Malware Analysis Report

2024-11-30 05:26

Sample ID 240711-pgxrgswbrr
Target softorganizer.exe
SHA256 e65f08b6749e63fea544cd201161e63abe6925e0e739faddda2bd4af5af56b97
Tags
stealc vidar spyware stealer lumma discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e65f08b6749e63fea544cd201161e63abe6925e0e739faddda2bd4af5af56b97

Threat Level: Known bad

The file softorganizer.exe was found to be: Known bad.

Malicious Activity Summary

stealc vidar spyware stealer lumma discovery

Detect Vidar Stealer

Stealc

Vidar

Lumma Stealer

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-11 12:18

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-11 12:18

Reported

2024-07-11 12:23

Platform

win7-20240705-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\softorganizer.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\GDHIDHIEGI.exe N/A
N/A N/A C:\ProgramData\KEBFHIJECF.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2016 set thread context of 2880 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2016 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2016 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2016 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2016 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2016 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2016 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2016 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2016 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2016 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2016 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2880 wrote to memory of 2404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\GDHIDHIEGI.exe
PID 2880 wrote to memory of 2404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\GDHIDHIEGI.exe
PID 2880 wrote to memory of 2404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\GDHIDHIEGI.exe
PID 2880 wrote to memory of 2404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\GDHIDHIEGI.exe
PID 2404 wrote to memory of 960 N/A C:\ProgramData\GDHIDHIEGI.exe C:\Windows\SysWOW64\WerFault.exe
PID 2404 wrote to memory of 960 N/A C:\ProgramData\GDHIDHIEGI.exe C:\Windows\SysWOW64\WerFault.exe
PID 2404 wrote to memory of 960 N/A C:\ProgramData\GDHIDHIEGI.exe C:\Windows\SysWOW64\WerFault.exe
PID 2404 wrote to memory of 960 N/A C:\ProgramData\GDHIDHIEGI.exe C:\Windows\SysWOW64\WerFault.exe
PID 2880 wrote to memory of 1656 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\KEBFHIJECF.exe
PID 2880 wrote to memory of 1656 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\KEBFHIJECF.exe
PID 2880 wrote to memory of 1656 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\KEBFHIJECF.exe
PID 2880 wrote to memory of 1656 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\KEBFHIJECF.exe
PID 1656 wrote to memory of 1312 N/A C:\ProgramData\KEBFHIJECF.exe C:\Windows\SysWOW64\WerFault.exe
PID 1656 wrote to memory of 1312 N/A C:\ProgramData\KEBFHIJECF.exe C:\Windows\SysWOW64\WerFault.exe
PID 1656 wrote to memory of 1312 N/A C:\ProgramData\KEBFHIJECF.exe C:\Windows\SysWOW64\WerFault.exe
PID 1656 wrote to memory of 1312 N/A C:\ProgramData\KEBFHIJECF.exe C:\Windows\SysWOW64\WerFault.exe
PID 2880 wrote to memory of 2608 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2880 wrote to memory of 2608 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2880 wrote to memory of 2608 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2880 wrote to memory of 2608 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2608 wrote to memory of 2824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2608 wrote to memory of 2824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2608 wrote to memory of 2824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\softorganizer.exe

"C:\Users\Admin\AppData\Local\Temp\softorganizer.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

C:\ProgramData\GDHIDHIEGI.exe

"C:\ProgramData\GDHIDHIEGI.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 112

C:\ProgramData\KEBFHIJECF.exe

"C:\ProgramData\KEBFHIJECF.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 112

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DHDHCGHDHIDH" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country Destination Domain Proto
US 8.8.8.8:53 steamcommunity.com udp
GB 104.82.234.109:443 steamcommunity.com tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 77.105.132.27:80 77.105.132.27 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
US 8.8.8.8:53 tea.arpdabl.org udp
NL 185.107.56.203:80 tea.arpdabl.org tcp
US 8.8.8.8:53 survey-smiles.com udp
US 199.59.243.226:80 survey-smiles.com tcp

