Malware Analysis Report

2024-10-19 08:36

Sample ID 240731-apcnyswhnr
Target 2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97
SHA256 2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97
Tags
quasar redline sectoprat exodusmarket.io office04 credential_access discovery infostealer rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97

Threat Level: Known bad

The file 2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97 was found to be: Known bad.

Malicious Activity Summary

quasar redline sectoprat exodusmarket.io office04 credential_access discovery infostealer rat spyware stealer trojan

Quasar payload

SectopRAT

SectopRAT payload

RedLine

Quasar RAT

RedLine payload

Credentials from Password Stores: Credentials from Web Browsers

Downloads MZ/PE file

Reads user/profile data of web browsers

Checks computer location settings

Executes dropped EXE

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-31 00:22

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-31 00:22

Reported

2024-07-31 00:25

Platform

win11-20240730-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Downloads MZ/PE file

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\adada.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2068 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2068 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2068 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2068 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2068 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2068 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2068 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2068 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3772 wrote to memory of 5004 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\pureee.exe
PID 3772 wrote to memory of 5004 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\pureee.exe
PID 3772 wrote to memory of 2344 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\adada.exe
PID 3772 wrote to memory of 2344 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\adada.exe
PID 3772 wrote to memory of 644 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
PID 3772 wrote to memory of 644 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
PID 3772 wrote to memory of 644 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
PID 2344 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\adada.exe C:\Windows\SYSTEM32\schtasks.exe
PID 2344 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\adada.exe C:\Windows\SYSTEM32\schtasks.exe
PID 5004 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 5004 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 5004 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 5004 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 5004 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 5004 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 5004 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 5004 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 5004 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 5004 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 5004 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 5004 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 5004 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 5004 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe

"C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\pureee.exe

"C:\Users\Admin\AppData\Local\Temp\pureee.exe"

C:\Users\Admin\AppData\Local\Temp\adada.exe

"C:\Users\Admin\AppData\Local\Temp\adada.exe"

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe

"C:\Users\Admin\AppData\Local\Temp\dropperrr.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

Network

Country Destination Domain Proto
NL 91.92.240.111:1334 91.92.240.111 tcp
US 8.8.8.8:53 111.240.92.91.in-addr.arpa udp
US 172.67.75.172:443 api.ip.sb tcp
NL 91.92.240.111:80 91.92.240.111 tcp
CH 185.196.9.187:80 185.196.9.187 tcp
NL 91.92.240.111:39001 tcp
NL 91.92.240.111:80 91.92.240.111 tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp

Files

memory/2068-0-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

memory/3772-1-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3772-2-0x00000000743FE000-0x00000000743FF000-memory.dmp

memory/3772-3-0x0000000005C10000-0x0000000006228000-memory.dmp

memory/3772-4-0x00000000054D0000-0x00000000054E2000-memory.dmp

memory/3772-5-0x0000000005530000-0x000000000556C000-memory.dmp

memory/3772-6-0x0000000005570000-0x00000000055BC000-memory.dmp

memory/3772-7-0x00000000743F0000-0x0000000074BA1000-memory.dmp

memory/3772-8-0x0000000005920000-0x0000000005A2A000-memory.dmp

memory/3772-9-0x0000000006AE0000-0x0000000006CA2000-memory.dmp

memory/3772-10-0x00000000071E0000-0x000000000770C000-memory.dmp

memory/3772-11-0x0000000006CB0000-0x0000000006D16000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpCA94.tmp

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Temp\tmpCAAA.tmp

MD5 d780b7995f84e5487be452d63157855b
SHA1 7df258685a42cb5cbff54aca7a8f347f16397ea6
SHA256 cc4eb56ac9e6043d5476d834932ef8eb9cfd4abaabe88ed9f6afdc5b70d42619
SHA512 d58077340001c6a1bd2b3280316a668c87e3dc8a4c7a1f8ff362bc29436ba4a214b3157474546b9876db2144fb4b570d6d7ef66d84481072996ef1760fe6fdb5

