef921d8ca82b34
SHA512 a57e198ff5e32453ac99d6aefb5ab71f9cb4c80006f2a75d3c3e0ef28a0ca00f387110788edc1df1e0a7ab9a2503571e82749e51acf7c67e654a586503754045

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-07 04:56

Reported

2024-07-07 04:58

Platform

win10v2004-20240704-en

Max time kernel

125s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1072 set thread context of 852 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1072 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1072 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1072 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1072 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1072 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1072 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1072 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\schtasks.exe
PID 1072 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\schtasks.exe
PID 1072 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Windows\SysWOW64\schtasks.exe
PID 1072 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 1072 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 1072 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 1072 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 1072 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 1072 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 1072 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 1072 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 1072 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 1072 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe
PID 1072 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe

Processes

C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe

"C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3796,i,1468394940417093286,13535766203427582426,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vQYTRFwVF.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vQYTRFwVF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB6C8.tmp"

C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe

"C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe"

C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe

"C:\Users\Admin\AppData\Local\Temp\114f1c23daae885f851b9cf1fdaf8457.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
NL 45.137.22.78:55615 45.137.22.78 tcp
US 8.8.8.8:53 78.22.137.45.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp
US 8.8.8.8:53 31.12.26.104.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

memory/1072-0-0x000000007464E000-0x000000007464F000-memory.dmp

memory/1072-1-0x0000000000770000-0x000000000083A000-memory.dmp

memory/1072-2-0x00000000057F0000-0x0000000005D94000-memory.dmp

memory/1072-3-0x0000000005240000-0x00000000052D2000-memory.dmp

memory/1072-5-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/1072-4-0x00000000052E0000-0x00000000052EA000-memory.dmp

memory/1072-6-0x0000000005780000-0x000000000579A000-memory.dmp

memory/1072-7-0x0000000005640000-0x0000000005648000-memory.dmp

memory/1072-8-0x00000000057E0000-0x00000000057EC000-memory.dmp

memory/1072-10-0x0000000006680000-0x000000000671C000-memory.dmp

memory/1072-9-0x0000000006540000-0x00000000065DA000-memory.dmp

memory/1072-16-0x000000007464E000-0x000000007464F000-memory.dmp

memory/1272-15-0x0000000002960000-0x0000000002996000-memory.dmp

memory/1272-18-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/1272-19-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/1272-17-0x00000000053F0000-0x0000000005A18000-memory.dmp

memory/1272-21-0x0000000005A90000-0x0000000005AF6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB6C8.tmp

MD5 f5d72d80fd60d50aeccf7b548333c6d1
SHA1 482993c96d5f1a0e0231215d63f01bb464347d03
SHA256 60c776ef48b864195d8a751bbde9b5281d2e423a26d3ac258abc1ad3d94bd44f
SHA512 5870e89ea2804a3e5d1e590ef37381407225d9184b389dbb41de501fbf04d44e8024d8f2c6efe5ddff83fa9c23020161ef9fb1f0c8ad11505cbc100a6b37a651

memory/1272-29-0x0000000074640000-0x0000000074DF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h1tkayui.whx.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1272-22-0x0000000005B00000-0x0000000005B66000-memory.dmp

memory/1080-40-0x0000000005A20000-0x0000000005D74000-memory.dmp

memory/1272-20-0x00000000053A0000-0x00000000053C2000-memory.dmp

memory/1080-44-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/852-45-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1080-47-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/1072-48-0x0000000074640000-0x0000000074DF0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\114f1c23daae885f851b9cf1fdaf8457.exe.log

MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

memory/1272-50-0x0000000006250000-0x000000000626E000-memory.dmp

memory/1272-51-0x0000000006280000-0x00000000062CC000-memory.dmp

memory/852-52-0x0000000005410000-0x0000000005A28000-memory.dmp

memory/852-53-0x0000000002980000-0x0000000002992000-memory.dmp

memory/852-54-0x0000000004E30000-0x0000000004E6C000-memory.dmp

memory/852-55-0x00000000050D0000-0x00000000051DA000-memory.dmp

memory/1272-68-0x0000000007240000-0x00000000072E3000-memory.dmp

memory/1272-67-0x0000000006860000-0x000000000687E000-memory.dmp

memory/1080-69-0x0000000074EF0000-0x0000000074F3C000-memory.dmp

memory/1272-57-0x0000000074EF0000-0x0000000074F3C000-memory.dmp

memory/1272-56-0x0000000006820000-0x0000000006852000-memory.dmp

memory/1080-79-0x00000000078C0000-0x0000000007F3A000-memory.dmp

memory/1272-80-0x0000000007570000-0x000000000758A000-memory.dmp

memory/1272-81-0x00000000075E0000-0x00000000075EA000-memory.dmp

memory/1272-82-0x00000000077F0000-0x0000000007886000-memory.dmp

memory/1272-83-0x0000000007770000-0x0000000007781000-memory.dmp

memory/1080-84-0x0000000007460000-0x000000000746E000-memory.dmp

memory/1272-85-0x00000000077B0000-0x00000000077C4000-memory.dmp

memory/1272-87-0x0000000007890000-0x0000000007898000-memory.dmp

memory/1272-86-0x00000000078B0000-0x00000000078CA000-memory.dmp

memory/1080-91-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/1272-90-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/852-92-0x00000000063C0000-0x0000000006582000-memory.dmp

memory/852-93-0x0000000006AC0000-0x0000000006FEC000-memory.dmp

memory/852-94-0x0000000006630000-0x00000000066A6000-memory.dmp

memory/852-95-0x0000000006770000-0x000000000678E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpD598.tmp

MD5 8f5942354d3809f865f9767eddf51314
SHA1 20be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256 776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512 fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

C:\Users\Admin\AppData\Local\Temp\tmpD5AE.tmp

MD5 a146b07d36c77deb545345f9fe3ddd75
SHA1 a0c87bf2dbe1dccdcbd2f68f2c366d273d247192
SHA256 f28113548245d5faa6e48dcbd57e80a29081d017b95808697347619b89d42c9b
SHA512 5cad32cef6e57d99c0e4508ae7f727055b0350a54578b65e1cf7f2fac319c07e32bb931740b4466d343be3c1178cf796067f467a2ccb56d7a60473258ff078cb

C:\Users\Admin\AppData\Local\Temp\tmpD5FA.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Local\Temp\tmpD5DF.tmp

MD5 8ad43179b9a9235f10a91c76301e64c9
SHA1 2f62e644b1ff2c8442fa18ff5e005dac64f1d47b
SHA256 626b33cfc3d8e42fb71b4d59980b56a4bafff9387e490788c327e50ef839e58a
SHA512 97626f305d2684efec3d945c4eff253c023e4fe92a2cfc0ffc0bc879df868b06031e7a83d426bca14a6f78658f5467f039d266da540645b6a7eb54774225a475

C:\Users\Admin\AppData\Local\Temp\tmpD5C9.tmp

MD5 7872fbf0a1bb518682babda3d8dc7b4e
SHA1 9714d4f9f7e7c3b9a99f656b88b3a10cbd9c65e4
SHA256 a821fa964b5c5273f0e4696e98815f07113c85436cc468f41f39722e7d2767c2
SHA512 f91bb32e1675f822af53ebc91dc5764625b13bc2e365dcf795e1132525857e5d43a18b2f53b4bb70722aef7a0eafd5b3e4d1805f8567d325d34ae41c281832c0