Malware Analysis Report

2024-12-07 22:21

Sample ID 240809-w9f3rsxgmh
Target MEGHAN's+2023+Organizer+ExtensionPDF.zip
SHA256 4c1114b5fb8124e3c834f812bc32dc6230adee16f5bbe6986cb9e093b3850b09
Tags
remcos remotehost discovery persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4c1114b5fb8124e3c834f812bc32dc6230adee16f5bbe6986cb9e093b3850b09

Threat Level: Known bad

The file MEGHAN's+2023+Organizer+ExtensionPDF.zip was found to be: Known bad.

Malicious Activity Summary

remcos remotehost discovery persistence rat

Remcos

Blocklisted process makes network request

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of NtCreateThreadExHideFromDebugger

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-09 18:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-09 18:37

Reported

2024-08-09 18:40

Platform

win7-20240729-en

Max time kernel

83s

Max time network

17s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF.zip

Signatures

N/A

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF.zip

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-08-09 18:37

Reported

2024-08-09 18:39

Platform

win7-20240704-en

Max time kernel

141s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe"

Signatures

Remcos

rat remcos

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\FirefoxData.dll,EntryPoint" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2852 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe
PID 2852 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe
PID 2852 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe
PID 2852 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe
PID 2852 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe
PID 2852 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe
PID 2852 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe
PID 2852 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Windows\SysWOW64\cmd.exe
PID 2852 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Windows\SysWOW64\cmd.exe
PID 2852 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Windows\SysWOW64\cmd.exe
PID 2852 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Windows\SysWOW64\cmd.exe
PID 2528 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2528 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2528 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2528 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe

"C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe"

C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe

"C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f & exit

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 privmerkt.com udp
BE 172.111.244.2:6042 privmerkt.com tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp

Files

memory/2852-0-0x0000000011000000-0x0000000011369000-memory.dmp

memory/2852-1-0x0000000010000000-0x0000000010204000-memory.dmp

memory/2852-2-0x0000000010026000-0x0000000010040000-memory.dmp

memory/2852-3-0x0000000010000000-0x0000000010204000-memory.dmp

memory/2852-4-0x0000000010000000-0x0000000010204000-memory.dmp

memory/2852-13-0x0000000010000000-0x0000000010204000-memory.dmp

memory/2852-12-0x0000000010000000-0x0000000010204000-memory.dmp

memory/2752-15-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-14-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-10-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2752-9-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2752-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2752-5-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2852-17-0x0000000002390000-0x00000000026F9000-memory.dmp

memory/2752-18-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-16-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-19-0x0000000011000000-0x0000000011369000-memory.dmp

memory/2752-20-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2852-21-0x0000000011000000-0x0000000011369000-memory.dmp

memory/2752-22-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-23-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-24-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-27-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-28-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-29-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-30-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-31-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-32-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-33-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-34-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-35-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-36-0x00000000001B0000-0x0000000000232000-memory.dmp

memory/2752-37-0x00000000001B0000-0x0000000000232000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-08-09 18:37

Reported

2024-08-09 18:40

Platform

win10v2004-20240802-en

Max time kernel

138s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe"

Signatures

Remcos

rat remcos

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\FirefoxData.dll,EntryPoint" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2016 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe
PID 2016 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe
PID 2016 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe
PID 2016 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe
PID 2016 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe
PID 2016 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe
PID 2016 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2368 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2368 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe

"C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe"

C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe

"C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f & exit

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 privmerkt.com udp
BE 172.111.244.2:6042 privmerkt.com tcp
US 8.8.8.8:53 2.244.111.172.in-addr.arpa udp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 20.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/2016-0-0x0000000011000000-0x0000000011369000-memory.dmp

memory/2016-1-0x0000000010000000-0x0000000010204000-memory.dmp

memory/2016-2-0x0000000010000000-0x0000000010204000-memory.dmp

memory/2016-4-0x0000000010000000-0x0000000010204000-memory.dmp

memory/3232-5-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2016-8-0x0000000010000000-0x0000000010204000-memory.dmp

memory/2016-3-0x0000000010026000-0x0000000010040000-memory.dmp

memory/3232-9-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3232-10-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3232-11-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3232-12-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3232-13-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3232-14-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3232-15-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2016-16-0x0000000011000000-0x0000000011369000-memory.dmp

memory/3232-17-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3232-19-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3232-20-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3232-21-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3232-22-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3232-23-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3232-27-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3232-28-0x0000000000400000-0x0000000000482000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-08-09 18:37