C:\Users\Admin\AppData\Local\Temp\tmpCAE5.tmp

MD5 14ccc9293153deacbb9a20ee8f6ff1b7
SHA1 46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3
SHA256 3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511
SHA512 916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

C:\Users\Admin\AppData\Local\Temp\tmpCAFA.tmp

MD5 22be08f683bcc01d7a9799bbd2c10041
SHA1 2efb6041cf3d6e67970135e592569c76fc4c41de
SHA256 451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457
SHA512 0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

C:\Users\Admin\AppData\Local\Temp\tmpCB10.tmp

MD5 87210e9e528a4ddb09c6b671937c79c6
SHA1 3c75314714619f5b55e25769e0985d497f0062f2
SHA256 eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
SHA512 f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

C:\Users\Admin\AppData\Local\Temp\tmpCB4B.tmp

MD5 40f3eb83cc9d4cdb0ad82bd5ff2fb824
SHA1 d6582ba879235049134fa9a351ca8f0f785d8835
SHA256 cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
SHA512 cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

memory/3772-166-0x0000000006FC0000-0x0000000007036000-memory.dmp

memory/3772-167-0x00000000070E0000-0x0000000007172000-memory.dmp

memory/3772-168-0x0000000007CC0000-0x0000000008266000-memory.dmp

memory/3772-169-0x0000000007730000-0x000000000774E000-memory.dmp

memory/3772-194-0x00000000743FE000-0x00000000743FF000-memory.dmp

memory/3772-195-0x00000000743F0000-0x0000000074BA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\pureee.exe

MD5 0006ad7b9f2a9b304e5b3790f6f18807
SHA1 00db2c60fca8aec6b504dd8fd4861a2e59a21fe9
SHA256 014d6c58dd7459c1664196ccd49b796f861d7d7e7e6c573bbb9cdc7cadc21450
SHA512 31fcde22e25be698ef2efd44cc65b758e8c9e8b62504f3254f9cc44bfaabdaa0c94cefceac12833372f8b2797b6bd0205bb9c8f1626e25ee4117d886198fb7db

memory/5004-207-0x000001E8E5260000-0x000001E8E530A000-memory.dmp

memory/5004-208-0x00007FF908863000-0x00007FF908865000-memory.dmp

memory/5004-209-0x000001E8FF8D0000-0x000001E8FF9DA000-memory.dmp

memory/5004-225-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-231-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-247-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-273-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-288-0x00007FF908860000-0x00007FF909322000-memory.dmp

memory/5004-271-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-270-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-267-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-265-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-263-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-261-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-259-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-257-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-255-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-253-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-251-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-249-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-245-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-243-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-241-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-239-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-237-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\adada.exe

MD5 9c682f5b5000cd003e76530706955a72
SHA1 1a69da76e05d114a317342dae3e9c7b10f107d43
SHA256 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522
SHA512 33bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f

memory/2344-300-0x0000000000CC0000-0x0000000000FE4000-memory.dmp

memory/5004-210-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-235-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-233-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-229-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-227-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-223-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-221-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-219-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe

MD5 35e7f1f850ca524d0eaa6522a4451834
SHA1 e98db252a62c84fd87416d2ec347de46ec053ebd
SHA256 2449fe334bbf8f09ff80422578a6c6961d20a0a456b214f6490c5ed1ae859c9e
SHA512 3b013378a51a29652ff84f61050b344f504ef51a51944d469b1d0e629e4abad979416a56b9cffb6cfe20b80dfbebffec35dce6f5dc10b02907dee538f9f17a01

memory/5004-217-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-215-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-213-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-211-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

memory/5004-4244-0x000001E880070000-0x000001E8800C6000-memory.dmp

memory/5004-4245-0x000001E8800D0000-0x000001E88011C000-memory.dmp

memory/5004-4254-0x00007FF908863000-0x00007FF908865000-memory.dmp

memory/5004-4255-0x00007FF908860000-0x00007FF909322000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-31 00:22

