Malware Analysis Report

2024-10-18 21:30

Sample ID 240818-hn1cma1fpd
Target 456c0f28c52578f27a0859bde7cd01543bbacb94295d195b440a097a000f1ced
SHA256 456c0f28c52578f27a0859bde7cd01543bbacb94295d195b440a097a000f1ced
Tags
stormkitty discovery stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

456c0f28c52578f27a0859bde7cd01543bbacb94295d195b440a097a000f1ced

Threat Level: Known bad

The file 456c0f28c52578f27a0859bde7cd01543bbacb94295d195b440a097a000f1ced was found to be: Known bad.

Malicious Activity Summary

stormkitty discovery stealer

StormKitty payload

StormKitty

Suspicious use of NtCreateUserProcessOtherParentProcess

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Enumerates processes with tasklist

Drops file in Windows directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-18 06:53

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-18 06:53

Reported

2024-08-18 06:56

Platform

win7-20240708-en

Max time kernel

149s

Max time network

123s

Command Line

C:\Windows\Explorer.EXE

Signatures

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2640 created 1188 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Windows\Explorer.EXE

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\AnchorAnnotated C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe N/A
File opened for modification C:\Windows\CheckingReliable C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe N/A
File opened for modification C:\Windows\ConferencesInto C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe N/A
File opened for modification C:\Windows\GamblingCedar C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\choice.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2408 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1680 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1680 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1680 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1680 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1680 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1680 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1680 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1680 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1680 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1680 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1680 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1680 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1680 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1680 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1680 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1680 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1680 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1680 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1680 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1680 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif
PID 1680 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif
PID 1680 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif
PID 1680 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif
PID 1680 wrote to memory of 2788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 1680 wrote to memory of 2788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 1680 wrote to memory of 2788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 1680 wrote to memory of 2788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 2640 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
PID 2640 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
PID 2640 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
PID 2640 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
PID 2640 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
PID 2640 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
PID 2640 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
PID 2640 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
PID 2640 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe

"C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k move Surrey Surrey.cmd && Surrey.cmd && exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 719580

C:\Windows\SysWOW64\findstr.exe

findstr /V "copehebrewinquireinnocent" Corpus

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b ..\Utilize + ..\Verzeichnis + ..\Built + ..\Vessels + ..\Cradle + ..\Jaguar + ..\Comics + ..\Flux + ..\Liberal f

C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif

Optimum.pif f

C:\Windows\SysWOW64\choice.exe

choice /d y /t 5

C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 PdvZAJjtltegTAllAQLr.PdvZAJjtltegTAllAQLr udp
FI 65.108.46.186:1337 tcp

Files

C:\Users\Admin\AppData\Local\Temp\Surrey

MD5 721cde52d197da4629a6792103404e23
SHA1 1f5bac364c6b9546ba0501f41766bb25df98b32b
SHA256 66627eef98fb038f1d22f620bc8d85430a442d08313602eb02f0b158b5471812
SHA512 63a6786227915bc450ea9ca4df4962126b4194a1fd5c68fe3c686da8175726d4efdda5e88aedea7b8e4e758816b9b31981fa79e37dbe51028650def5042ccac6

C:\Users\Admin\AppData\Local\Temp\Corpus

MD5 148febc94e0f8036a074350ef338b007
SHA1 1be93210e5348f9409fe4162599dfaad797a2ade
SHA256 849892bc358956ee263db6cbddd4a9cca0e1564d6caefe44e2e998d559e610a0
SHA512 72b83e8cb35bf6fe295f1cb84197f3ffb4944e19b9ece9f6664ed2bc4aca40c9c912debf260e891c80feebb4c84935da4c2996b9a100ce94cde177928f31fa92

C:\Users\Admin\AppData\Local\Temp\Folding

MD5 67ff730b62d42030058393ab3f0dafd1
SHA1 79215f079836dd43b4f7b1e66739bd7dab9fb6a3
SHA256 95d53427ef46fb44354a0253a611e342a30428101acaf83215f5b21432afbff1
SHA512 6e7d6f12686b0b30c96eebe01546e4aee1adee39a7467409e8f41de9a37c65daa010ebcefa6c452d4849e7ba0bec9be55be1b38250420b40e2956c151478d973

