Malware Analysis Report

2024-09-23 02:52

Sample ID 240709-17vklayhjk
Target CCXProcess.exe
SHA256 52d77f0c17e871983e761c9fef3b93b1b3263878fd91caa330bd1a1bc8c75355
Tags
rat c2 asyncrat discovery stormkitty collection persistence privilege_escalation spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

52d77f0c17e871983e761c9fef3b93b1b3263878fd91caa330bd1a1bc8c75355

Threat Level: Known bad

The file CCXProcess.exe was found to be: Known bad.

Malicious Activity Summary

rat c2 asyncrat discovery stormkitty collection persistence privilege_escalation spyware stealer

StormKitty

AsyncRat

Asyncrat family

StormKitty payload

Async RAT payload

Reads user/profile data of web browsers

Legitimate hosting services abused for malware hosting/C2

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Looks up geolocation information via web service

Checks installed software on the system

Drops file in Windows directory

Event Triggered Execution: Netsh Helper DLL

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

outlook_office_path

Suspicious behavior: EnumeratesProcesses

Modifies registry class

outlook_win_path

Modifies system certificate store

Suspicious use of SendNotifyMessage

Checks SCSI registry key(s)

Checks processor information in registry

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-09 22:17

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-09 22:17

Reported

2024-07-09 22:28

Platform

win7-20240704-en

Max time kernel

600s

Max time network

606s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe"

Signatures

AsyncRat

rat asyncrat

Checks installed software on the system

discovery

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe

"C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

Network

Country Destination Domain Proto
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp

Files

memory/3012-0-0x000007FEF4D73000-0x000007FEF4D74000-memory.dmp

memory/3012-1-0x00000000010A0000-0x00000000010C6000-memory.dmp

memory/3012-3-0x000007FEF4D70000-0x000007FEF575C000-memory.dmp

memory/3012-4-0x000007FEF4D70000-0x000007FEF575C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabBF7A.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarD56D.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/3012-57-0x000007FEF4D73000-0x000007FEF4D74000-memory.dmp

memory/2724-58-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/3012-59-0x000007FEF4D70000-0x000007FEF575C000-memory.dmp

memory/2724-60-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/3012-79-0x000007FEF4D70000-0x000007FEF575C000-memory.dmp

memory/2724-134-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2724-135-0x0000000140000000-0x00000001405E8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-09 22:17

Reported

2024-07-09 22:28

Platform

win10-20240611-en

Max time kernel

599s

Max time network

604s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe"

Signatures

AsyncRat

rat asyncrat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A
N/A ip-api.com N/A N/A

Looks up geolocation information via web service

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rescache\_merged\4183903823\2290032291.pri C:\Windows\system32\taskmgr.exe N/A
File created C:\Windows\rescache\_merged\1601268389\715946058.pri C:\Windows\system32\taskmgr.exe N/A

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f53000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c7f000000010000000c000000300a06082b060105050703097e000000010000000800000000c001b39667d601030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe

"C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe"

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\findstr.exe

findstr All

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\netsh.exe

netsh wlan show networks mode=bssid

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

Network

Country Destination Domain Proto
US 199.232.210.172:80 tcp
US 199.232.210.172:80 tcp
AR 181.47.208.50:4449 tcp
US 8.8.8.8:53 50.208.47.181.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
US 8.8.8.8:53 icanhazip.com udp
US 104.16.185.241:80 icanhazip.com tcp
US 8.8.8.8:53 241.185.16.104.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
AR 181.47.208.50:4449 tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 api.mylnikov.org udp
US 172.67.196.114:443 api.mylnikov.org tcp
US 8.8.8.8:53 114.196.67.172.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
US 8.8.8.8:53 31.73.42.20.in-addr.arpa udp

