Malware Analysis Report

2024-10-23 19:29

Sample ID 240901-v2xvwaxfpe
Target 997e7eb0db00d9cf3b7147f31bc09860N.exe
SHA256 f36de50dbad73f41dcc58b6f2246227e55b9381ea6d30ecc0622bc446c166a91
Tags
quasar azorult ebayprofiles discovery infostealer spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f36de50dbad73f41dcc58b6f2246227e55b9381ea6d30ecc0622bc446c166a91

Threat Level: Known bad

The file 997e7eb0db00d9cf3b7147f31bc09860N.exe was found to be: Known bad.

Malicious Activity Summary

quasar azorult ebayprofiles discovery infostealer spyware trojan

Azorult

Quasar RAT

Quasar family

Quasar payload

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Looks up external IP address via web service

Enumerates connected drives

Suspicious use of SetThreadContext

AutoIT Executable

Unsigned PE

Program crash

System Location Discovery: System Language Discovery

Enumerates physical storage devices

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-01 17:29

Signatures

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-01 17:29

Reported

2024-09-01 17:31

Platform

win7-20240729-en

Max time kernel

3s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe"

Signatures

Azorult

trojan infostealer azorult

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\windef.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1976 set thread context of 2988 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\vnc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\windef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\windef.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1976 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 1976 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 1976 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 1976 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 1976 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 1976 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 1976 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 1976 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 2596 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 2596 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 2596 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 2596 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 1976 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe
PID 1976 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe
PID 1976 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe
PID 1976 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe
PID 2596 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 1976 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe
PID 1976 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe
PID 1976 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Windows\SysWOW64\schtasks.exe
PID 1976 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Windows\SysWOW64\schtasks.exe
PID 1976 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Windows\SysWOW64\schtasks.exe
PID 1976 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Windows\SysWOW64\schtasks.exe
PID 2596 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\SysWOW64\WerFault.exe
PID 2596 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\SysWOW64\WerFault.exe
PID 2596 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\SysWOW64\WerFault.exe
PID 2596 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe

"C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe"

C:\Users\Admin\AppData\Local\Temp\vnc.exe

"C:\Users\Admin\AppData\Local\Temp\vnc.exe"

C:\Users\Admin\AppData\Local\Temp\windef.exe

"C:\Users\Admin\AppData\Local\Temp\windef.exe"

C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe

"C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 160

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe

"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f

C:\Windows\system32\taskeng.exe

taskeng.exe {E887F3B8-30AB-4FCF-B053-44EAA410EF0B} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

C:\Users\Admin\AppData\Local\Temp\vnc.exe

"C:\Users\Admin\AppData\Local\Temp\vnc.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k

C:\Users\Admin\AppData\Local\Temp\windef.exe

"C:\Users\Admin\AppData\Local\Temp\windef.exe"

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\vDutQ3nm820y.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 1524

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe

"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 0x21.in udp
US 44.221.84.105:8000 0x21.in tcp
US 208.95.112.1:80 ip-api.com tcp
RU 5.8.88.191:443 tcp
US 8.8.8.8:53 0x21.in udp
US 44.221.84.105:8000 0x21.in tcp
RU 5.8.88.191:8080 tcp
US 8.8.8.8:53 0x21.in udp
US 44.221.84.105:8000 0x21.in tcp
US 8.8.8.8:53 0x21.in udp
US 44.221.84.105:8000 0x21.in tcp
US 8.8.8.8:53 sockartek.icu udp
RU 5.8.88.191:8080 tcp
RU 5.8.88.191:8080 tcp
RU 5.8.88.191:8080 tcp
RU 5.8.88.191:8080 tcp

Files

C:\Users\Admin\AppData\Local\Temp\vnc.exe

MD5 b8ba87ee4c3fc085a2fed0d839aadce1
SHA1 b3a2e3256406330e8b1779199bb2b9865122d766
SHA256 4e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA512 7a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2

\Users\Admin\AppData\Local\Temp\windef.exe

MD5 b4a202e03d4135484d0e730173abcc72
SHA1 01b30014545ea526c15a60931d676f9392ea0c70
SHA256 7050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512 632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb

memory/1976-28-0x0000000000B40000-0x0000000000B41000-memory.dmp

memory/2988-43-0x0000000000080000-0x00000000000A0000-memory.dmp

memory/1724-46-0x0000000000860000-0x00000000008BE000-memory.dmp

memory/2988-38-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2988-32-0x0000000000080000-0x00000000000A0000-memory.dmp