C:\Users\Admin\AppData\Local\Temp\Utilize

MD5 4bb39f0bce8a4f7b640ba76ecccaf87b
SHA1 c0c7feca88b0fc3fc1f20d1963ae25388a1f4c12
SHA256 96af995b201e5392293f2d7272b1c9a3f0eb671d62aeafffb4b0bbbfed0e3560
SHA512 ad2752281067584233cc19b3d0bbd0178dc3907af71c8dc3c37afe35f417afe1b1fc4d9ad2d99506d53100afde8ddb692e93669b8c9398782cb03dc22a04e1ef

C:\Users\Admin\AppData\Local\Temp\Verzeichnis

MD5 6a5ab833602af088d60d3d7f89b77229
SHA1 32f9fe7c6ba035993a627a78491651f02d0dfc97
SHA256 41586643456496d40c3279839a1cb1528428c19deefb4c702bd58f1467a1a1d0
SHA512 0598b2b38270a8d282ae2325330420b467be203047dffc2e85626fd78e78f81c5084487eebfbefbcb36115732a6670a9857655c18803388c02e37fbcf51aaa66

C:\Users\Admin\AppData\Local\Temp\Built

MD5 0a91386341f9d1a371bc735576b276a4
SHA1 a02598ef42cef1443cc94a8310a6c02df07119d4
SHA256 7b857693641ff1ff59e69422b09299a5580d20677acd530c27c7fbc9e3ee3b92
SHA512 b492508575c01689c982a8eb57fac2b5759e4c843c92f99d231b63c25ab4c82fa7fece9d4e9c2cc436a3232b4ed7947baecf2a06aafbf1a3cf243395af71e96b

C:\Users\Admin\AppData\Local\Temp\Vessels

MD5 d64ef3bbcca2c221c0bcc85a7b6d5209
SHA1 5c3cf9d492c7021e19e103fa14ab3965fd1c6ba3
SHA256 c8c35545936faa3b0e00aa1b907952e97fffd9c1958045253863b4c2fad7f295
SHA512 2b6713646373b5b233295930a46fefbd499b607a94051c6294d3dce12f58b187c98f22f7f0b1243f22611a82c659b1d95f70a7858247b8f0853a1765d449e611

C:\Users\Admin\AppData\Local\Temp\Cradle

MD5 8c59dae352a159e484b0de9603dabc11
SHA1 34992e582081635abf736ec18f1492ae40ca4925
SHA256 3ab028b25bd6bd3ba48a92c4198dd8ff07fe71b4b41c785469d79da422f2fe46
SHA512 cf041cc9470ac479702c19714d875868a5168940a8d56715a98ae3d52f0363ffab160566d7c364b1bd9e8cb263b7e2b60e6719dbac7b6ad12e5f6a87e4f57d8e

C:\Users\Admin\AppData\Local\Temp\Jaguar

MD5 fdadac1c5944e618315f608ad2f02714
SHA1 debe3ccc5a4abc326dbcb4a86ec8074671a3417f
SHA256 49687025dce701973b47fb6caba71f1443471e64551f41967a6a3275ce1e93d5
SHA512 92d7da5ef3625157acb00752b74fcfb80c588bc3ddf8b7fda488f68d0a6cf332aade539ee92139a26c5dc3549c8a69471ca24fcb1568068d5293b8988bbbab58

C:\Users\Admin\AppData\Local\Temp\Comics

MD5 4a3aab84dbfdaf25ae909ac736489f4b
SHA1 76663cb1186f29fed429863013600c9d69355d36
SHA256 2caa4849a4353ca50dfdbc860412e95b783fdcc7e60d8756c9b4bdf2915e1923
SHA512 1c2b0ffa8783bb9e9082eae4214547d8ced58121e717b57884a56042a7ef70c55e702d7f018dea72ca95aa40170c6f24ccec7d56fa3b160237969b5c0473bea5