Files

memory/2356-1-0x00007FF87EFD0000-0x00007FF87F1AB000-memory.dmp

memory/2356-0-0x0000000000D10000-0x0000000000D36000-memory.dmp

memory/2356-3-0x00007FF87EFD0000-0x00007FF87F1AB000-memory.dmp

memory/2356-4-0x00007FF87EFD0000-0x00007FF87F1AB000-memory.dmp

memory/2356-7-0x00007FF87EFD0000-0x00007FF87F1AB000-memory.dmp

memory/2356-8-0x00007FF87EFD0000-0x00007FF87F1AB000-memory.dmp

memory/2356-10-0x00007FF87EFD0000-0x00007FF87F1AB000-memory.dmp

memory/2356-11-0x00007FF87EFD0000-0x00007FF87F1AB000-memory.dmp

memory/2356-12-0x000000001C0E0000-0x000000001C156000-memory.dmp

memory/2356-13-0x000000001B9C0000-0x000000001BA26000-memory.dmp

memory/2356-14-0x000000001BA40000-0x000000001BA5E000-memory.dmp

memory/2356-15-0x0000000001460000-0x0000000001582000-memory.dmp

memory/2356-39-0x00000000015D0000-0x00000000015F2000-memory.dmp

memory/2356-40-0x000000001CE00000-0x000000001CF34000-memory.dmp

memory/2356-41-0x0000000001580000-0x000000000158A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpEB3.tmp.dat

MD5 64408bdf8a846d232d7db045b4aa38b1
SHA1 2b004e839e8fc7632c72aa030b99322e1e378750
SHA256 292f45b8c48293c19461f901644572f880933cbbde47aedcc060b5162283a9fe
SHA512 90c169dbae6e15779c67e013007ac7df182a9221395edd9d6072d15e270132a44e43e330dfe0af818cf3c93754086601cd1c401fb9b69d7c9567407e4d08873b

C:\Users\Admin\AppData\Local\Temp\places.raw

MD5 992848147f89ffb1c8c56771484ed175
SHA1 0d2f38d2f569e18cf37e7771376c42d430fb517b
SHA256 90f853eb9adc4d53d070033082db2d8d5100659e85ef477066fc450f68adb112
SHA512 1010f75056512235a122cac576634cacf7305a3244631eec80c5e6be1170627073cf24e955e5f23ad22bb74dcfe749ec3274f581ccd5d01bc788ea8afead74e0

C:\Users\Admin\AppData\Local\Temp\tmp1727.tmp.dat

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp1728.tmp.dat

MD5 90a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1 aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA256 7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512 ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

C:\Users\Admin\AppData\Local\066e6f523d340da57ba03131615b0d9c\Admin@GKUTWGDF_en-US\System\Process.txt

MD5 eb69d22fc1d8eec2c29e220c65b96741
SHA1 ef3849ecc1ff0c2794b6abdcf2a9be20828e3ffd
SHA256 5edeeb5263173fb92c7216f7628227b17c171c13945b6cc2ce902b211b96f730
SHA512 4a6834ffaacb871452ac93b4807e524f0461309b0d47206ff14bfb273ae6c984201267c895c429bb55a9fc0caa727d7642bfed9ccb01e67c4d37ac64699b865d

C:\Users\Admin\AppData\Local\066e6f523d340da57ba03131615b0d9c\Admin@GKUTWGDF_en-US\System\Process.txt

MD5 217635450d31ad9bc27a275854685f69
SHA1 26fcf1886a7c8cf7907b7da59bb0ec21c9adc122
SHA256 8785e854da960725cb5dc2276c1a4d7559a3a3ef0a5dae303d1d9b9dffb07044
SHA512 c8100373de5a8a4cdeca503292063d28b81c991eaf7493e29579e20011d0c6b9d08c6c87c0399dfe41470eedc924cb603b44501d4754ce6eb77e75dfbf2de1fa

memory/2356-162-0x000000001C920000-0x000000001C99A000-memory.dmp

memory/2356-202-0x000000001D050000-0x000000001D0D4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2F2A.tmp.dat

MD5 1eb2d831c942f0084c89794c33205b55
SHA1 0988fc3f56f07d258ca3f5629acf18123baff722
SHA256 c880a9fb192a7ffb576934c9041c011258e6a3498a861efa3704ec317f351578
SHA512 af850b21602c73588709304b46024db2afdb3afaf42627a5fd01bc15f80e2180de042068e2e09563c52bdabc82a580c475fc8605e80cc1e7f98567179948ddd0

