Malware Analysis Report

2025-05-28 14:54

Sample ID 240821-kwxb2szcqe
Target 013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
SHA256 013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5
Tags
discovery execution vipkeylogger collection credential_access keylogger spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5

Threat Level: Known bad

The file 013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe was found to be: Known bad.

Malicious Activity Summary

discovery execution vipkeylogger collection credential_access keylogger spyware stealer

VIPKeylogger

Credentials from Password Stores: Credentials from Web Browsers

Command and Scripting Interpreter: PowerShell

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Checks computer location settings

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Browser Information Discovery

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

outlook_win_path

Suspicious use of WriteProcessMemory

outlook_office_path

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-21 08:57

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-21 08:57

Reported

2024-08-21 09:00

Platform

win7-20240708-en

Max time kernel

119s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2028 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2028 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2028 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2028 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2028 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2028 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2028 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2028 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2028 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 2028 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 2028 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 2028 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 2028 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 816 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 816 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 816 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 2028 wrote to memory of 816 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe

Processes

C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe

"C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RQlazJwKsD.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RQlazJwKsD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp822B.tmp"

C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe

"C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe"

C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe

"C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe"

C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe

"C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe"

C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe

"C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe"

C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe

"C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe"

Network

N/A

Files

memory/2028-0-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

memory/2028-1-0x00000000003C0000-0x0000000000498000-memory.dmp

memory/2028-2-0x0000000074D70000-0x000000007545E000-memory.dmp

memory/2028-3-0x00000000003B0000-0x00000000003C2000-memory.dmp

memory/2028-4-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

memory/2028-5-0x0000000074D70000-0x000000007545E000-memory.dmp

memory/2028-6-0x0000000000540000-0x0000000000550000-memory.dmp

memory/2028-7-0x0000000005B40000-0x0000000005BCC000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 5b89fb5f9251e1b9d78f4c402988e92e
SHA1 ffdc1146f694a17f4c18bf7de637d740859bebba
SHA256 29d2c8380eb8b070d352719f8070efe89fedde2725aee6cc151a3f9d024fce4d
SHA512 b58ba0a7dcb3bc3a6e72e9d6ac23bbb7eb478bf11e26a66b16e932b9b030227c258cc1b49e40c5a9212b6e734900e6927acaf0575c6625c0d18078d64546c984

C:\Users\Admin\AppData\Local\Temp\tmp822B.tmp

MD5 b5eecf68c2ed87cd724fd40ccb21a24c
SHA1 e500d212a57fde29d4734e82c718b4e18c6bccf5
SHA256 b4191a36a40f4501012d2ad0f5c2ed9714c7aabd18c0ec875763cff1a754fdb8
SHA512 45b7f218b564fb5a0140f5993ac19cc693182b744e1d2231323f4a2cf02fdea773c816958c405d3336d4d84a2c4938f3a2145c2440d6c3bd41f422834c2e9284

memory/2028-20-0x0000000074D70000-0x000000007545E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-21 08:57

Reported

2024-08-21 09:00

Platform

win10v2004-20240802-en

Max time kernel

143s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5000 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5000 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5000 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5000 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5000 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5000 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5000 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 5000 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 5000 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 5000 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 5000 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 5000 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 5000 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 5000 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 5000 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 5000 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 5000 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 5000 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 5000 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe
PID 5000 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe

"C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RQlazJwKsD.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RQlazJwKsD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp19BD.tmp"

C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe

"C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe"

C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe

"C:\Users\Admin\AppData\Local\Temp\013f695b5ec6d00214cc5835bb446a73382871e90cb17c6d8922c3b3ef7484c5.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
BR 132.226.247.73:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 73.247.226.132.in-addr.arpa udp
US 8.8.8.8:53 152.67.21.104.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 52.111.227.14:443 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/5000-0-0x0000000074ABE000-0x0000000074ABF000-memory.dmp