C:\Users\Admin\AppData\Local\Temp\Flux

MD5 523fea93bbf3f0b9ddd4d1a432b624c9
SHA1 578ccd6f97455881ca61fddf068695ab0daa8918
SHA256 f4e881ea8495c993e2f008e9b5fc082bc2cea97812fe944dda293f3b02fb60b0
SHA512 633474c0d83e92171d09ab5849b83a9bcd613f630ec54ee44ad42ac8102d25c987f9e3ec71ea6c2d3542bcc9919ded6e37c3754a8f074aeea9704f16770692f4

C:\Users\Admin\AppData\Local\Temp\Liberal

MD5 524c0177830e8a3624062be7eddfa277
SHA1 0a830e50e9433d530094edf3577b7ec5c5d1c5f5
SHA256 aacfabd8f6dde87949cbafa8eab7536dc5377e726064445e62824d10584eaec5
SHA512 79ed8be7d451a885befb7001c52a9f0db3977be8e16abd7db9f7742d520270a650ac77ed72e512a377d8f888bf05643f6bce3fea2d4dba8f37c7fff73a70d0cd

\Users\Admin\AppData\Local\Temp\719580\Optimum.pif

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

C:\Users\Admin\AppData\Local\Temp\719580\f

MD5 43ca848d3a9ee13623e355d9ee71b515
SHA1 944f72b5cc721b44bf50c0013b4b10151972074d
SHA256 3d4000a64c1b7be8fcefe59e8f39f1ae12ef1fcd9d30a39158f83b26ee189831
SHA512 e52336e652a69b34c41aa9283d8e2e8e795c5734507b23050f48aa25be4423eafcc416f38bf23463de0602c20a24f0fd75629ec23214119b4c4a98025be8513f

\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe

MD5 b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1 d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA256 6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512 b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

memory/840-37-0x0000000000210000-0x00000000002A8000-memory.dmp

memory/840-39-0x0000000000210000-0x00000000002A8000-memory.dmp

memory/840-40-0x0000000000210000-0x00000000002A8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-18 06:53

Reported

2024-08-18 06:56

Platform

win10v2004-20240802-en

Max time kernel

148s

Max time network

139s

Command Line

C:\Windows\Explorer.EXE

Signatures

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2396 created 3348 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Windows\Explorer.EXE

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\AnchorAnnotated C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe N/A
File opened for modification C:\Windows\CheckingReliable C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe N/A
File opened for modification C:\Windows\ConferencesInto C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe N/A
File opened for modification C:\Windows\GamblingCedar C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\choice.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1432 wrote to memory of 3612 N/A C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe C:\Windows\SysWOW64\cmd.exe
PID 1432 wrote to memory of 3612 N/A C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe C:\Windows\SysWOW64\cmd.exe
PID 1432 wrote to memory of 3612 N/A C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe C:\Windows\SysWOW64\cmd.exe
PID 3612 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3612 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3612 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3612 wrote to memory of 3992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3612 wrote to memory of 3992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3612 wrote to memory of 3992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3612 wrote to memory of 4652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3612 wrote to memory of 4652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3612 wrote to memory of 4652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3612 wrote to memory of 4768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3612 wrote to memory of 4768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3612 wrote to memory of 4768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3612 wrote to memory of 4772 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3612 wrote to memory of 4772 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3612 wrote to memory of 4772 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3612 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3612 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3612 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3612 wrote to memory of 3080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3612 wrote to memory of 3080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3612 wrote to memory of 3080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3612 wrote to memory of 2396 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif
PID 3612 wrote to memory of 2396 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif
PID 3612 wrote to memory of 2396 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif
PID 3612 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 3612 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 3612 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 2396 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
PID 2396 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
PID 2396 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
PID 2396 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
PID 2396 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe

"C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k move Surrey Surrey.cmd && Surrey.cmd && exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 719580

C:\Windows\SysWOW64\findstr.exe

findstr /V "copehebrewinquireinnocent" Corpus

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b ..\Utilize + ..\Verzeichnis + ..\Built + ..\Vessels + ..\Cradle + ..\Jaguar + ..\Comics + ..\Flux + ..\Liberal f