memory/2988-30-0x0000000000080000-0x00000000000A0000-memory.dmp

memory/660-58-0x00000000011B0000-0x000000000120E000-memory.dmp

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

MD5 baa5a62fa7c619060e00c3ba12903527
SHA1 40cad01636f42ae249a6ec20f5fd3dd05795fa75
SHA256 0726fbca0f60bd7db8c1f525c1e3726ee0e7b5886870f0d723629c5aa63a2d25
SHA512 5518e85deec72eae80dd1ffa011799f10f77b762ed39a5f5860f91fe411cfe8e61c1011c82e7ea53e29306dff7e34946560b1a058bfc589c6d3cf1b8d6fc4b55

memory/1596-71-0x0000000000020000-0x0000000000021000-memory.dmp

memory/1596-73-0x000007FFFFFD6000-0x000007FFFFFD7000-memory.dmp

memory/1596-74-0x0000000000480000-0x000000000051C000-memory.dmp

memory/1596-91-0x0000000000480000-0x000000000051C000-memory.dmp

memory/2276-93-0x0000000000EA0000-0x0000000000EFE000-memory.dmp

memory/1124-96-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1124-99-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1124-103-0x0000000000400000-0x0000000000420000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8GKTZEIP.txt

MD5 7ce31b5f67e17a5633f4fc0a25140d15
SHA1 73f1c48573239ceaade310cf8457e894f49b77ab
SHA256 aab4755d68acd5207dd1c500cc04eaac434ab0ef69eea040142563b2c0a1b80e
SHA512 21671002917a88400f51c5d73b0c8d1f1c09441fa8ac169815d8f0c54f0948c7fbdc9945d837da5a6f7871f37b9ed5c87c1ca9d151d9f08e25dd5e8b1ba6ab0f

C:\Users\Admin\AppData\Local\Temp\vDutQ3nm820y.bat

MD5 4a0afade2ea07f62267341747da8023d
SHA1 5fac59d28c400e178a56df10bfd07d9c21d79e68
SHA256 ba7587bc40a4fbf4e1d906243485e83ff35414b93806f971c4110a52bc3a26d1
SHA512 27f8c0b4c5df77799887b16574111e5fb0a682472341459879484fc1f93c97496bc7e4f6cbaff4db3ab20db042eebe72ab9bea2ce1f00c176f7519fab94d8962

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-01 17:29

Reported

2024-09-01 17:31

Platform

win10v2004-20240802-en

Max time kernel

4s

Max time network

110s

Command Line

"C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe"

Signatures

Azorult

trojan infostealer azorult

Quasar RAT

trojan spyware quasar
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\windef.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4544 set thread context of 1040 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\vnc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\windef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\windef.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4544 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 4544 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 4544 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\vnc.exe
PID 4340 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 4340 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 4340 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\vnc.exe C:\Windows\system32\svchost.exe
PID 4544 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 4544 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 4544 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\windef.exe
PID 4544 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe
PID 4544 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe
PID 4544 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe
PID 4544 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe
PID 4544 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe
PID 4544 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Windows\SysWOW64\schtasks.exe
PID 4544 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Windows\SysWOW64\schtasks.exe
PID 4544 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe

"C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe"

C:\Users\Admin\AppData\Local\Temp\vnc.exe

"C:\Users\Admin\AppData\Local\Temp\vnc.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k

C:\Users\Admin\AppData\Local\Temp\windef.exe

"C:\Users\Admin\AppData\Local\Temp\windef.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4340 -ip 4340

C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe

"C:\Users\Admin\AppData\Local\Temp\997e7eb0db00d9cf3b7147f31bc09860N.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 552

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe

"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

C:\Users\Admin\AppData\Local\Temp\vnc.exe

"C:\Users\Admin\AppData\Local\Temp\vnc.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k

C:\Users\Admin\AppData\Local\Temp\windef.exe

"C:\Users\Admin\AppData\Local\Temp\windef.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3092 -ip 3092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 520

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3mntJo2Dq4Sj.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 516 -ip 516

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 1084

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe

"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5noG6lDRCxC1.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3212 -ip 3212

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2232

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe

"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\t0AgLtCPSbAg.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2900 -ip 2900

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 1960

Network

Country Destination Domain Proto
US 8.8.8.8:53 0x21.in udp
US 44.221.84.105:8000 0x21.in tcp
US 8.8.8.8:53 0x21.in udp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 44.221.84.105:8000 0x21.in tcp
US 208.95.112.1:80 ip-api.com tcp
RU 5.8.88.191:443 tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 44.221.84.105:8000 0x21.in tcp
US 44.221.84.105:8000 0x21.in tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 sockartek.icu udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
RU 5.8.88.191:443 tcp
US 8.8.8.8:53 sockartek.icu udp
US 208.95.112.1:80 ip-api.com tcp
RU 5.8.88.191:443 tcp
US 52.111.227.11:443 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 sockartek.icu udp

