Malware Analysis Report

2025-05-28 14:54

Sample ID 240821-nnf7mszcmp
Target f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
SHA256 f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d
Tags
vipkeylogger collection credential_access discovery execution keylogger spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d

Threat Level: Known bad

The file f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe was found to be: Known bad.

Malicious Activity Summary

vipkeylogger collection credential_access discovery execution keylogger spyware stealer

VIPKeylogger

Credentials from Password Stores: Credentials from Web Browsers

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Browser Information Discovery

System Location Discovery: System Language Discovery

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

outlook_win_path

outlook_office_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-21 11:32

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-21 11:32

Reported

2024-08-21 11:34

Platform

win7-20240708-en

Max time kernel

119s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2092 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2092 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2092 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2092 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2092 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2092 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2092 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2092 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2092 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\schtasks.exe
PID 2092 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\schtasks.exe
PID 2092 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\schtasks.exe
PID 2092 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\schtasks.exe
PID 2092 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
PID 2092 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
PID 2092 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
PID 2092 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
PID 2092 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
PID 2092 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
PID 2092 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
PID 2092 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
PID 2092 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe

"C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hlxwOGwWpD.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hlxwOGwWpD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDAA6.tmp"

C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe

"C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 checkip.dyndns.org udp
JP 132.226.8.169:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp

Files

memory/2092-0-0x0000000073F9E000-0x0000000073F9F000-memory.dmp

memory/2092-1-0x0000000000AF0000-0x0000000000BC8000-memory.dmp

memory/2092-2-0x0000000073F90000-0x000000007467E000-memory.dmp

memory/2092-3-0x00000000003B0000-0x00000000003C2000-memory.dmp

memory/2092-4-0x0000000073F9E000-0x0000000073F9F000-memory.dmp

memory/2092-5-0x0000000073F90000-0x000000007467E000-memory.dmp

memory/2092-6-0x0000000000400000-0x0000000000410000-memory.dmp

memory/2092-7-0x0000000005B00000-0x0000000005B8C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 6f9b0f6680ce138c79e9f089c1aca849
SHA1 ffb03142f9a261ef611b44da7db11ec94632c964
SHA256 7f0c3a22512820f20083862d2b07ec6c09e9bd146601b885ee8e758933f6eefe
SHA512 fd45b4cb51bc71e9d6d41a573be59132adeca1374364e98984cc24b2a7b771a38fb7f3a74b5403fdf88192ff3a3213eef27ab23a2d768ee3262790e55bafa46e

C:\Users\Admin\AppData\Local\Temp\tmpDAA6.tmp

MD5 ecf8b2eabc2bb1bfff836d07e737e684
SHA1 bd57470363f865ea23fb3f2036641cb186ba547e
SHA256 1269eee9b514b3fc5dc1dfa76ed70f4b38e5818e150969f4d924841a0ee0ed6e
SHA512 6f872aa479ef172fbcf37ec373c70d359fc6d24d8825eb763ca5091abf5decde10d8b7794ab592a3710f59e6ac0e7259a095150726ddb41e45be983f82240023

memory/2612-20-0x0000000000400000-0x0000000000448000-memory.dmp

memory/2612-24-0x0000000000400000-0x0000000000448000-memory.dmp

memory/2612-22-0x0000000000400000-0x0000000000448000-memory.dmp

memory/2612-31-0x0000000000400000-0x0000000000448000-memory.dmp

memory/2612-30-0x0000000000400000-0x0000000000448000-memory.dmp

memory/2612-29-0x0000000000400000-0x0000000000448000-memory.dmp

memory/2612-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2612-26-0x0000000000400000-0x0000000000448000-memory.dmp

memory/2092-32-0x0000000073F90000-0x000000007467E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-21 11:32

Reported

2024-08-21 11:34

Platform

win10v2004-20240802-en

Max time kernel

139s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3340 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3340 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3340 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3340 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3340 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3340 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3340 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\schtasks.exe
PID 3340 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\schtasks.exe
PID 3340 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Windows\SysWOW64\schtasks.exe
PID 3340 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
PID 3340 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
PID 3340 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
PID 3340 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
PID 3340 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
PID 3340 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
PID 3340 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe
PID 3340 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe

"C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hlxwOGwWpD.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hlxwOGwWpD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2BAF.tmp"