C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif

Optimum.pif f

C:\Windows\SysWOW64\choice.exe

choice /d y /t 5

C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 PdvZAJjtltegTAllAQLr.PdvZAJjtltegTAllAQLr udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
FI 65.108.46.186:1337 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 186.46.108.65.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Surrey

MD5 721cde52d197da4629a6792103404e23
SHA1 1f5bac364c6b9546ba0501f41766bb25df98b32b
SHA256 66627eef98fb038f1d22f620bc8d85430a442d08313602eb02f0b158b5471812
SHA512 63a6786227915bc450ea9ca4df4962126b4194a1fd5c68fe3c686da8175726d4efdda5e88aedea7b8e4e758816b9b31981fa79e37dbe51028650def5042ccac6

C:\Users\Admin\AppData\Local\Temp\Corpus

MD5 148febc94e0f8036a074350ef338b007
SHA1 1be93210e5348f9409fe4162599dfaad797a2ade
SHA256 849892bc358956ee263db6cbddd4a9cca0e1564d6caefe44e2e998d559e610a0
SHA512 72b83e8cb35bf6fe295f1cb84197f3ffb4944e19b9ece9f6664ed2bc4aca40c9c912debf260e891c80feebb4c84935da4c2996b9a100ce94cde177928f31fa92

C:\Users\Admin\AppData\Local\Temp\Folding

MD5 67ff730b62d42030058393ab3f0dafd1
SHA1 79215f079836dd43b4f7b1e66739bd7dab9fb6a3
SHA256 95d53427ef46fb44354a0253a611e342a30428101acaf83215f5b21432afbff1
SHA512 6e7d6f12686b0b30c96eebe01546e4aee1adee39a7467409e8f41de9a37c65daa010ebcefa6c452d4849e7ba0bec9be55be1b38250420b40e2956c151478d973

C:\Users\Admin\AppData\Local\Temp\Utilize

MD5 4bb39f0bce8a4f7b640ba76ecccaf87b
SHA1 c0c7feca88b0fc3fc1f20d1963ae25388a1f4c12
SHA256 96af995b201e5392293f2d7272b1c9a3f0eb671d62aeafffb4b0bbbfed0e3560
SHA512 ad2752281067584233cc19b3d0bbd0178dc3907af71c8dc3c37afe35f417afe1b1fc4d9ad2d99506d53100afde8ddb692e93669b8c9398782cb03dc22a04e1ef

C:\Users\Admin\AppData\Local\Temp\Built

MD5 0a91386341f9d1a371bc735576b276a4
SHA1 a02598ef42cef1443cc94a8310a6c02df07119d4
SHA256 7b857693641ff1ff59e69422b09299a5580d20677acd530c27c7fbc9e3ee3b92
SHA512 b492508575c01689c982a8eb57fac2b5759e4c843c92f99d231b63c25ab4c82fa7fece9d4e9c2cc436a3232b4ed7947baecf2a06aafbf1a3cf243395af71e96b

C:\Users\Admin\AppData\Local\Temp\Verzeichnis

MD5 6a5ab833602af088d60d3d7f89b77229
SHA1 32f9fe7c6ba035993a627a78491651f02d0dfc97
SHA256 41586643456496d40c3279839a1cb1528428c19deefb4c702bd58f1467a1a1d0
SHA512 0598b2b38270a8d282ae2325330420b467be203047dffc2e85626fd78e78f81c5084487eebfbefbcb36115732a6670a9857655c18803388c02e37fbcf51aaa66

C:\Users\Admin\AppData\Local\Temp\Vessels

MD5 d64ef3bbcca2c221c0bcc85a7b6d5209
SHA1 5c3cf9d492c7021e19e103fa14ab3965fd1c6ba3
SHA256 c8c35545936faa3b0e00aa1b907952e97fffd9c1958045253863b4c2fad7f295
SHA512 2b6713646373b5b233295930a46fefbd499b607a94051c6294d3dce12f58b187c98f22f7f0b1243f22611a82c659b1d95f70a7858247b8f0853a1765d449e611