Reported

2024-08-09 18:40

Platform

win10v2004-20240802-en

Max time kernel

148s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\msimg32.dll,#1

Signatures

Remcos

rat remcos

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\FirefoxData.dll,EntryPoint" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4160 wrote to memory of 1736 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4160 wrote to memory of 1736 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4160 wrote to memory of 1736 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1736 wrote to memory of 2064 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1736 wrote to memory of 2064 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1736 wrote to memory of 2064 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1736 wrote to memory of 2064 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1736 wrote to memory of 2064 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1736 wrote to memory of 2064 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1736 wrote to memory of 1404 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1736 wrote to memory of 1404 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1736 wrote to memory of 1404 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1404 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1404 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1404 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\msimg32.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\msimg32.dll,#1

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\SysWOW64\rundll32.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f & exit

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 privmerkt.com udp
BE 172.111.244.2:6042 privmerkt.com tcp
US 8.8.8.8:53 2.244.111.172.in-addr.arpa udp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 215.143.182.52.in-addr.arpa udp

Files

memory/1736-0-0x0000000010000000-0x0000000010204000-memory.dmp

memory/1736-3-0x0000000010000000-0x0000000010204000-memory.dmp

memory/1736-2-0x0000000010026000-0x0000000010040000-memory.dmp

memory/1736-1-0x0000000010000000-0x0000000010204000-memory.dmp

memory/1736-6-0x0000000010000000-0x0000000010204000-memory.dmp

memory/2064-7-0x00000000010F0000-0x0000000001172000-memory.dmp

memory/2064-4-0x0000000001180000-0x0000000001181000-memory.dmp

memory/2064-8-0x00000000010F0000-0x0000000001172000-memory.dmp

memory/2064-9-0x00000000010F0000-0x0000000001172000-memory.dmp

memory/2064-10-0x00000000010F0000-0x0000000001172000-memory.dmp

memory/2064-11-0x00000000010F0000-0x0000000001172000-memory.dmp

memory/2064-12-0x00000000010F0000-0x0000000001172000-memory.dmp

memory/2064-13-0x00000000010F0000-0x0000000001172000-memory.dmp

memory/2064-14-0x00000000010F0000-0x0000000001172000-memory.dmp

memory/2064-16-0x00000000010F0000-0x0000000001172000-memory.dmp

memory/2064-17-0x00000000010F0000-0x0000000001172000-memory.dmp

memory/2064-18-0x00000000010F0000-0x0000000001172000-memory.dmp

memory/2064-19-0x00000000010F0000-0x0000000001172000-memory.dmp

memory/2064-20-0x00000000010F0000-0x0000000001172000-memory.dmp

memory/2064-21-0x00000000010F0000-0x0000000001172000-memory.dmp

memory/2064-24-0x00000000010F0000-0x0000000001172000-memory.dmp

memory/2064-25-0x00000000010F0000-0x0000000001172000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-08-09 18:37

Reported

2024-08-09 18:40

Platform

win7-20240704-en

Max time kernel

150s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\msimg32.dll,#1

Signatures

Remcos

rat remcos

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\FirefoxData.dll,EntryPoint" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1624 wrote to memory of 1496 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1624 wrote to memory of 1496 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1624 wrote to memory of 1496 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1624 wrote to memory of 1496 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1624 wrote to memory of 1496 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1624 wrote to memory of 1496 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1624 wrote to memory of 1496 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1496 wrote to memory of 2604 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1496 wrote to memory of 2604 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1496 wrote to memory of 2604 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1496 wrote to memory of 2604 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1496 wrote to memory of 2604 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1496 wrote to memory of 2604 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1496 wrote to memory of 2604 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1496 wrote to memory of 2604 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1496 wrote to memory of 2604 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1496 wrote to memory of 2604 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1496 wrote to memory of 2648 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1496 wrote to memory of 2648 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1496 wrote to memory of 2648 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1496 wrote to memory of 2648 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2648 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2648 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2648 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\msimg32.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\msimg32.dll,#1