Files

memory/2016-0-0x0000000074AEE000-0x0000000074AEF000-memory.dmp

memory/2016-1-0x0000000000AF0000-0x0000000001054000-memory.dmp

memory/2016-2-0x0000000074AE0000-0x00000000751CE000-memory.dmp

memory/2016-3-0x0000000005280000-0x000000000548A000-memory.dmp

memory/2016-4-0x0000000005860000-0x00000000059B4000-memory.dmp

memory/2016-5-0x0000000000580000-0x000000000059C000-memory.dmp

memory/2016-6-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-9-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-11-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-35-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-51-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-61-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-59-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-57-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-55-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-53-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-49-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-47-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-45-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-43-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-41-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-39-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-37-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-33-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-31-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-29-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-27-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-25-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-23-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-21-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-19-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-17-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-15-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-13-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-8-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-65-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2016-63-0x0000000000580000-0x0000000000595000-memory.dmp

memory/2880-67-0x0000000000400000-0x0000000000648000-memory.dmp

memory/2880-69-0x0000000000400000-0x0000000000648000-memory.dmp

memory/2880-68-0x0000000000400000-0x0000000000648000-memory.dmp

memory/2880-66-0x0000000000400000-0x0000000000648000-memory.dmp

memory/2880-76-0x0000000000400000-0x0000000000648000-memory.dmp

memory/2016-74-0x0000000074AE0000-0x00000000751CE000-memory.dmp

memory/2016-77-0x0000000074AE0000-0x00000000751CE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab3822.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar3845.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

\ProgramData\GDHIDHIEGI.exe

MD5 5dcb471423fbb62d7c218760aee4936d
SHA1 7d72a2295639a8702ecdb77cc020b7a9eef48b04
SHA256 837340da10b33b25bca1c15db3b273bfde18110b46949e8c545f31756e7b44bd
SHA512 d8febe1cc91bbacd1b0298eb88d0d25f7789ee962f4d4717cb74ca1d1081ecab78a4062923b31386bcae141900ee99c182836e52bbb4b9f362cd8bdf687dc736

\ProgramData\KEBFHIJECF.exe

MD5 0b4cc01ce62da8ed72b98a896c11c1dd
SHA1 eb87a11df4f7a0066389094ee9ba8a4e189794ad
SHA256 6ab0929361ee1a7fdc900bb0f6e50e999183a7c1aef1f44951b7847e86dfd3bc
SHA512 b24fb55140210cc3c8d5f2dec84f36314a93397351a7109701b05dcb47cfbaf437c74fcafb551d8a96e845ea656a5c618b4a229c6acba8c2d0ed3849ccc48b8d

memory/2880-630-0x0000000000400000-0x0000000000648000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-11 12:18

Reported

2024-07-11 12:23

Platform

win10v2004-20240709-en

Max time kernel

94s

Max time network

204s

Command Line

"C:\Users\Admin\AppData\Local\Temp\softorganizer.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Lumma Stealer

stealer lumma

Stealc

stealer stealc

Vidar

stealer vidar

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\FBFIDBFHDB.exe N/A
N/A N/A C:\ProgramData\HDAFBAEBKJ.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1332 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1332 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1332 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1332 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1332 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1332 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1332 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1332 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1332 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3536 wrote to memory of 3772 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\FBFIDBFHDB.exe
PID 3536 wrote to memory of 3772 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\FBFIDBFHDB.exe
PID 3536 wrote to memory of 3772 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\FBFIDBFHDB.exe
PID 3772 wrote to memory of 4592 N/A C:\ProgramData\FBFIDBFHDB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3772 wrote to memory of 4592 N/A C:\ProgramData\FBFIDBFHDB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3772 wrote to memory of 4592 N/A C:\ProgramData\FBFIDBFHDB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3772 wrote to memory of 4592 N/A C:\ProgramData\FBFIDBFHDB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3772 wrote to memory of 4592 N/A C:\ProgramData\FBFIDBFHDB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3772 wrote to memory of 4592 N/A C:\ProgramData\FBFIDBFHDB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3772 wrote to memory of 4592 N/A C:\ProgramData\FBFIDBFHDB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3772 wrote to memory of 4592 N/A C:\ProgramData\FBFIDBFHDB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3772 wrote to memory of 4592 N/A C:\ProgramData\FBFIDBFHDB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3536 wrote to memory of 3308 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\HDAFBAEBKJ.exe
PID 3536 wrote to memory of 3308 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\HDAFBAEBKJ.exe
PID 3536 wrote to memory of 3308 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\HDAFBAEBKJ.exe
PID 3308 wrote to memory of 5100 N/A C:\ProgramData\HDAFBAEBKJ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3308 wrote to memory of 5100 N/A C:\ProgramData\HDAFBAEBKJ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3308 wrote to memory of 5100 N/A C:\ProgramData\HDAFBAEBKJ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3308 wrote to memory of 4724 N/A C:\ProgramData\HDAFBAEBKJ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3308 wrote to memory of 4724 N/A C:\ProgramData\HDAFBAEBKJ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3308 wrote to memory of 4724 N/A C:\ProgramData\HDAFBAEBKJ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3308 wrote to memory of 4724 N/A C:\ProgramData\HDAFBAEBKJ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3308 wrote to memory of 4724 N/A C:\ProgramData\HDAFBAEBKJ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3308 wrote to memory of 4724 N/A C:\ProgramData\HDAFBAEBKJ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3308 wrote to memory of 4724 N/A C:\ProgramData\HDAFBAEBKJ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3308 wrote to memory of 4724 N/A C:\ProgramData\HDAFBAEBKJ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3308 wrote to memory of 4724 N/A C:\ProgramData\HDAFBAEBKJ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3536 wrote to memory of 2212 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 3536 wrote to memory of 2212 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 3536 wrote to memory of 2212 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 4588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2212 wrote to memory of 4588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2212 wrote to memory of 4588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\softorganizer.exe