C:\Users\Admin\AppData\Local\Temp\tmp2F6B.tmp.dat

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Local\066e6f523d340da57ba03131615b0d9c\msgid.dat

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Analysis: behavioral3

Detonation Overview

Submitted

2024-07-09 22:17

Reported

2024-07-09 22:28

Platform

win10v2004-20240709-en

Max time kernel

591s

Max time network

601s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe"

Signatures

AsyncRat

rat asyncrat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A
N/A ip-api.com N/A N/A

Looks up geolocation information via web service

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: 33 N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe

"C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe"

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\findstr.exe

findstr All

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\netsh.exe

netsh wlan show networks mode=bssid

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
AR 181.47.208.50:4449 tcp
US 8.8.8.8:53 50.208.47.181.in-addr.arpa udp
AR 181.47.208.50:4449 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
US 8.8.8.8:53 icanhazip.com udp
US 104.16.185.241:80 icanhazip.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 241.185.16.104.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 api.mylnikov.org udp
US 104.21.44.66:443 api.mylnikov.org tcp
AR 181.47.208.50:4449 tcp
US 8.8.8.8:53 66.44.21.104.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 233.128.159.162.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp

Files

memory/532-0-0x00000000007C0000-0x00000000007E6000-memory.dmp

memory/532-1-0x00007FFB38253000-0x00007FFB38255000-memory.dmp

memory/532-3-0x00007FFB38250000-0x00007FFB38D11000-memory.dmp

memory/532-4-0x00007FFB38250000-0x00007FFB38D11000-memory.dmp

memory/532-6-0x00007FFB38250000-0x00007FFB38D11000-memory.dmp

memory/532-7-0x00007FFB38253000-0x00007FFB38255000-memory.dmp

memory/532-8-0x00007FFB38250000-0x00007FFB38D11000-memory.dmp

memory/532-9-0x00007FFB38250000-0x00007FFB38D11000-memory.dmp

memory/532-10-0x00007FFB38250000-0x00007FFB38D11000-memory.dmp

memory/532-11-0x000000001C610000-0x000000001C686000-memory.dmp

memory/532-12-0x000000001C590000-0x000000001C5F6000-memory.dmp

memory/532-13-0x000000001B4D0000-0x000000001B4EE000-memory.dmp

memory/532-14-0x00007FFB38250000-0x00007FFB38D11000-memory.dmp

memory/532-15-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-16-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-17-0x000000001CA40000-0x000000001CB62000-memory.dmp

memory/532-56-0x0000000000F20000-0x0000000000F42000-memory.dmp

memory/532-57-0x00007FFB38250000-0x00007FFB38D11000-memory.dmp

memory/532-58-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-59-0x000000001D7F0000-0x000000001D924000-memory.dmp

memory/532-60-0x0000000000ED0000-0x0000000000EDA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpCA6C.tmp.dat

MD5 93033b50faaecfc1f3413dd113d4f365
SHA1 a04840585ab5160bad05c13aabe2a875416b0d79
SHA256 51ac570ca79b6f12f89240532e24cf26a9cab7e982b6570e54b10769c6f60e25
SHA512 986351814483f2072bf4b83a5bcd221be88f888f90f85ce588807e354b9716e96e0f238735740b6217bfd28ffc75eedeabb2d56d1a10a384ced5501b346611ce

C:\Users\Admin\AppData\Local\Temp\places.raw

MD5 dc12f0d5e3d37a36754e395494764fa8
SHA1 f6afda1bad75e8cab00daf848f8761a6d81c9e49
SHA256 bcef9af37c07630ffce40d6b50af904c002bdd464e4e14e5af5ef312b2f84955
SHA512 aba8e9a3848eafbd169461311e581686a89f81b91dbf36eb6e4a4862c54d4107c13d9b5e8e49c85e5cbe1fb26ad810450067bf42c475968572e19bfb9697e3cd