Reported

2024-07-31 00:25

Platform

win10v2004-20240730-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\adada.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 768 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 768 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 768 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 768 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 768 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 768 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 768 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 768 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 704 wrote to memory of 4616 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\pureee.exe
PID 704 wrote to memory of 4616 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\pureee.exe
PID 704 wrote to memory of 4684 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\adada.exe
PID 704 wrote to memory of 4684 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\adada.exe
PID 704 wrote to memory of 4536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
PID 704 wrote to memory of 4536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
PID 704 wrote to memory of 4536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
PID 4684 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\adada.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4684 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\adada.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4684 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\adada.exe C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
PID 4684 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\adada.exe C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
PID 720 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe C:\Windows\SYSTEM32\schtasks.exe
PID 720 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4616 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 4616 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 4616 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 4616 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 4616 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 4616 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 4616 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 4616 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 4616 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 4616 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 4616 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 4616 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 4616 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 4616 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe

"C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\pureee.exe

"C:\Users\Admin\AppData\Local\Temp\pureee.exe"

C:\Users\Admin\AppData\Local\Temp\adada.exe

"C:\Users\Admin\AppData\Local\Temp\adada.exe"

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe

"C:\Users\Admin\AppData\Local\Temp\dropperrr.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe

"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
NL 91.92.240.111:1334 91.92.240.111 tcp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 111.240.92.91.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp
US 8.8.8.8:53 31.13.26.104.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 91.92.240.111:80 91.92.240.111 tcp
NL 91.92.240.111:80 91.92.240.111 tcp
CH 185.196.9.187:80 185.196.9.187 tcp
US 8.8.8.8:53 187.9.196.185.in-addr.arpa udp
NL 91.92.240.111:39001 tcp
CA 51.222.21.20:4782 tcp
US 8.8.8.8:53 ipwho.is udp
DE 195.201.57.90:443 ipwho.is tcp
NL 91.92.240.111:80 91.92.240.111 tcp
US 8.8.8.8:53 20.21.222.51.in-addr.arpa udp
US 8.8.8.8:53 90.57.201.195.in-addr.arpa udp
GB 161.35.34.195:3333 rx.unmineable.com tcp
US 8.8.8.8:53 195.34.35.161.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/768-0-0x00000000009A0000-0x00000000009A1000-memory.dmp

memory/704-1-0x0000000000400000-0x000000000041E000-memory.dmp

memory/704-2-0x0000000074F6E000-0x0000000074F6F000-memory.dmp

memory/704-3-0x0000000005770000-0x0000000005D88000-memory.dmp

memory/704-4-0x0000000005190000-0x00000000051A2000-memory.dmp

memory/704-5-0x0000000005230000-0x000000000526C000-memory.dmp

memory/704-6-0x0000000005270000-0x00000000052BC000-memory.dmp

memory/704-7-0x0000000074F60000-0x0000000075710000-memory.dmp

memory/704-8-0x00000000054D0000-0x00000000055DA000-memory.dmp

memory/704-9-0x0000000006530000-0x00000000066F2000-memory.dmp

memory/704-10-0x0000000006C30000-0x000000000715C000-memory.dmp

memory/704-26-0x00000000064C0000-0x0000000006526000-memory.dmp

memory/704-27-0x0000000007710000-0x0000000007CB4000-memory.dmp

memory/704-28-0x0000000006950000-0x00000000069E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpE565.tmp

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Temp\tmpE57A.tmp

MD5 3914229ad727c7cd45e8a32ad29036a4
SHA1 d01f833636d7972e1fe488925b21f8d8a2c987e9
SHA256 6c93e72f201c3172c2b1b2a5ee1b5e13bbf57078b9b7e2298019ad0d6463d1f1
SHA512 fab86a83e0feb9df02c7ffede3ad0a6fa139e8707526ed2b06c139bb7d341b8515832ea4b07144ac11eeab5646d461c7fb2c73492f5a951755e0a29a3baac103