"C:\Users\Admin\AppData\Local\Temp\softorganizer.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

C:\ProgramData\FBFIDBFHDB.exe

"C:\ProgramData\FBFIDBFHDB.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\ProgramData\HDAFBAEBKJ.exe

"C:\ProgramData\HDAFBAEBKJ.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KKKJEBAAECBG" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country Destination Domain Proto
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 steamcommunity.com udp
GB 104.82.234.109:443 steamcommunity.com tcp
US 8.8.8.8:53 109.234.82.104.in-addr.arpa udp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
US 8.8.8.8:53 221.241.109.65.in-addr.arpa udp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 77.105.132.27:80 77.105.132.27 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
US 8.8.8.8:53 stationacutwo.shop udp
US 172.67.172.239:443 stationacutwo.shop tcp
US 8.8.8.8:53 27.132.105.77.in-addr.arpa udp
US 8.8.8.8:53 bouncedgowp.shop udp
US 172.67.214.52:443 bouncedgowp.shop tcp
US 8.8.8.8:53 bannngwko.shop udp
FI 65.109.241.221:443 65.109.241.221 tcp
US 172.67.146.61:443 bannngwko.shop tcp
US 8.8.8.8:53 239.172.67.172.in-addr.arpa udp
US 8.8.8.8:53 52.214.67.172.in-addr.arpa udp
US 8.8.8.8:53 bargainnykwo.shop udp
US 104.21.47.93:443 bargainnykwo.shop tcp
US 8.8.8.8:53 affecthorsedpo.shop udp
US 172.67.135.137:443 affecthorsedpo.shop tcp
FI 65.109.241.221:443 65.109.241.221 tcp
US 8.8.8.8:53 radiationnopp.shop udp
US 8.8.8.8:53 61.146.67.172.in-addr.arpa udp
US 8.8.8.8:53 93.47.21.104.in-addr.arpa udp
US 8.8.8.8:53 137.135.67.172.in-addr.arpa udp
US 104.21.68.158:443 radiationnopp.shop tcp
FI 65.109.241.221:443 65.109.241.221 tcp
US 8.8.8.8:53 answerrsdo.shop udp
US 172.67.203.63:443 answerrsdo.shop tcp
US 8.8.8.8:53 publicitttyps.shop udp
US 104.21.25.154:443 publicitttyps.shop tcp
US 8.8.8.8:53 158.68.21.104.in-addr.arpa udp
US 8.8.8.8:53 63.203.67.172.in-addr.arpa udp
US 8.8.8.8:53 154.25.21.104.in-addr.arpa udp
FI 65.109.241.221:443 65.109.241.221 tcp
US 8.8.8.8:53 benchillppwo.shop udp
US 172.67.160.230:443 benchillppwo.shop tcp
GB 104.82.234.109:443 steamcommunity.com tcp
US 8.8.8.8:53 reinforcedirectorywd.shop udp
US 104.21.83.48:443 reinforcedirectorywd.shop tcp
FI 65.109.241.221:443 65.109.241.221 tcp
US 8.8.8.8:53 230.160.67.172.in-addr.arpa udp
US 8.8.8.8:53 48.83.21.104.in-addr.arpa udp
US 8.8.8.8:53 tea.arpdabl.org udp
US 172.93.194.61:80 tea.arpdabl.org tcp
US 8.8.8.8:53 survey-smiles.com udp
US 199.59.243.226:80 survey-smiles.com tcp
US 8.8.8.8:53 61.194.93.172.in-addr.arpa udp
US 8.8.8.8:53 226.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 steamcommunity.com udp
GB 104.82.234.109:443 steamcommunity.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
FI 65.109.241.221:443 65.109.241.221 tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/1332-0-0x000000007497E000-0x000000007497F000-memory.dmp