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\SysWOW64\rundll32.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f & exit

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 privmerkt.com udp
BE 172.111.244.2:6042 privmerkt.com tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp

Files

memory/1496-1-0x0000000010026000-0x0000000010040000-memory.dmp

memory/1496-2-0x0000000010000000-0x0000000010204000-memory.dmp

memory/1496-0-0x0000000010000000-0x0000000010204000-memory.dmp

memory/2604-4-0x0000000000180000-0x0000000000202000-memory.dmp

memory/1496-3-0x0000000010000000-0x0000000010204000-memory.dmp

memory/2604-11-0x0000000000180000-0x0000000000202000-memory.dmp

memory/1496-10-0x0000000010000000-0x0000000010204000-memory.dmp

memory/2604-8-0x00000000000D0000-0x00000000000D1000-memory.dmp

memory/2604-7-0x00000000000D0000-0x00000000000D1000-memory.dmp

memory/2604-13-0x0000000000180000-0x0000000000202000-memory.dmp

memory/2604-15-0x0000000000180000-0x0000000000202000-memory.dmp

memory/1496-12-0x0000000010000000-0x0000000010204000-memory.dmp

memory/2604-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2604-16-0x0000000000180000-0x0000000000202000-memory.dmp

memory/2604-17-0x0000000000180000-0x0000000000202000-memory.dmp

memory/2604-18-0x0000000000180000-0x0000000000202000-memory.dmp

memory/2604-19-0x0000000000180000-0x0000000000202000-memory.dmp

memory/2604-20-0x0000000000180000-0x0000000000202000-memory.dmp

memory/2604-22-0x0000000000180000-0x0000000000202000-memory.dmp

memory/2604-23-0x0000000000180000-0x0000000000202000-memory.dmp

memory/2604-24-0x0000000000180000-0x0000000000202000-memory.dmp

memory/2604-25-0x0000000000180000-0x0000000000202000-memory.dmp

memory/2604-26-0x0000000000180000-0x0000000000202000-memory.dmp

memory/2604-27-0x0000000000180000-0x0000000000202000-memory.dmp

memory/2604-28-0x0000000000180000-0x0000000000202000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-09 18:37

Reported

2024-08-09 18:45

Platform

win10v2004-20240802-en

Max time kernel

447s

Max time network

446s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF.zip

Signatures

Remcos

rat remcos

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\FirefoxData.dll,EntryPoint" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zG.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4036 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe
PID 4036 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe
PID 4036 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe
PID 4036 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe
PID 4036 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe
PID 4036 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe
PID 4036 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe C:\Windows\SysWOW64\cmd.exe
PID 4036 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe C:\Windows\SysWOW64\cmd.exe
PID 4036 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe C:\Windows\SysWOW64\cmd.exe
PID 796 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 796 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 796 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF.zip

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\" -spe -an -ai#7zMap21919:152:7zEvent25320

C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe

"C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe"

C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe

"C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f & exit

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 40.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 privmerkt.com udp
BE 172.111.244.2:6042 privmerkt.com tcp
US 8.8.8.8:53 2.244.111.172.in-addr.arpa udp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 44.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 104.246.116.51.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\TAXORGANIZERpdf.exe