Files

C:\Users\Admin\AppData\Local\Temp\vnc.exe

MD5 b8ba87ee4c3fc085a2fed0d839aadce1
SHA1 b3a2e3256406330e8b1779199bb2b9865122d766
SHA256 4e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA512 7a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2

C:\Users\Admin\AppData\Local\Temp\windef.exe

MD5 b4a202e03d4135484d0e730173abcc72
SHA1 01b30014545ea526c15a60931d676f9392ea0c70
SHA256 7050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512 632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb

memory/4544-19-0x0000000003B70000-0x0000000003B71000-memory.dmp

memory/1040-28-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1040-20-0x0000000000400000-0x0000000000420000-memory.dmp

memory/4964-29-0x000000007306E000-0x000000007306F000-memory.dmp

memory/4964-30-0x0000000000A40000-0x0000000000A9E000-memory.dmp

memory/4964-33-0x0000000005980000-0x0000000005F24000-memory.dmp

memory/4964-34-0x00000000053D0000-0x0000000005462000-memory.dmp

memory/4964-35-0x0000000005350000-0x00000000053B6000-memory.dmp

memory/4964-36-0x0000000006070000-0x0000000006082000-memory.dmp

memory/4964-37-0x00000000065B0000-0x00000000065EC000-memory.dmp

memory/516-45-0x00000000060A0000-0x00000000060AA000-memory.dmp

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

MD5 baa5a62fa7c619060e00c3ba12903527
SHA1 40cad01636f42ae249a6ec20f5fd3dd05795fa75
SHA256 0726fbca0f60bd7db8c1f525c1e3726ee0e7b5886870f0d723629c5aa63a2d25
SHA512 5518e85deec72eae80dd1ffa011799f10f77b762ed39a5f5860f91fe411cfe8e61c1011c82e7ea53e29306dff7e34946560b1a058bfc589c6d3cf1b8d6fc4b55

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windef.exe.log

MD5 10eab9c2684febb5327b6976f2047587
SHA1 a12ed54146a7f5c4c580416aecb899549712449e
SHA256 f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA512 7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50

C:\Users\Admin\AppData\Local\Temp\3mntJo2Dq4Sj.bat

MD5 fdff1d7378cd3606978e6c8929f7df2b
SHA1 2ce5e0e253e2e5e5323bd8b202a34a6383648bea
SHA256 9a1b2dd146f7a089504bc2050a5b8949a6b6747cbc5119d711d03f649b431ff3
SHA512 6a1def49408c07a1542eb33521c31b22dfbd105c72ff19f0531cba12ae02819e5a172d6da9900ff598454d6a329c68c21efd1321a240e502800c00a485a013db

C:\Users\Admin\AppData\Roaming\Logs\09-01-2024

MD5 1484e56b355fcb5b419ef283c879dba4
SHA1 71c3821c3a50f968859f9e2c3126ab004b7cd612
SHA256 b7e65091421a0403cbaeab13eb580a09a8201207cd193c04826161960433c787
SHA512 e9c5766fcf791fb550aaa21fb7d1333b16a501e6ab8be74ee785cd6439fad6f9e8b5cbb8b0802081311363778e84ce516428ad4fc6548f2ed01ebd4b762228ef

C:\Users\Admin\AppData\Local\Temp\5noG6lDRCxC1.bat

MD5 6e04792becadace0db4637962db2de08
SHA1 e49b7ff7575551dbd0f0472f35227b5eaa07a6d0
SHA256 018f85fb9453ade2af2ba9d419dcd3596f0730160d0df70d667177297fe73034
SHA512 c650c3c5837fa5284676ac726067fe825e0a234b597e64c46d3281bca45891d08c762e8df4aa26b64aa7f61e3409fb6dc7e59d2be3751db03253a6c28b03beed

C:\Users\Admin\AppData\Roaming\Logs\09-01-2024

MD5 ecfa7f4acfd0730ee89b9a7806511996
SHA1 1ed0878c95e0f609876eff9b4cf12c88e9b8bf01
SHA256 029b9e090188e31d5707dc4b69038808decd3ecfd76556c221375ff5c8a97008
SHA512 92c4a154189c14cb7e2791c3efda567c7492274b855460770a4ba24335d25d9931027ceb26c36e7aab7964928ef0657a119f46a04941d09479d293991e977cf6

C:\Users\Admin\AppData\Local\Temp\t0AgLtCPSbAg.bat

MD5 d078d9afd2f60c8c7857bb0ab6c55148
SHA1 8493f5598cfa84f1f2603719350792f0f04a9525
SHA256 8c97f9df50635444324d7380383af4c501f244e2f7213237c87fa5da61756d05
SHA512 288a3e972cc84a6cc144e4bfc1084798b9fe19fd897ae8197cf63c52ac737e5500ed92b52c386eda662bcf4a02a1d8b84924d16fdcb9f0b9c5aa273d5b782e44