memory/1332-1-0x0000000000680000-0x0000000000BE4000-memory.dmp

memory/1332-2-0x0000000005690000-0x000000000572C000-memory.dmp

memory/1332-3-0x0000000074970000-0x0000000075120000-memory.dmp

memory/1332-4-0x0000000005840000-0x0000000005A4A000-memory.dmp

memory/1332-5-0x0000000005A50000-0x0000000005BA4000-memory.dmp

memory/1332-6-0x0000000005580000-0x000000000559C000-memory.dmp

memory/1332-12-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-16-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-66-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-64-0x0000000005580000-0x0000000005595000-memory.dmp

memory/3536-69-0x0000000000400000-0x0000000000648000-memory.dmp

memory/3536-67-0x0000000000400000-0x0000000000648000-memory.dmp

memory/1332-71-0x0000000074970000-0x0000000075120000-memory.dmp

memory/1332-63-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-60-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-58-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-56-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-54-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-52-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-51-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-48-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-46-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-44-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-42-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-40-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-38-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-36-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-34-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-32-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-31-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-29-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-26-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-24-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-22-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-20-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-19-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-14-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-10-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-8-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-7-0x0000000005580000-0x0000000005595000-memory.dmp

memory/1332-72-0x0000000074970000-0x0000000075120000-memory.dmp

memory/3536-73-0x0000000000400000-0x0000000000648000-memory.dmp

memory/3536-78-0x0000000000400000-0x0000000000648000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\FBFIDBFHDB.exe

MD5 5dcb471423fbb62d7c218760aee4936d
SHA1 7d72a2295639a8702ecdb77cc020b7a9eef48b04
SHA256 837340da10b33b25bca1c15db3b273bfde18110b46949e8c545f31756e7b44bd
SHA512 d8febe1cc91bbacd1b0298eb88d0d25f7789ee962f4d4717cb74ca1d1081ecab78a4062923b31386bcae141900ee99c182836e52bbb4b9f362cd8bdf687dc736

memory/4592-156-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1332-155-0x0000000074970000-0x0000000075120000-memory.dmp

C:\ProgramData\HDAFBAEBKJ.exe

MD5 0b4cc01ce62da8ed72b98a896c11c1dd
SHA1 eb87a11df4f7a0066389094ee9ba8a4e189794ad
SHA256 6ab0929361ee1a7fdc900bb0f6e50e999183a7c1aef1f44951b7847e86dfd3bc
SHA512 b24fb55140210cc3c8d5f2dec84f36314a93397351a7109701b05dcb47cfbaf437c74fcafb551d8a96e845ea656a5c618b4a229c6acba8c2d0ed3849ccc48b8d

memory/3536-170-0x0000000000400000-0x0000000000648000-memory.dmp

memory/3536-173-0x0000000000400000-0x0000000000648000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5G8JI3LV\76561199735694209[1].htm

MD5 6312eb72b629c5dd7d2dc44c339158ce
SHA1 1956fc476f484290133c39c9741ec0fdfbeb0544
SHA256 2760332d6bbc2943cb00e5029081bc16fa549a2cf63fef65bafa72ef5173d5e8
SHA512 f965061f7a208f13a40ec8003d24a917f6ef6c5421c023d28b984a7e43974b342409be7a4526fa414e9692a91a1c56b2013ca145b9ea997769328585f46ee4e1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

