Malware Analysis Report

2024-11-16 12:10

Sample ID 240715-n2b5vaxgrh
Target PO supplies 15 7 24.exe
SHA256 08666ef4278f5e77d441949a6069b712fd4908fc75df489ed9289daa5ff3cf5e
Tags
neshta execution persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

08666ef4278f5e77d441949a6069b712fd4908fc75df489ed9289daa5ff3cf5e

Threat Level: Known bad

The file PO supplies 15 7 24.exe was found to be: Known bad.

Malicious Activity Summary

neshta execution persistence spyware stealer

Neshta

Command and Scripting Interpreter: PowerShell

Modifies system executable filetype association

Reads user/profile data of web browsers

Loads dropped DLL

Checks computer location settings

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-15 11:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-15 11:53

Reported

2024-07-15 11:55

Platform

win7-20240705-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2820 set thread context of 3020 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2820 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2820 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2820 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2820 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2820 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2820 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2820 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2820 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2820 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\schtasks.exe
PID 2820 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\schtasks.exe
PID 2820 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\schtasks.exe
PID 2820 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\schtasks.exe
PID 2820 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2820 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2820 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2820 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2820 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2820 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2820 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2820 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2820 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2820 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2820 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2820 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

"C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QBloUDNxsti.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QBloUDNxsti" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8F83.tmp"

C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

"C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

Network

N/A

Files

memory/2820-0-0x00000000741BE000-0x00000000741BF000-memory.dmp

memory/2820-1-0x0000000000C80000-0x0000000000D3C000-memory.dmp

memory/2820-2-0x00000000741B0000-0x000000007489E000-memory.dmp

memory/2820-3-0x0000000000630000-0x000000000064A000-memory.dmp

memory/2820-4-0x00000000006A0000-0x00000000006AE000-memory.dmp

memory/2820-5-0x0000000004E00000-0x0000000004E8E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TGFOOFQEVRG7U5OW5A33.temp

MD5 fa0e68c3d6878fbeca278d8718708b3a
SHA1 89a321a0ebdb226b7278b19f051522f5980e1111
SHA256 c65c38f5f81e690eccc632404660ea2d6c821042041bbfefd5476ac6b2fdb1f4
SHA512 0a7cb5d9862d8e9635739424ad5943a1bb390e67cb67247b3f7c979a15ad6a0bd3a55aaf5df3c4c2602a976511daef6f7b9d56def01c7fcb8aa59a6c2ca3d8e0

C:\Users\Admin\AppData\Local\Temp\tmp8F83.tmp

MD5 3c0d3592d2b748f62508768029be0513
SHA1 727960b8025464244ea082b051c947365ab88146
SHA256 0d2d3724c8016cddf4fe1b759af0800a9207b0a90736c49918b67a7984c4c969
SHA512 f23881c08df60af15c10d08cc4855407d37203a0714a763acae3493e58be834beb0d9575788bbcfef513dd507b8ff299b04b7216c2c3df8665dccb6d1ad511ae

memory/3020-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3020-18-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3020-34-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3020-33-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3020-30-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3020-28-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3020-26-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3020-24-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3020-22-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3020-20-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2820-36-0x00000000741B0000-0x000000007489E000-memory.dmp

C:\Windows\svchost.com

MD5 831ea2d64c8371b5fb5c293902f942dd
SHA1 41bda99a7dcda14fffc5297f77d73deccf7e52f9
SHA256 0be3fe232479bb98c0801b5b5279e6f0527d470cf93236c9cc8109dd8bf6b268
SHA512 eb195b26b63bff3102231be5fcef9e700b23af42485719c1b77e30b06efd7cfd2c170a46d756c38d8056f0a9fa12fd25564bf21a700238035f4d066afadc0b0a

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

C:\Users\Admin\AppData\Roaming\QBLOUD~1.EXE

MD5 8c4507c84e866d7a0677244d94c439f6
SHA1 b7917d2630306f79444a473903c0170ce8e58abe
SHA256 08666ef4278f5e77d441949a6069b712fd4908fc75df489ed9289daa5ff3cf5e
SHA512 950b7452c9047f24baec92101973fd3d4fdfac7f81cc2208df2a20de46db43b54eb411fa48442df5cf963ba18286047490b920529906149a8e1d9a5605bf01e1

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-15 11:53

Reported

2024-07-15 11:55

Platform

win10v2004-20240704-en

Max time kernel

143s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4728 set thread context of 2396 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.41\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~2.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MI391D~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4728 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4728 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4728 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4728 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4728 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4728 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4728 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\schtasks.exe
PID 4728 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\schtasks.exe
PID 4728 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\schtasks.exe
PID 4728 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 4728 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

"C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QBloUDNxsti.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QBloUDNxsti" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE29F.tmp"

C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

"C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

"C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

"C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp

Files

memory/4728-0-0x00000000746CE000-0x00000000746CF000-memory.dmp

memory/4728-1-0x00000000005F0000-0x00000000006AC000-memory.dmp

memory/4728-2-0x0000000005560000-0x0000000005B04000-memory.dmp

memory/4728-3-0x0000000005050000-0x00000000050E2000-memory.dmp

memory/4728-4-0x0000000005120000-0x000000000512A000-memory.dmp

memory/4728-5-0x00000000746C0000-0x0000000074E70000-memory.dmp

memory/4728-6-0x0000000005420000-0x000000000543A000-memory.dmp

memory/4728-7-0x0000000006210000-0x000000000621E000-memory.dmp

memory/4728-8-0x0000000006270000-0x00000000062FE000-memory.dmp

memory/4728-9-0x0000000009DB0000-0x0000000009E4C000-memory.dmp

memory/2496-14-0x0000000000B30000-0x0000000000B66000-memory.dmp

memory/2496-15-0x00000000746C0000-0x0000000074E70000-memory.dmp

memory/2496-16-0x0000000005090000-0x00000000056B8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpE29F.tmp