C:\Users\Admin\AppData\Local\Temp\tmpCAA1.tmp.dat

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\tmpD297.tmp.dat

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Temp\tmpD298.tmp.dat

MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

C:\Users\Admin\AppData\Local\005a2f60177abd32427ea41e332644d4\Admin@QIVBHIQT_en-US\System\Process.txt

MD5 c8a90250ba840f8f479c698994e82b2c
SHA1 dc17263636f77ae3b1077284ef6fff0939fe6b0d
SHA256 e1291712fdf0e89c6baa3fd430c432d294b286bfbfd1a27810b29190b8ad0492
SHA512 ef783a028fbc505477bb283a113556cd9ffecf62216c21c76a26e95166c9040ad293ddba472c7ca710738416ddd164b5e4bead9689e5204b3a641c8cbc7654fc

C:\Users\Admin\AppData\Local\005a2f60177abd32427ea41e332644d4\Admin@QIVBHIQT_en-US\System\Process.txt

MD5 24987e5e3deb25751a8dda622d5725f2
SHA1 e5a6bddc25860ef137ba4197ecd3f43fb2a4f173
SHA256 619006bf6f86a007bc324736e723c2d86ebec90cdd4d9732e69e055615817080
SHA512 0e612adad4bfe900ac27dbe8fefd9ec62daed16d08ff402ffe1633faca3370ff09f133b082c8f5016da895bf6d16ba51fa1b289a6442797b56872fe7cfe924ee

memory/532-204-0x00007FFB38250000-0x00007FFB38D11000-memory.dmp

memory/532-206-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-208-0x000000001C490000-0x000000001C50A000-memory.dmp

memory/532-251-0x000000001CB60000-0x000000001CBE4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpEAD8.tmp.dat

MD5 a603e09d617fea7517059b4924b1df93
SHA1 31d66e1496e0229c6a312f8be05da3f813b3fa9e
SHA256 ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7
SHA512 eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

C:\Users\Admin\AppData\Local\Temp\tmpEAEA.tmp.dat

MD5 40f3eb83cc9d4cdb0ad82bd5ff2fb824
SHA1 d6582ba879235049134fa9a351ca8f0f785d8835
SHA256 cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
SHA512 cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

C:\Users\Admin\AppData\Local\Temp\tmpEAFE.tmp.dat

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmpEAFF.tmp.dat

MD5 49693267e0adbcd119f9f5e02adf3a80
SHA1 3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512 b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

C:\Users\Admin\AppData\Local\Temp\tmpEB00.tmp.dat

MD5 9618e15b04a4ddb39ed6c496575f6f95
SHA1 1c28f8750e5555776b3c80b187c5d15a443a7412
SHA256 a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512 f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

C:\Users\Admin\AppData\Local\005a2f60177abd32427ea41e332644d4\msgid.dat

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

memory/532-298-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-338-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-378-0x00007FFB38250000-0x00007FFB38D11000-memory.dmp

memory/532-379-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-380-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-381-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-382-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-383-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-384-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/4272-385-0x000001CAE3F10000-0x000001CAE3F11000-memory.dmp

memory/4272-386-0x000001CAE3F10000-0x000001CAE3F11000-memory.dmp

memory/4272-387-0x000001CAE3F10000-0x000001CAE3F11000-memory.dmp

memory/4272-392-0x000001CAE3F10000-0x000001CAE3F11000-memory.dmp

memory/4272-397-0x000001CAE3F10000-0x000001CAE3F11000-memory.dmp

memory/4272-396-0x000001CAE3F10000-0x000001CAE3F11000-memory.dmp

memory/4272-395-0x000001CAE3F10000-0x000001CAE3F11000-memory.dmp

memory/4272-394-0x000001CAE3F10000-0x000001CAE3F11000-memory.dmp

memory/4272-393-0x000001CAE3F10000-0x000001CAE3F11000-memory.dmp

memory/4272-391-0x000001CAE3F10000-0x000001CAE3F11000-memory.dmp

memory/532-398-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-399-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-400-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-401-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-402-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-403-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-404-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-405-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-406-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-407-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-408-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-409-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-410-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-411-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-412-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-413-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-414-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-415-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-416-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-417-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-418-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-419-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-420-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-421-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-422-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-423-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-424-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-425-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-426-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-427-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-428-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-429-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-430-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-431-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-432-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-433-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-434-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-435-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-436-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-437-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-438-0x000000001C890000-0x000000001CA39000-memory.dmp

memory/532-439-0x000000001C890000-0x000000001CA39000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-07-09 22:17