C:\Users\Admin\AppData\Local\Temp\tmpE5A5.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmpE5C1.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\tmpE5AB.tmp

MD5 49693267e0adbcd119f9f5e02adf3a80
SHA1 3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512 b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

C:\Users\Admin\AppData\Local\Temp\tmpE5FC.tmp

MD5 40f3eb83cc9d4cdb0ad82bd5ff2fb824
SHA1 d6582ba879235049134fa9a351ca8f0f785d8835
SHA256 cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
SHA512 cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

memory/704-183-0x0000000006B70000-0x0000000006BE6000-memory.dmp

memory/704-184-0x0000000007180000-0x000000000719E000-memory.dmp

memory/704-185-0x0000000074F6E000-0x0000000074F6F000-memory.dmp

memory/704-186-0x0000000074F60000-0x0000000075710000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\pureee.exe

MD5 0006ad7b9f2a9b304e5b3790f6f18807
SHA1 00db2c60fca8aec6b504dd8fd4861a2e59a21fe9
SHA256 014d6c58dd7459c1664196ccd49b796f861d7d7e7e6c573bbb9cdc7cadc21450
SHA512 31fcde22e25be698ef2efd44cc65b758e8c9e8b62504f3254f9cc44bfaabdaa0c94cefceac12833372f8b2797b6bd0205bb9c8f1626e25ee4117d886198fb7db

memory/4616-198-0x000001C7A9240000-0x000001C7A92EA000-memory.dmp

memory/4616-199-0x00007FFD2F423000-0x00007FFD2F425000-memory.dmp

memory/4616-200-0x000001C7C37F0000-0x000001C7C38FA000-memory.dmp

memory/4616-201-0x00007FFD2F420000-0x00007FFD2FEE1000-memory.dmp

memory/4616-215-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-219-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-247-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-263-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-261-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-259-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-257-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-255-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-253-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-251-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-249-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-245-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-243-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-241-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-239-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-235-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-233-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-231-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-229-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-227-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-225-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-224-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-221-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-217-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-213-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-211-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-210-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-207-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-205-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-203-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-237-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

memory/4616-202-0x000001C7C37F0000-0x000001C7C38F5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\adada.exe

MD5 9c682f5b5000cd003e76530706955a72
SHA1 1a69da76e05d114a317342dae3e9c7b10f107d43
SHA256 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522
SHA512 33bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f

memory/4684-4225-0x00000000007A0000-0x0000000000AC4000-memory.dmp

memory/4616-4227-0x000001C7C3760000-0x000001C7C37AC000-memory.dmp

memory/4616-4226-0x000001C7C3700000-0x000001C7C3756000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe

MD5 35e7f1f850ca524d0eaa6522a4451834
SHA1 e98db252a62c84fd87416d2ec347de46ec053ebd
SHA256 2449fe334bbf8f09ff80422578a6c6961d20a0a456b214f6490c5ed1ae859c9e
SHA512 3b013378a51a29652ff84f61050b344f504ef51a51944d469b1d0e629e4abad979416a56b9cffb6cfe20b80dfbebffec35dce6f5dc10b02907dee538f9f17a01

memory/720-4242-0x000000001BBB0000-0x000000001BC00000-memory.dmp

memory/720-4243-0x000000001EC30000-0x000000001ECE2000-memory.dmp

memory/720-4244-0x000000001EB70000-0x000000001EB82000-memory.dmp

memory/720-4245-0x000000001EBD0000-0x000000001EC0C000-memory.dmp

memory/4616-4254-0x00007FFD2F423000-0x00007FFD2F425000-memory.dmp

memory/4616-4255-0x00007FFD2F420000-0x00007FFD2FEE1000-memory.dmp

memory/704-4257-0x0000000074F60000-0x0000000075710000-memory.dmp