memory/5000-1-0x00000000003E0000-0x00000000004B8000-memory.dmp

memory/5000-2-0x00000000053E0000-0x0000000005984000-memory.dmp

memory/5000-3-0x0000000004ED0000-0x0000000004F62000-memory.dmp

memory/5000-4-0x0000000074AB0000-0x0000000075260000-memory.dmp

memory/5000-5-0x0000000004EA0000-0x0000000004EAA000-memory.dmp

memory/5000-6-0x0000000005390000-0x00000000053A2000-memory.dmp

memory/5000-7-0x0000000074ABE000-0x0000000074ABF000-memory.dmp

memory/5000-8-0x0000000074AB0000-0x0000000075260000-memory.dmp

memory/5000-9-0x00000000053B0000-0x00000000053C0000-memory.dmp

memory/5000-10-0x00000000060C0000-0x000000000614C000-memory.dmp

memory/5000-11-0x0000000006340000-0x00000000063DC000-memory.dmp

memory/2252-16-0x0000000002800000-0x0000000002836000-memory.dmp

memory/2252-17-0x0000000005430000-0x0000000005A58000-memory.dmp

memory/2252-18-0x0000000074AB0000-0x0000000075260000-memory.dmp

memory/2252-19-0x0000000074AB0000-0x0000000075260000-memory.dmp

memory/2252-20-0x0000000074AB0000-0x0000000075260000-memory.dmp

memory/1488-21-0x0000000074AB0000-0x0000000075260000-memory.dmp

memory/1488-22-0x0000000074AB0000-0x0000000075260000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp19BD.tmp

MD5 907a6eacc0df09d80385d80059ff2a54
SHA1 0b0322b8cacb793f8926e10a14b230c0b3c035cc
SHA256 c5860165a76fc508ca7b54e7bd58ea58e4039a16e403971e424ee68819547e6f
SHA512 be4bb88ce315b59b2cedabb89850c3dcfcda43fe9182c2f6ea3e1927c5ebf448c7297734aff4cb3ea8d00b8a4da2344287edd52dc5624ef97430157ff3731330

memory/2252-25-0x0000000005AD0000-0x0000000005B36000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kjirbq0r.pze.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2252-24-0x0000000005A60000-0x0000000005AC6000-memory.dmp

memory/2252-23-0x0000000005340000-0x0000000005362000-memory.dmp

memory/2252-45-0x0000000005D30000-0x0000000006084000-memory.dmp

memory/2728-46-0x0000000000400000-0x0000000000448000-memory.dmp

memory/5000-48-0x0000000074AB0000-0x0000000075260000-memory.dmp

memory/2252-49-0x0000000006100000-0x000000000611E000-memory.dmp

memory/2252-50-0x00000000061B0000-0x00000000061FC000-memory.dmp

memory/1488-51-0x00000000074C0000-0x00000000074F2000-memory.dmp

memory/1488-62-0x0000000007500000-0x000000000751E000-memory.dmp

memory/1488-52-0x0000000071290000-0x00000000712DC000-memory.dmp

memory/1488-63-0x0000000007530000-0x00000000075D3000-memory.dmp

memory/2252-64-0x0000000071290000-0x00000000712DC000-memory.dmp

memory/1488-74-0x0000000007EB0000-0x000000000852A000-memory.dmp

memory/1488-75-0x0000000007870000-0x000000000788A000-memory.dmp

memory/1488-76-0x00000000078E0000-0x00000000078EA000-memory.dmp

memory/1488-77-0x0000000007AF0000-0x0000000007B86000-memory.dmp

memory/2252-78-0x0000000007630000-0x0000000007641000-memory.dmp

memory/2252-79-0x0000000007660000-0x000000000766E000-memory.dmp

memory/2252-80-0x0000000007670000-0x0000000007684000-memory.dmp

memory/2252-81-0x0000000007770000-0x000000000778A000-memory.dmp

memory/1488-82-0x0000000007B90000-0x0000000007B98000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 0f393d81193def130ccd9e521704b7cb
SHA1 d281d33b41473a52e9f0484e3c5ef14d5a84002b
SHA256 a33cdc5ed41d444645e948522b307c4d1ae675e86bc21ba8a46b67440d15ddfc
SHA512 4e3383f950e567d39e67ff9bb8086ae26a3e1d3957f4cce1306edc0b801da78e9bb29f22240661563e7ab04d73038f70eae0573f63d80dd8634b9651eb77a077

memory/2252-89-0x0000000074AB0000-0x0000000075260000-memory.dmp

memory/1488-88-0x0000000074AB0000-0x0000000075260000-memory.dmp

memory/2728-90-0x0000000006470000-0x0000000006632000-memory.dmp

memory/2728-91-0x00000000062F0000-0x0000000006340000-memory.dmp