Malware Analysis Report

2024-09-11 09:52

Sample ID 240718-r4k3bashpn
Target 13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe
SHA256 13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5
Tags
redline sectoprat cheat execution infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5

Threat Level: Known bad

The file 13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe was found to be: Known bad.

Malicious Activity Summary

redline sectoprat cheat execution infostealer rat trojan

SectopRAT payload

RedLine

RedLine payload

SectopRAT

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Persistence
TA0003
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-18 14:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-18 14:44

Reported

2024-07-18 14:47

Platform

win7-20240704-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2812 set thread context of 1732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2800 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2800 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2800 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2800 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2812 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2812 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2812 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2812 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2812 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2812 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2812 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2812 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2812 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2812 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2812 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2812 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2812 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2812 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2812 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2812 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2812 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2812 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2812 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2812 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2812 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Processes

C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe

"C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AdCwxzRPlmXEbv.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AdCwxzRPlmXEbv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2FF6.tmp"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

Network

Country Destination Domain Proto
NL 185.222.57.153:55615 185.222.57.153 tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp

Files

memory/2800-4-0x00000000004E0000-0x00000000004E2000-memory.dmp

memory/2684-5-0x0000000000180000-0x0000000000182000-memory.dmp

memory/2684-6-0x0000000000450000-0x0000000000451000-memory.dmp

\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

MD5 22c86949178066a53d70309553f8b44e
SHA1 eb4a99acdc4b638528902c8e8480bc1f58a457b5
SHA256 b9d43a80163b702f8c3d2aac0409bb2d945368e68b9c4cbe29e888ceff2fb953
SHA512 0364deec86a6658b6d5b9085fd84f4cfef57b59a45ecfa5625de6a0e8bb6c5387644af66a0374f053c23045a370717abf3c97a8376deed3ed8cb01a7206cbb72

memory/2812-21-0x0000000000960000-0x0000000000A0A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpg

MD5 e83ccb51ee74efd2a221be293d23c69a
SHA1 4365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256 da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA512 0252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46

memory/2812-23-0x0000000004890000-0x0000000004902000-memory.dmp

memory/2812-24-0x0000000000370000-0x0000000000380000-memory.dmp

memory/2812-25-0x0000000000540000-0x000000000054E000-memory.dmp

memory/2812-26-0x0000000005270000-0x00000000052D0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 d23037b0eff19060ac445852dd082445
SHA1 a41c1f658cd6ce05d56a208b4c46412abce40e74
SHA256 4dc2b43cad929d8f754c61673fda31bd6824ebc0080cdaa505fb987c24e09653
SHA512 4293060b0767430f33a2826b88948e8890ff7f84238595be648f16ed84d16fb20b29d4e0af976e4744df16fe68a7e27df46b5327482e8c31da81b8cbe22339a8

C:\Users\Admin\AppData\Local\Temp\tmp2FF6.tmp

MD5 abf5f4e9a31411bbd95e2a3933145f77
SHA1 78accd11dd4fe969df861f512b9d30e51c01ef1a
SHA256 f22386dc8644f0e213de1a74676ee3379f868f3b091cd77e0d96071a40c5ef6b
SHA512 4964ff4251ba79ca05419b2d8d45f09d0fb10aef361ffcd77001ca92d0638e0a9f4354ca85e3fcb8c9c04c8a6e10555f8f27c156c12834a190d0173cff801af2

memory/1732-40-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1732-46-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1732-49-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1732-48-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1732-44-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1732-42-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1732-51-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1732-52-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2684-53-0x0000000000450000-0x0000000000451000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-18 14:44

Reported

2024-07-18 14:47

Platform

win10v2004-20240709-en

Max time kernel

138s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1944 set thread context of 732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3540 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 3540 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 3540 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1944 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1944 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1944 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1944 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1944 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1944 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1944 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 1944 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 1944 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 1944 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1944 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1944 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1944 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1944 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1944 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1944 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1944 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Processes

C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe

"C:\Users\Admin\AppData\Local\Temp\13905f844c59906aaf353a12fc820dfeb56f5f1d781ca5b20e24bb20d1542ab5.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AdCwxzRPlmXEbv.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AdCwxzRPlmXEbv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8F4.tmp"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
NL 185.222.57.153:55615 185.222.57.153 tcp
US 8.8.8.8:53 153.57.222.185.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 172.67.75.172:443 api.ip.sb tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.75.67.172.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