C:\Users\Admin\AppData\Local\Temp\Cradle

MD5 8c59dae352a159e484b0de9603dabc11
SHA1 34992e582081635abf736ec18f1492ae40ca4925
SHA256 3ab028b25bd6bd3ba48a92c4198dd8ff07fe71b4b41c785469d79da422f2fe46
SHA512 cf041cc9470ac479702c19714d875868a5168940a8d56715a98ae3d52f0363ffab160566d7c364b1bd9e8cb263b7e2b60e6719dbac7b6ad12e5f6a87e4f57d8e

C:\Users\Admin\AppData\Local\Temp\Jaguar

MD5 fdadac1c5944e618315f608ad2f02714
SHA1 debe3ccc5a4abc326dbcb4a86ec8074671a3417f
SHA256 49687025dce701973b47fb6caba71f1443471e64551f41967a6a3275ce1e93d5
SHA512 92d7da5ef3625157acb00752b74fcfb80c588bc3ddf8b7fda488f68d0a6cf332aade539ee92139a26c5dc3549c8a69471ca24fcb1568068d5293b8988bbbab58

C:\Users\Admin\AppData\Local\Temp\Comics

MD5 4a3aab84dbfdaf25ae909ac736489f4b
SHA1 76663cb1186f29fed429863013600c9d69355d36
SHA256 2caa4849a4353ca50dfdbc860412e95b783fdcc7e60d8756c9b4bdf2915e1923
SHA512 1c2b0ffa8783bb9e9082eae4214547d8ced58121e717b57884a56042a7ef70c55e702d7f018dea72ca95aa40170c6f24ccec7d56fa3b160237969b5c0473bea5

C:\Users\Admin\AppData\Local\Temp\Flux

MD5 523fea93bbf3f0b9ddd4d1a432b624c9
SHA1 578ccd6f97455881ca61fddf068695ab0daa8918
SHA256 f4e881ea8495c993e2f008e9b5fc082bc2cea97812fe944dda293f3b02fb60b0
SHA512 633474c0d83e92171d09ab5849b83a9bcd613f630ec54ee44ad42ac8102d25c987f9e3ec71ea6c2d3542bcc9919ded6e37c3754a8f074aeea9704f16770692f4

C:\Users\Admin\AppData\Local\Temp\Liberal

MD5 524c0177830e8a3624062be7eddfa277
SHA1 0a830e50e9433d530094edf3577b7ec5c5d1c5f5
SHA256 aacfabd8f6dde87949cbafa8eab7536dc5377e726064445e62824d10584eaec5
SHA512 79ed8be7d451a885befb7001c52a9f0db3977be8e16abd7db9f7742d520270a650ac77ed72e512a377d8f888bf05643f6bce3fea2d4dba8f37c7fff73a70d0cd

C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

C:\Users\Admin\AppData\Local\Temp\719580\f

MD5 43ca848d3a9ee13623e355d9ee71b515
SHA1 944f72b5cc721b44bf50c0013b4b10151972074d
SHA256 3d4000a64c1b7be8fcefe59e8f39f1ae12ef1fcd9d30a39158f83b26ee189831
SHA512 e52336e652a69b34c41aa9283d8e2e8e795c5734507b23050f48aa25be4423eafcc416f38bf23463de0602c20a24f0fd75629ec23214119b4c4a98025be8513f

memory/948-33-0x0000000000B60000-0x0000000000BF8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe

MD5 0d5df43af2916f47d00c1573797c1a13
SHA1 230ab5559e806574d26b4c20847c368ed55483b0
SHA256 c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512 f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

memory/948-36-0x0000000005A80000-0x0000000006024000-memory.dmp

memory/948-37-0x0000000005540000-0x00000000055A6000-memory.dmp

memory/948-39-0x0000000006590000-0x0000000006622000-memory.dmp

memory/948-40-0x0000000006580000-0x000000000658A000-memory.dmp

memory/948-41-0x0000000006830000-0x00000000068CC000-memory.dmp