Reported

2024-07-09 22:28

Platform

win11-20240709-en

Max time kernel

429s

Max time network

599s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe"

Signatures

AsyncRat

rat asyncrat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A icanhazip.com N/A N/A

Looks up geolocation information via web service

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe

"C:\Users\Admin\AppData\Local\Temp\CCXProcess.exe"

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\findstr.exe

findstr All

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\netsh.exe

netsh wlan show networks mode=bssid

Network

Country Destination Domain Proto
AR 181.47.208.50:4449 tcp
US 8.8.8.8:53 50.208.47.181.in-addr.arpa udp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp
US 104.16.185.241:80 icanhazip.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 172.67.196.114:443 api.mylnikov.org tcp
AR 181.47.208.50:4449 tcp
US 162.159.136.232:443 discord.com tcp
AR 181.47.208.50:4449 tcp
AR 181.47.208.50:4449 tcp

Files

memory/4828-1-0x00007FFC78A33000-0x00007FFC78A35000-memory.dmp

memory/4828-0-0x0000000000750000-0x0000000000776000-memory.dmp

memory/4828-3-0x00007FFC78A30000-0x00007FFC794F2000-memory.dmp

memory/4828-4-0x00007FFC78A30000-0x00007FFC794F2000-memory.dmp

memory/4828-6-0x00007FFC78A30000-0x00007FFC794F2000-memory.dmp

memory/4828-7-0x00007FFC78A30000-0x00007FFC794F2000-memory.dmp

memory/4828-8-0x00007FFC78A33000-0x00007FFC78A35000-memory.dmp

memory/4828-9-0x00007FFC78A30000-0x00007FFC794F2000-memory.dmp

memory/4828-10-0x00007FFC78A30000-0x00007FFC794F2000-memory.dmp

memory/4828-11-0x00007FFC78A30000-0x00007FFC794F2000-memory.dmp

memory/4828-12-0x00007FFC78A30000-0x00007FFC794F2000-memory.dmp

memory/4828-13-0x000000001C5C0000-0x000000001C636000-memory.dmp

memory/4828-14-0x000000001C540000-0x000000001C5A6000-memory.dmp

memory/4828-15-0x000000001B9B0000-0x000000001B9CE000-memory.dmp

memory/4828-16-0x000000001CDA0000-0x000000001CEC2000-memory.dmp

memory/4828-55-0x0000000000E30000-0x0000000000E52000-memory.dmp

memory/4828-56-0x000000001D450000-0x000000001D584000-memory.dmp

memory/4828-57-0x0000000000DE0000-0x0000000000DEA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\places.raw

MD5 15c652e6e9bb3baf39e74d1ae168af64
SHA1 0510438958a96aea1dd3b758bec1b5154e0ec2b8
SHA256 b485cce001f09618c2922963df6f7e15fea0a4f4335270e1faa9b05edd1af753
SHA512 fa060ec18a60b5f46de8edf60a46dee181f1146bada929736d537d707f8f6829da265e8d6c6d32244ea94d88f698743a7b580f3bc469a2a9b97d6d6aaaabac2b

C:\Users\Admin\AppData\Local\Temp\tmp1EC5.tmp.dat

MD5 f58c7184af18ea41ed8faa6ac4fe5b19
SHA1 5ab330803374ac6e89227b80ea48a9c7e30a8f89
SHA256 10922dee8fdb085d37aa6bc88fc3f4588c6b0c989b1bc4a3a6a8ed40aa145ae4
SHA512 934c44d31e7e2d814d405b11c38f1f60305e08e6615670423c1317d92f35e9302fe314fdc125a449c0fc8ace30d598f012aa89dc24575367a652d5a06680f4f0