MD5 30307b319b2451b6bf61d3e6b232f1da
SHA1 6a512848872be1325761e7ca110e0a1ee91cb0ef
SHA256 a7dbbad8a1cd038e5ab5b3c6b1b312774d808e4b0a2254e8039036972ac8881a
SHA512 7833ecb30a75324af6852e3583a609a653652f3cda9037ace7a1098ce7e52ed4b994c5ff1a0a0b4db748a01b06e8d4b8a10a50ebb9c0d4fbc8aa12dd1168f0b7

memory/4036-8-0x0000000011000000-0x0000000011369000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MEGHAN's+2023+Organizer+ExtensionPDF\msimg32.dll

MD5 5cc9588ffecb92d4def5283824bb44e9
SHA1 c78c47029d82c0f39ea9e876e8cf9d9a62904a21
SHA256 979401509e1295095800710e522397e08ab09296e55bdf4be502de18f5f61cad
SHA512 e808e8658e1844d50eca9acefecd6b1988ed95c48c6769ae6749c844fe398aff908e5885d896f65c72058d9ee5d0b2e06b8c03db0d72fe69367d3da8aa5e120d

memory/4036-11-0x0000000010000000-0x0000000010204000-memory.dmp

memory/4036-12-0x0000000010000000-0x0000000010204000-memory.dmp

memory/4968-13-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/4036-16-0x0000000010000000-0x0000000010204000-memory.dmp

memory/4968-19-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-17-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-20-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-21-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-22-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-23-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-24-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4036-27-0x0000000011000000-0x0000000011369000-memory.dmp

memory/4968-28-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-29-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-30-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-32-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-33-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-36-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-37-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-38-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-39-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-40-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-42-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-43-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-46-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-52-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4968-53-0x0000000000400000-0x0000000000482000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-08-09 18:37

Reported

2024-08-09 18:39

Platform

win7-20240704-en

Max time kernel

122s

Max time network

124s

Command Line

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1099.pdf"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1099.pdf"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 9ccafa5e1ee9ee4efce2621de367a5fa
SHA1 c0e1ee24a0ef7e29ef3ab320b50276d07601963a
SHA256 3cdb8321198a7b0e11217f262bf5beac0f07ce75ffa5f4da4fe24f7d2d89130d
SHA512 5030ad2ccb1904eb66c6e9313bc3a34c9ccb85e1b440f96e9a6321a1708e4f42401847d7c10b8f2e5eb7278202cf451e44796d18b1f4415feb4e4af0378a47f1

Analysis: behavioral4

Detonation Overview

Submitted

2024-08-09 18:37

Reported

2024-08-09 18:39

Platform

win10v2004-20240802-en

Max time kernel

102s

Max time network

126s

Command Line

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1099.pdf"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2552 wrote to memory of 1740 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2552 wrote to memory of 1740 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2552 wrote to memory of 1740 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 1980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1740 wrote to memory of 4888 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

Processes

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1099.pdf"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DD9B475ADEA4DD4365C13B4DCF3A118A --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BB5CA08CD0A18A0BFDFD324082AB6E9E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BB5CA08CD0A18A0BFDFD324082AB6E9E --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9A455D38A03F8C2D5483E05E3572CAA3 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A436F9B5ECE1D84021F54AC13075438A --mojo-platform-channel-handle=1876 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F6A898E930FF88DF5B66650331BFE6B5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F6A898E930FF88DF5B66650331BFE6B5 --renderer-client-id=6 --mojo-platform-channel-handle=2284 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=016700404BFBCC8CB67A897C82DE5BFA --mojo-platform-channel-handle=2716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 135.244.100.95.in-addr.arpa udp
US 8.8.8.8:53 146.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 22.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 d785f933ccaa69d617a787416843c8b8
SHA1 fddcb19ea08667233f7dac3cebfa895f31908cec
SHA256 a4779157c31a7d497e334d17d2ee4acd3615a27357c6bc86879f0d9e81e61ae9
SHA512 eef7e1c2a0122f307295896f2e8b5ac394b20d17562406f598d0323304520ae2fd6666f8b18d2d5516d5e55c5918bd1ae155f5d673ee96037b2af4469dcf1e9b

memory/2552-121-0x000000000A2C0000-0x000000000A56B000-memory.dmp