C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe

"C:\Users\Admin\AppData\Local\Temp\f5dcef48d10d26c35b7123ed8b8281eb18b0aabd2fba48509da1d75732804d0d.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
JP 132.226.8.169:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 169.8.226.132.in-addr.arpa udp
US 8.8.8.8:53 134.177.67.172.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/3340-0-0x000000007511E000-0x000000007511F000-memory.dmp

memory/3340-1-0x0000000000920000-0x00000000009F8000-memory.dmp

memory/3340-2-0x0000000005A10000-0x0000000005FB4000-memory.dmp

memory/3340-3-0x0000000005460000-0x00000000054F2000-memory.dmp

memory/3340-5-0x0000000075110000-0x00000000758C0000-memory.dmp

memory/3340-4-0x00000000053C0000-0x00000000053CA000-memory.dmp

memory/3340-6-0x0000000007FB0000-0x0000000007FC2000-memory.dmp

memory/3340-7-0x000000007511E000-0x000000007511F000-memory.dmp

memory/3340-8-0x0000000075110000-0x00000000758C0000-memory.dmp

memory/3340-9-0x00000000065C0000-0x00000000065D0000-memory.dmp

memory/3340-10-0x0000000006620000-0x00000000066AC000-memory.dmp

memory/3340-11-0x00000000068A0000-0x000000000693C000-memory.dmp

memory/3664-16-0x0000000002130000-0x0000000002166000-memory.dmp

memory/3664-18-0x0000000004DE0000-0x0000000005408000-memory.dmp

memory/3664-17-0x0000000075110000-0x00000000758C0000-memory.dmp

memory/3664-19-0x0000000075110000-0x00000000758C0000-memory.dmp

memory/448-20-0x0000000075110000-0x00000000758C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2BAF.tmp

MD5 af8d78ef159ec799932802039900a4a7
SHA1 968ff9c77b20a5998831afa50836eb262cf317a2
SHA256 ba1216c4620212795f3154e241808e5b3ccb0a4bf5d6e98d02bb5631f4f7a078
SHA512 92592ad4871ad41017638a74469c231a102571ff29d8b1a844d327cff5282e32d6ce43c6cecbae32c21bb27859c41a72c2fa66dd95b2b50b18f29ed0fd6e64c9

memory/448-25-0x0000000075110000-0x00000000758C0000-memory.dmp

memory/3664-24-0x0000000005410000-0x0000000005476000-memory.dmp

memory/60-26-0x0000000000400000-0x0000000000448000-memory.dmp

memory/3664-33-0x0000000005480000-0x00000000057D4000-memory.dmp

memory/3664-38-0x0000000075110000-0x00000000758C0000-memory.dmp

memory/3340-39-0x0000000075110000-0x00000000758C0000-memory.dmp

memory/448-49-0x0000000075110000-0x00000000758C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qpjg4x0m.u1o.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3664-23-0x0000000004D20000-0x0000000004D86000-memory.dmp

memory/3664-22-0x0000000004C80000-0x0000000004CA2000-memory.dmp

memory/3664-51-0x0000000005FE0000-0x000000000602C000-memory.dmp

memory/3664-50-0x0000000005A50000-0x0000000005A6E000-memory.dmp

memory/3664-52-0x0000000006A50000-0x0000000006A82000-memory.dmp

memory/3664-53-0x0000000071860000-0x00000000718AC000-memory.dmp

memory/3664-63-0x0000000005FB0000-0x0000000005FCE000-memory.dmp

memory/3664-64-0x0000000006C90000-0x0000000006D33000-memory.dmp

memory/448-65-0x0000000071860000-0x00000000718AC000-memory.dmp

memory/448-76-0x0000000007100000-0x000000000711A000-memory.dmp

memory/448-75-0x0000000007750000-0x0000000007DCA000-memory.dmp

memory/448-77-0x0000000007170000-0x000000000717A000-memory.dmp

memory/3664-78-0x0000000006FF0000-0x0000000007086000-memory.dmp

memory/448-79-0x0000000007300000-0x0000000007311000-memory.dmp

memory/448-80-0x0000000007330000-0x000000000733E000-memory.dmp

memory/3664-81-0x0000000006FB0000-0x0000000006FC4000-memory.dmp

memory/3664-82-0x00000000070B0000-0x00000000070CA000-memory.dmp

memory/448-83-0x0000000007420000-0x0000000007428000-memory.dmp

memory/3664-90-0x0000000075110000-0x00000000758C0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c640708fc9d5eb2e9d873bd7ab0e1c43
SHA1 80e60da90e211114707a7dcb61cba50cebaf83d9
SHA256 53a6892d3ea519bf41166eeaaef3e102a95e9bd36160ebffe5fbda15cb5af61b
SHA512 488845c8cf3e1f783cf37e09dd1bf8de9bc1b5b0431ca76c40289e12203d9fd697583c1f1d3c6b226d79cad3fbdc41aeac64adc521dbaefc650ab00ff5133668

memory/448-89-0x0000000075110000-0x00000000758C0000-memory.dmp

memory/60-91-0x00000000063E0000-0x00000000065A2000-memory.dmp

memory/60-92-0x0000000006270000-0x00000000062C0000-memory.dmp