C:\Users\Admin\AppData\Local\Temp\tmp1EEC.tmp.dat

MD5 87210e9e528a4ddb09c6b671937c79c6
SHA1 3c75314714619f5b55e25769e0985d497f0062f2
SHA256 eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
SHA512 f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

C:\Users\Admin\AppData\Local\Temp\tmp276D.tmp.dat

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Temp\tmp276E.tmp.dat

MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

C:\Users\Admin\AppData\Local\31feab0bef027d5291c3ab014828756d\Admin@ELEOLWUJ_en-US\System\Process.txt

MD5 9a8faa7761dacf023fc67ae74eb25c87
SHA1 69942cbe7d826da039931b7cea975ffc54fa2954
SHA256 f7de75164037a525d1fa84a568fd6b265d264477367e4b2029b743ff0d184b86
SHA512 f31862771d540a7a84d0bec614bead33093a7597bcf9293571fff5830c4ba2780990ce5036216a5d33d579aee1ef1edd4cad6abd99aace7c30381bc3021fd451

C:\Users\Admin\AppData\Local\31feab0bef027d5291c3ab014828756d\Admin@ELEOLWUJ_en-US\System\Process.txt

MD5 04d55908eac79ddda05bfb3a92e2f2ea
SHA1 fbcf0bcc9ba8d0896b2c2425bc3bb0ccc4e8dd44
SHA256 16a0d567947d475529eb259e1783d7ea4f6b29e90e03831373ccd4a3d732d769
SHA512 b88b21f653bb0b582b1b69c9e85d8d38f90b21bc560af9893c42858662a6e6c2cc6ae09d432d5787ba96a314d4dd8aeebd5d7d18122183515973df1acadfb74b

C:\Users\Admin\AppData\Local\31feab0bef027d5291c3ab014828756d\Admin@ELEOLWUJ_en-US\System\Process.txt

MD5 eb29245d4296f559a628e24999a73165
SHA1 f9d3fb1e17ac74a892970c495a50110822f91361
SHA256 194da30b7b70c65d43ba807629cae3f9cf553e354bf2ca17c2ad116612ec12e8
SHA512 3fb951ad39acb52c16539b127bd75d8b8d5a3edd570ff7af18aac86238f7a545ab1b7015917b61c8354f64996e34d130d1cfd924db85624e5dfb896bc43c1b48

memory/4828-199-0x00007FFC78A30000-0x00007FFC794F2000-memory.dmp

memory/4828-202-0x000000001C240000-0x000000001C2BA000-memory.dmp

memory/4828-242-0x000000001C2C0000-0x000000001C344000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp3E95.tmp.dat

MD5 a603e09d617fea7517059b4924b1df93
SHA1 31d66e1496e0229c6a312f8be05da3f813b3fa9e
SHA256 ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7
SHA512 eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

C:\Users\Admin\AppData\Local\Temp\tmp3EB8.tmp.dat

MD5 40f3eb83cc9d4cdb0ad82bd5ff2fb824
SHA1 d6582ba879235049134fa9a351ca8f0f785d8835
SHA256 cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
SHA512 cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

C:\Users\Admin\AppData\Local\Temp\tmp3EBC.tmp.dat

MD5 14ccc9293153deacbb9a20ee8f6ff1b7
SHA1 46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3
SHA256 3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511
SHA512 916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

C:\Users\Admin\AppData\Local\Temp\tmp3EBE.tmp.dat

MD5 4e2922249bf476fb3067795f2fa5e794
SHA1 d2db6b2759d9e650ae031eb62247d457ccaa57d2
SHA256 c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1
SHA512 8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

C:\Users\Admin\AppData\Local\Temp\tmp3EBD.tmp.dat

MD5 22be08f683bcc01d7a9799bbd2c10041
SHA1 2efb6041cf3d6e67970135e592569c76fc4c41de
SHA256 451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457
SHA512 0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

C:\Users\Admin\AppData\Local\31feab0bef027d5291c3ab014828756d\msgid.dat

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

memory/4828-367-0x00007FFC78A30000-0x00007FFC794F2000-memory.dmp