MD5 baa2409ed7f6a7e8bba952df083e96bc
SHA1 d8ad93370da697703762fef037a411218e800a85
SHA256 da9bbebc50ba4463f66d800e4f748bd5489d411b93e2b14b72e9095c33545d69
SHA512 7404f98c6312fbe3c5ed747738de2655ca4bec1357f9566dabbb630ef110d39bfa03a5c5cf685d96c885ada550ef007358f9a5921d291dd0e2a486e41dd3d216

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

MD5 605e42c1174615ebb03fbd0f073383e0
SHA1 a939ee83654c4d534fe8b54c8f1b2e2a18072043
SHA256 5577426d83e3ee4d364d28f0aaaf9c361e21027dac215bff73bcc3c9f447fa4d
SHA512 7c9fa2f72347c2d635b78176aaddcf436956de4fc2a1eca821dc6ba11da2e3f0f982e0055ca96cf8a0b60d4597719606c4cc7dfb553b4fa50bbb642208da8534

C:\ProgramData\IDBGHDGHCGHC\BAEBGH

MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Analysis: behavioral3

Detonation Overview

Submitted

2024-07-11 12:18

Reported

2024-07-11 12:23

Platform

win11-20240709-en

Max time kernel

147s

Max time network

275s

Command Line

"C:\Users\Admin\AppData\Local\Temp\softorganizer.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\HCGCAAKJDH.exe N/A
N/A N/A C:\ProgramData\DGCFHIDAKE.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3576 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3576 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3576 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3576 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3576 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3576 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3576 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3576 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3576 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\softorganizer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3368 wrote to memory of 2068 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\HCGCAAKJDH.exe
PID 3368 wrote to memory of 2068 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\HCGCAAKJDH.exe
PID 3368 wrote to memory of 2068 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\HCGCAAKJDH.exe
PID 2068 wrote to memory of 4776 N/A C:\ProgramData\HCGCAAKJDH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2068 wrote to memory of 4776 N/A C:\ProgramData\HCGCAAKJDH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2068 wrote to memory of 4776 N/A C:\ProgramData\HCGCAAKJDH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2068 wrote to memory of 4776 N/A C:\ProgramData\HCGCAAKJDH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2068 wrote to memory of 4776 N/A C:\ProgramData\HCGCAAKJDH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2068 wrote to memory of 4776 N/A C:\ProgramData\HCGCAAKJDH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2068 wrote to memory of 4776 N/A C:\ProgramData\HCGCAAKJDH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2068 wrote to memory of 4776 N/A C:\ProgramData\HCGCAAKJDH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2068 wrote to memory of 4776 N/A C:\ProgramData\HCGCAAKJDH.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3368 wrote to memory of 4768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\DGCFHIDAKE.exe
PID 3368 wrote to memory of 4768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\DGCFHIDAKE.exe
PID 3368 wrote to memory of 4768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\ProgramData\DGCFHIDAKE.exe
PID 4768 wrote to memory of 760 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 760 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 760 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 2700 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 2700 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 2700 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 3160 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 3160 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 3160 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 3240 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 3240 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 3240 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 3240 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 3240 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 3240 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 3240 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 3240 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4768 wrote to memory of 3240 N/A C:\ProgramData\DGCFHIDAKE.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3368 wrote to memory of 2520 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 3368 wrote to memory of 2520 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 3368 wrote to memory of 2520 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\cmd.exe
PID 2520 wrote to memory of 3152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2520 wrote to memory of 3152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2520 wrote to memory of 3152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\softorganizer.exe

"C:\Users\Admin\AppData\Local\Temp\softorganizer.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

C:\ProgramData\HCGCAAKJDH.exe

"C:\ProgramData\HCGCAAKJDH.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\ProgramData\DGCFHIDAKE.exe