MD5 22c86949178066a53d70309553f8b44e
SHA1 eb4a99acdc4b638528902c8e8480bc1f58a457b5
SHA256 b9d43a80163b702f8c3d2aac0409bb2d945368e68b9c4cbe29e888ceff2fb953
SHA512 0364deec86a6658b6d5b9085fd84f4cfef57b59a45ecfa5625de6a0e8bb6c5387644af66a0374f053c23045a370717abf3c97a8376deed3ed8cb01a7206cbb72

memory/1944-14-0x000000007298E000-0x000000007298F000-memory.dmp

memory/1944-15-0x00000000002E0000-0x000000000038A000-memory.dmp

memory/1944-16-0x00000000053D0000-0x0000000005974000-memory.dmp

memory/1944-17-0x0000000004D20000-0x0000000004DB2000-memory.dmp

memory/1944-18-0x0000000004DF0000-0x0000000004DFA000-memory.dmp

memory/1944-19-0x0000000072980000-0x0000000073130000-memory.dmp

memory/1944-20-0x00000000063F0000-0x0000000006462000-memory.dmp

memory/1944-21-0x0000000005120000-0x0000000005130000-memory.dmp

memory/1944-22-0x0000000006490000-0x000000000649E000-memory.dmp

memory/1944-23-0x00000000066F0000-0x0000000006750000-memory.dmp

memory/1944-24-0x0000000006550000-0x00000000065EC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpg

MD5 e83ccb51ee74efd2a221be293d23c69a
SHA1 4365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256 da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA512 0252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46

memory/684-30-0x0000000000C70000-0x0000000000CA6000-memory.dmp

memory/684-31-0x0000000004CC0000-0x00000000052E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8F4.tmp

MD5 83995c6689a1b6520afaf84addb72e3d
SHA1 03577eb90125a27b5a83457c870aeefda105cc11
SHA256 a6395dec786b2bd39b2b498fca361223974d422dccc0849a1bdfc72091233323
SHA512 e65dba02151fa5684e61df9c14242facdff55f537a1f61b48ac929dcc221261769b8ba286d6c110cd574ea7ef90565d132f5ab872eafa892672bd3440218a762

memory/684-33-0x0000000004A40000-0x0000000004A62000-memory.dmp

memory/684-35-0x00000000053D0000-0x0000000005436000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5xxr25cn.mtk.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1944-49-0x0000000072980000-0x0000000073130000-memory.dmp

memory/684-48-0x0000000005440000-0x0000000005794000-memory.dmp

memory/732-36-0x0000000000400000-0x000000000041E000-memory.dmp

memory/684-34-0x00000000052F0000-0x0000000005356000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO.exe.log

MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

memory/732-60-0x0000000005E50000-0x0000000006468000-memory.dmp

memory/732-61-0x0000000005730000-0x0000000005742000-memory.dmp

memory/684-62-0x0000000005A20000-0x0000000005A3E000-memory.dmp

memory/732-64-0x0000000005790000-0x00000000057CC000-memory.dmp

memory/684-63-0x0000000005A50000-0x0000000005A9C000-memory.dmp

memory/732-65-0x0000000005A40000-0x0000000005B4A000-memory.dmp

memory/4072-67-0x0000000070080000-0x00000000700CC000-memory.dmp

memory/4072-66-0x0000000006D80000-0x0000000006DB2000-memory.dmp

memory/684-77-0x0000000070080000-0x00000000700CC000-memory.dmp

memory/4072-87-0x00000000060E0000-0x00000000060FE000-memory.dmp

memory/4072-88-0x0000000006DC0000-0x0000000006E63000-memory.dmp

memory/4072-89-0x0000000007520000-0x0000000007B9A000-memory.dmp

memory/4072-90-0x0000000006ED0000-0x0000000006EEA000-memory.dmp

memory/4072-91-0x0000000006F50000-0x0000000006F5A000-memory.dmp

memory/684-92-0x0000000006FC0000-0x0000000007056000-memory.dmp

memory/684-93-0x0000000006F40000-0x0000000006F51000-memory.dmp

memory/684-94-0x0000000006F70000-0x0000000006F7E000-memory.dmp

memory/4072-95-0x0000000007110000-0x0000000007124000-memory.dmp

memory/4072-96-0x0000000007210000-0x000000000722A000-memory.dmp

memory/4072-97-0x00000000071F0000-0x00000000071F8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cfde5002f0a5f336315faddcd5f34264
SHA1 51cc00bfc43b90c59c1167ca5c427703bedd523e
SHA256 07f48345ee310c99dc8981ffd50531e04e817d054fa2ab58ad5ac90cfb9a85f6
SHA512 835468011cb988173d22804d75e6e384c982dd84d0b680962bc915f4f87e7bf5f844f73bf0a8065b4ee350bf755313e4a610bfde05a0c8d9cf0821e947b94b3a

memory/732-103-0x0000000006D20000-0x0000000006EE2000-memory.dmp

memory/732-104-0x0000000007420000-0x000000000794C000-memory.dmp