MD5 ef2ba6a06136a969e06399264757e718
SHA1 43daf81f8eb1a8531dbe558d2462934bad39c508
SHA256 db15e988876d2b21500dcfc070fc139f069962d2c58a0e64ddc116ae425dcc43
SHA512 33315fd748013e378800f8b64c0132542bcc8400a7c79901b8f9e9cc74c2caa8af208e4465c23bb3206e1309ab6831a75f357c9a9cde85c55c66cdfe433d3803

memory/1928-18-0x00000000746C0000-0x0000000074E70000-memory.dmp

memory/1928-19-0x00000000746C0000-0x0000000074E70000-memory.dmp

memory/2396-20-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2396-21-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2396-22-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2496-25-0x0000000004E40000-0x0000000004E62000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wasqtddd.jf3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2496-27-0x00000000746C0000-0x0000000074E70000-memory.dmp

memory/2496-34-0x0000000004FC0000-0x0000000005026000-memory.dmp

memory/2496-33-0x0000000004EE0000-0x0000000004F46000-memory.dmp

memory/2496-48-0x00000000057C0000-0x0000000005B14000-memory.dmp

memory/4728-26-0x00000000746C0000-0x0000000074E70000-memory.dmp

memory/2396-50-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1928-49-0x00000000746C0000-0x0000000074E70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\PO supplies 15 7 24.exe

MD5 ae303747897daf45e48698d2ae593960
SHA1 b9349e9bf97e84e1490450a6a71f364a8a18ba40
SHA256 6ad9d05e2f8ab4b9050da219cc18aef707fd79ff7ee6e108bfb5f1d262c26dbb
SHA512 6386c4b064a957481a52faf153fc93af4029f2ade078656a359a8e0398c0329df6a903062a16868dc69efb06489af61a52aeccea4958402ddf46315f0b6ff16b

C:\Windows\svchost.com

MD5 831ea2d64c8371b5fb5c293902f942dd
SHA1 41bda99a7dcda14fffc5297f77d73deccf7e52f9
SHA256 0be3fe232479bb98c0801b5b5279e6f0527d470cf93236c9cc8109dd8bf6b268
SHA512 eb195b26b63bff3102231be5fcef9e700b23af42485719c1b77e30b06efd7cfd2c170a46d756c38d8056f0a9fa12fd25564bf21a700238035f4d066afadc0b0a

memory/2496-59-0x0000000005C00000-0x0000000005C1E000-memory.dmp

memory/2496-62-0x0000000005F70000-0x0000000005FBC000-memory.dmp

memory/1928-64-0x0000000070960000-0x00000000709AC000-memory.dmp

memory/1928-74-0x0000000006800000-0x000000000681E000-memory.dmp

memory/1928-63-0x0000000006820000-0x0000000006852000-memory.dmp

memory/1928-75-0x00000000072B0000-0x0000000007353000-memory.dmp

memory/1928-77-0x0000000007560000-0x000000000757A000-memory.dmp

memory/1928-76-0x0000000007BE0000-0x000000000825A000-memory.dmp

memory/2496-78-0x0000000070960000-0x00000000709AC000-memory.dmp

memory/1928-88-0x00000000075D0000-0x00000000075DA000-memory.dmp

memory/1928-89-0x00000000077E0000-0x0000000007876000-memory.dmp

memory/1928-100-0x0000000007760000-0x0000000007771000-memory.dmp

memory/1928-105-0x0000000007790000-0x000000000779E000-memory.dmp

memory/1928-106-0x00000000077A0000-0x00000000077B4000-memory.dmp

memory/1928-111-0x00000000078A0000-0x00000000078BA000-memory.dmp

memory/1928-119-0x0000000007880000-0x0000000007888000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 0480827a07a59cf10053a80308763aa7
SHA1 1927313be7963c2d321d0d9da612526a5a38bff6
SHA256 1d40f2e9599803304f6648e08eb6624fc4e08f1dd6ba51847ff6e8dc90d6bfe0
SHA512 2ed9f230e7cd0d31f266b79b7654691b95d9409dd8f2b4bf821069ee00e66807f4da3dc1e33574fccf301db4b98a2a8bf8cf74be142bdd05c825e14b770c8cc7

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/1928-169-0x00000000746C0000-0x0000000074E70000-memory.dmp

memory/2496-170-0x00000000746C0000-0x0000000074E70000-memory.dmp

C:\Users\Admin\AppData\Roaming\QBLOUD~1.EXE

MD5 8c4507c84e866d7a0677244d94c439f6
SHA1 b7917d2630306f79444a473903c0170ce8e58abe
SHA256 08666ef4278f5e77d441949a6069b712fd4908fc75df489ed9289daa5ff3cf5e
SHA512 950b7452c9047f24baec92101973fd3d4fdfac7f81cc2208df2a20de46db43b54eb411fa48442df5cf963ba18286047490b920529906149a8e1d9a5605bf01e1

memory/2396-187-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2396-189-0x0000000000400000-0x000000000041B000-memory.dmp