"C:\ProgramData\DGCFHIDAKE.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\GCFBAKKJDBKJ" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country Destination Domain Proto
US 8.8.8.8:53 steamcommunity.com udp
GB 104.82.234.109:443 steamcommunity.com tcp
US 8.8.8.8:53 109.234.82.104.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 77.105.132.27:80 77.105.132.27 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
US 104.21.30.130:443 stationacutwo.shop tcp
US 172.67.214.52:443 bouncedgowp.shop tcp
US 104.21.81.196:443 bannngwko.shop tcp
US 104.21.47.93:443 bargainnykwo.shop tcp
US 104.21.6.254:443 affecthorsedpo.shop tcp
FI 65.109.241.221:443 65.109.241.221 tcp
US 172.67.196.169:443 radiationnopp.shop tcp
US 8.8.8.8:53 169.196.67.172.in-addr.arpa udp
US 172.67.203.63:443 answerrsdo.shop tcp
US 104.21.25.154:443 publicitttyps.shop tcp
FI 65.109.241.221:443 65.109.241.221 tcp
US 104.21.81.128:443 benchillppwo.shop tcp
GB 104.82.234.109:443 steamcommunity.com tcp
FI 65.109.241.221:443 65.109.241.221 tcp
US 172.67.214.98:443 reinforcedirectorywd.shop tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
NL 185.107.56.203:80 tea.arpdabl.org tcp
US 199.59.243.226:80 survey-smiles.com tcp
GB 104.82.234.109:443 steamcommunity.com tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp
FI 65.109.241.221:443 65.109.241.221 tcp

Files

memory/3576-0-0x0000000074EAE000-0x0000000074EAF000-memory.dmp

memory/3576-1-0x0000000000590000-0x0000000000AF4000-memory.dmp

memory/3576-2-0x0000000005660000-0x00000000056FC000-memory.dmp

memory/3576-3-0x0000000074EA0000-0x0000000075651000-memory.dmp

memory/3576-4-0x0000000005820000-0x0000000005A2A000-memory.dmp

memory/3576-5-0x0000000005A30000-0x0000000005B84000-memory.dmp

memory/3576-6-0x0000000005550000-0x000000000556C000-memory.dmp

memory/3576-62-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-65-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-60-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-58-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3368-69-0x0000000000400000-0x0000000000648000-memory.dmp

memory/3576-70-0x0000000074EA0000-0x0000000075651000-memory.dmp

memory/3368-67-0x0000000000400000-0x0000000000648000-memory.dmp

memory/3576-54-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-50-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-48-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3368-73-0x0000000000400000-0x0000000000648000-memory.dmp

memory/3576-72-0x0000000074EA0000-0x0000000075651000-memory.dmp

memory/3576-44-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-42-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-40-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-39-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-66-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-36-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-34-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-32-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-30-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-28-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-26-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-24-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-20-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-18-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-14-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-12-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-10-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-8-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-56-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-52-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-46-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-22-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-16-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3576-7-0x0000000005550000-0x0000000005565000-memory.dmp

memory/3368-80-0x0000000000400000-0x0000000000648000-memory.dmp

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\HCGCAAKJDH.exe

MD5 5dcb471423fbb62d7c218760aee4936d
SHA1 7d72a2295639a8702ecdb77cc020b7a9eef48b04
SHA256 837340da10b33b25bca1c15db3b273bfde18110b46949e8c545f31756e7b44bd
SHA512 d8febe1cc91bbacd1b0298eb88d0d25f7789ee962f4d4717cb74ca1d1081ecab78a4062923b31386bcae141900ee99c182836e52bbb4b9f362cd8bdf687dc736

memory/4776-157-0x0000000000400000-0x000000000044F000-memory.dmp

C:\ProgramData\DGCFHIDAKE.exe

MD5 0b4cc01ce62da8ed72b98a896c11c1dd
SHA1 eb87a11df4f7a0066389094ee9ba8a4e189794ad
SHA256 6ab0929361ee1a7fdc900bb0f6e50e999183a7c1aef1f44951b7847e86dfd3bc
SHA512 b24fb55140210cc3c8d5f2dec84f36314a93397351a7109701b05dcb47cfbaf437c74fcafb551d8a96e845ea656a5c618b4a229c6acba8c2d0ed3849ccc48b8d

memory/3368-173-0x0000000000400000-0x0000000000648000-memory.dmp

memory/3368-174-0x0000000000400000-0x0000000000648000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\41XQO3A1\76561199735694209[1].htm

MD5 9cf7bea00610e043acbd0d9203cc74b8
SHA1 2cd9dae3ec095caa8527cd2c2ca7517004387ae3
SHA256 3407ea8c663fc9ffd59b2b40a658c99b5c2eff4dc61fc21a0fe4a8b2077bc6bd
SHA512 266fe90046e910ceb23ae786ed7a9b5c5530b807a3d1fb6470f228f8644b75f7f777108948120d597d072b0778604fb2ff4502addd020d337aa325fdfc874823

C:\ProgramData\IDAKJKEHDBGH\AAEBAF

MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad