Malware Analysis Report

2024-10-23 16:21

Sample ID 240903-tqvqpssbrg
Target FileApp.zip
SHA256 9c279a961213bb1bdbc4944555da05dbe20fc89a8d557493fa86f217bdb36b2d
Tags
djvu redline stealc tofsee leva logsdiller cloud (tg: @logsdillabot) credential_access discovery evasion execution infostealer persistence privilege_escalation ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9c279a961213bb1bdbc4944555da05dbe20fc89a8d557493fa86f217bdb36b2d

Threat Level: Known bad

The file FileApp.zip was found to be: Known bad.

Malicious Activity Summary

djvu redline stealc tofsee leva logsdiller cloud (tg: @logsdillabot) credential_access discovery evasion execution infostealer persistence privilege_escalation ransomware spyware stealer trojan

Tofsee

RedLine payload

RedLine

Djvu Ransomware

Stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Credentials from Password Stores: Credentials from Web Browsers

Creates new service(s)

Stops running service(s)

Downloads MZ/PE file

Sets service image path in registry

Modifies Windows Firewall

Checks BIOS information in registry

Identifies Wine through registry keys

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks computer location settings

Reads data files stored by FTP clients

Modifies file permissions

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Power Settings

Looks up external IP address via web service

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Launches sc.exe

Browser Information Discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Unsigned PE

System Location Discovery: System Language Discovery

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-03 16:16

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-03 16:16

Reported

2024-09-03 16:29

Platform

win7-20240903-es

Max time kernel

264s

Max time network

304s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FileApp.exe"

Signatures

Djvu Ransomware

ransomware djvu

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Tofsee

trojan tofsee

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe N/A

Creates new service(s)

persistence execution

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\jzlukfpb\ImagePath = "C:\\Windows\\SysWOW64\\jzlukfpb\\nlvwyuxd.exe" C:\Windows\SysWOW64\svchost.exe N/A

Stops running service(s)

evasion execution

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\iofolko5\cl72WfKJXpWJZQ8APmUcRgLS.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\_b2DzgFESmNupBrOZqH1QyWa.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\d_LqOyosQVBLJULcMwoiDt6h.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\MlIQrhcIhmVCbQDsrEQn6hL4.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\mrfH53W_UOps4E2YW2zcAy43.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
N/A N/A C:\Windows\SysWOW64\jzlukfpb\nlvwyuxd.exe N/A
N/A N/A C:\Users\AdminCAEHDBAAEC.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\22726f0b-26f7-4321-b2cc-27745ea16ef3\\jHfb4pfbrQoklLLfzCz3zu3K.exe\" --AutoStart" C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.myip.com N/A N/A
N/A api.2ip.ua N/A N/A
N/A api64.ipify.org N/A N/A
N/A api64.ipify.org N/A N/A
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A
N/A api.myip.com N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\iofolko5\cl72WfKJXpWJZQ8APmUcRgLS.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\iofolko5\mrfH53W_UOps4E2YW2zcAy43.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\AdminCAEHDBAAEC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\jzlukfpb\nlvwyuxd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\FileApp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\iofolko5\_b2DzgFESmNupBrOZqH1QyWa.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\iofolko5\d_LqOyosQVBLJULcMwoiDt6h.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000020000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 190000000100000010000000dbd91ea86008fd8536f2b37529666c7b0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\MlIQrhcIhmVCbQDsrEQn6hL4.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
N/A N/A C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2476 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2476 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2476 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2476 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2476 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2476 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2476 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2476 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2476 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2476 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2476 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2476 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2476 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2476 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2640 wrote to memory of 2368 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\cl72WfKJXpWJZQ8APmUcRgLS.exe
PID 2640 wrote to memory of 2368 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\cl72WfKJXpWJZQ8APmUcRgLS.exe
PID 2640 wrote to memory of 2368 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\cl72WfKJXpWJZQ8APmUcRgLS.exe
PID 2640 wrote to memory of 2368 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\cl72WfKJXpWJZQ8APmUcRgLS.exe
PID 2640 wrote to memory of 2772 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\_b2DzgFESmNupBrOZqH1QyWa.exe
PID 2640 wrote to memory of 2772 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\_b2DzgFESmNupBrOZqH1QyWa.exe
PID 2640 wrote to memory of 2772 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\_b2DzgFESmNupBrOZqH1QyWa.exe
PID 2640 wrote to memory of 2772 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\_b2DzgFESmNupBrOZqH1QyWa.exe
PID 2640 wrote to memory of 2880 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\d_LqOyosQVBLJULcMwoiDt6h.exe
PID 2640 wrote to memory of 2880 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\d_LqOyosQVBLJULcMwoiDt6h.exe
PID 2640 wrote to memory of 2880 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\d_LqOyosQVBLJULcMwoiDt6h.exe
PID 2640 wrote to memory of 2880 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\d_LqOyosQVBLJULcMwoiDt6h.exe
PID 2640 wrote to memory of 2744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe
PID 2640 wrote to memory of 2744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe
PID 2640 wrote to memory of 2744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe
PID 2640 wrote to memory of 2744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe
PID 2640 wrote to memory of 2744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe
PID 2640 wrote to memory of 2744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe
PID 2640 wrote to memory of 2744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe
PID 2640 wrote to memory of 2768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe
PID 2640 wrote to memory of 2768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe
PID 2640 wrote to memory of 2768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe
PID 2640 wrote to memory of 2768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe
PID 2640 wrote to memory of 2676 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe
PID 2640 wrote to memory of 2676 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe
PID 2640 wrote to memory of 2676 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe
PID 2640 wrote to memory of 2676 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe
PID 2640 wrote to memory of 2796 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe
PID 2640 wrote to memory of 2796 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe
PID 2640 wrote to memory of 2796 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe
PID 2640 wrote to memory of 2796 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe
PID 2640 wrote to memory of 2188 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\MlIQrhcIhmVCbQDsrEQn6hL4.exe
PID 2640 wrote to memory of 2188 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\MlIQrhcIhmVCbQDsrEQn6hL4.exe
PID 2640 wrote to memory of 2188 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\MlIQrhcIhmVCbQDsrEQn6hL4.exe
PID 2640 wrote to memory of 2188 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\MlIQrhcIhmVCbQDsrEQn6hL4.exe
PID 2640 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe
PID 2640 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe
PID 2640 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe
PID 2640 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe
PID 2640 wrote to memory of 1724 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\mrfH53W_UOps4E2YW2zcAy43.exe
PID 2640 wrote to memory of 1724 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\mrfH53W_UOps4E2YW2zcAy43.exe
PID 2640 wrote to memory of 1724 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\mrfH53W_UOps4E2YW2zcAy43.exe
PID 2640 wrote to memory of 1724 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\Documents\iofolko5\mrfH53W_UOps4E2YW2zcAy43.exe
PID 2744 wrote to memory of 2648 N/A C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp
PID 2744 wrote to memory of 2648 N/A C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp
PID 2744 wrote to memory of 2648 N/A C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp
PID 2744 wrote to memory of 2648 N/A C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp
PID 2744 wrote to memory of 2648 N/A C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp
PID 2744 wrote to memory of 2648 N/A C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp
PID 2744 wrote to memory of 2648 N/A C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\FileApp.exe

"C:\Users\Admin\AppData\Local\Temp\FileApp.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\Documents\iofolko5\cl72WfKJXpWJZQ8APmUcRgLS.exe

C:\Users\Admin\Documents\iofolko5\cl72WfKJXpWJZQ8APmUcRgLS.exe

C:\Users\Admin\Documents\iofolko5\_b2DzgFESmNupBrOZqH1QyWa.exe

C:\Users\Admin\Documents\iofolko5\_b2DzgFESmNupBrOZqH1QyWa.exe

C:\Users\Admin\Documents\iofolko5\d_LqOyosQVBLJULcMwoiDt6h.exe

C:\Users\Admin\Documents\iofolko5\d_LqOyosQVBLJULcMwoiDt6h.exe

C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe

C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe

C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe

C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe

C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe

C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe

C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe

C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe

C:\Users\Admin\Documents\iofolko5\MlIQrhcIhmVCbQDsrEQn6hL4.exe

C:\Users\Admin\Documents\iofolko5\MlIQrhcIhmVCbQDsrEQn6hL4.exe

C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe

C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe

C:\Users\Admin\Documents\iofolko5\mrfH53W_UOps4E2YW2zcAy43.exe

C:\Users\Admin\Documents\iofolko5\mrfH53W_UOps4E2YW2zcAy43.exe

C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp

"C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp" /SL5="$7011C,3332875,54272,C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe

"C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe

"C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe"

C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe

"C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe"

C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe

"C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe"

C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe

"C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe"

C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe

C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jzlukfpb\

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\22726f0b-26f7-4321-b2cc-27745ea16ef3" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\nlvwyuxd.exe" C:\Windows\SysWOW64\jzlukfpb\

C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe

"C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe

"C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create jzlukfpb binPath= "C:\Windows\SysWOW64\jzlukfpb\nlvwyuxd.exe /d\"C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description jzlukfpb "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start jzlukfpb

C:\Windows\SysWOW64\jzlukfpb\nlvwyuxd.exe

C:\Windows\SysWOW64\jzlukfpb\nlvwyuxd.exe /d"C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminCAEHDBAAEC.exe"

C:\Users\AdminCAEHDBAAEC.exe

"C:\Users\AdminCAEHDBAAEC.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminDBFCBGCGIJ.exe"

C:\Users\AdminDBFCBGCGIJ.exe

"C:\Users\AdminDBFCBGCGIJ.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "VIFLJRPW"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "VIFLJRPW" binpath= "C:\ProgramData\xprfjygruytr\etzpikspwykg.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "VIFLJRPW"

C:\ProgramData\xprfjygruytr\etzpikspwykg.exe

C:\ProgramData\xprfjygruytr\etzpikspwykg.exe

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 185.143.223.148:80 185.143.223.148 tcp
US 8.8.8.8:53 api64.ipify.org udp
US 104.237.62.213:443 api64.ipify.org tcp
US 104.237.62.213:443 api64.ipify.org tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.59.81:443 ipinfo.io tcp
US 34.117.59.81:443 ipinfo.io tcp
US 8.8.8.8:53 db-ip.com udp
US 172.67.75.166:443 db-ip.com tcp
US 8.8.8.8:53 api.myip.com udp
US 104.26.9.59:443 api.myip.com tcp
US 185.143.223.148:80 185.143.223.148 tcp
US 8.8.8.8:53 240902180529931.tyr.zont16.com udp
US 8.8.8.8:53 file-link-iota.vercel.app udp
US 8.8.8.8:53 prodesarrolloapurimac.pe udp
RU 176.111.174.109:80 176.111.174.109 tcp
RU 31.41.244.9:80 31.41.244.9 tcp
CH 147.45.44.104:80 147.45.44.104 tcp
RU 176.113.115.33:80 176.113.115.33 tcp
CH 147.45.44.104:80 147.45.44.104 tcp
CA 51.222.104.23:80 prodesarrolloapurimac.pe tcp
US 76.76.21.9:80 file-link-iota.vercel.app tcp
US 76.76.21.9:80 file-link-iota.vercel.app tcp
CH 179.43.188.227:80 240902180529931.tyr.zont16.com tcp
US 76.76.21.9:80 file-link-iota.vercel.app tcp
CA 51.222.104.23:80 prodesarrolloapurimac.pe tcp
US 76.76.21.9:80 file-link-iota.vercel.app tcp
US 76.76.21.9:443 file-link-iota.vercel.app tcp
US 76.76.21.9:443 file-link-iota.vercel.app tcp
CA 51.222.104.23:80 prodesarrolloapurimac.pe tcp
US 76.76.21.9:443 file-link-iota.vercel.app tcp
US 76.76.21.9:443 file-link-iota.vercel.app tcp
CA 51.222.104.23:80 prodesarrolloapurimac.pe tcp
CA 51.222.104.23:443 prodesarrolloapurimac.pe tcp
CA 51.222.104.23:443 prodesarrolloapurimac.pe tcp
CA 51.222.104.23:443 prodesarrolloapurimac.pe tcp
CA 51.222.104.23:443 prodesarrolloapurimac.pe tcp
US 8.8.8.8:53 iplogger.org udp
US 104.26.3.46:443 iplogger.org tcp
RU 185.215.113.100:80 185.215.113.100 tcp
FR 147.45.68.138:80 147.45.68.138 tcp
CZ 46.8.231.109:80 46.8.231.109 tcp
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
DE 147.45.47.36:30035 tcp
GB 142.250.178.3:80 c.pki.goog tcp
US 172.67.139.220:443 api.2ip.ua tcp
FI 95.216.107.53:12311 tcp
US 8.8.8.8:53 cajgtus.com udp
MX 189.163.84.89:80 cajgtus.com tcp
US 8.8.8.8:53 microsoft.com udp
NL 20.76.201.171:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.42.13:25 microsoft-com.mail.protection.outlook.com tcp
CH 147.45.44.104:80 147.45.44.104 tcp
US 8.8.8.8:53 traineiwnqo.shop udp
US 188.114.96.9:443 traineiwnqo.shop tcp
US 8.8.8.8:53 vanaheim.cn udp
RU 77.232.41.29:443 vanaheim.cn tcp
RU 62.122.184.58:483 tcp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 45.76.89.70:443 pool.hashvault.pro tcp
US 8.8.8.8:53 70.13.110.194.dnsbl.sorbs.net udp
US 8.8.8.8:53 70.13.110.194.bl.spamcop.net udp
US 8.8.8.8:53 70.13.110.194.zen.spamhaus.org udp
US 8.8.8.8:53 70.13.110.194.sbl-xbl.spamhaus.org udp
US 8.8.8.8:53 70.13.110.194.cbl.abuseat.org udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 67.195.228.111:25 mta6.am0.yahoodns.net tcp
RU 176.111.174.109:419 tcp
UA 45.143.201.238:419 tcp
RU 176.113.115.84:419 tcp
RU 193.143.1.5:419 tcp
RU 176.113.115.135:419 tcp
RU 176.113.115.136:419 tcp
RU 176.111.174.92:419 tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
FR 147.45.68.138:80 147.45.68.138 tcp
DE 208.91.106.45:443 tcp

Files

memory/2476-0-0x000000007481E000-0x000000007481F000-memory.dmp

memory/2476-1-0x0000000000F10000-0x000000000182C000-memory.dmp

memory/2476-2-0x0000000005B80000-0x0000000005E7E000-memory.dmp

memory/2476-3-0x00000000005D0000-0x00000000005F2000-memory.dmp

memory/2640-5-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-10-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-15-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-19-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-20-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-17-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2640-11-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-9-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-8-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-6-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-21-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-23-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-32-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-34-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-33-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-31-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-30-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-29-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-28-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-27-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-26-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-25-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-24-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-22-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-38-0x0000000000400000-0x00000000005E0000-memory.dmp

C:\Users\Admin\Documents\iofolko5\_b2DzgFESmNupBrOZqH1QyWa.exe

MD5 6b19e5c100db0812ffb7813a1503c05d
SHA1 17032c0b1b056bec3f23786bad5aa17404de3297
SHA256 516b1a67a3aafceadff083854b26512174cbed4d455c5d8f8993acc8a895ea2e
SHA512 fb97bd74aae13cb4d0205cf704300dfc4f0678dcbd07aacc295bc13b666a4bff46f12786c2d37702a7a783e786a6a92df31df37a39ebcaee74d46c58e0c4e27c

memory/2640-47-0x0000000000400000-0x00000000005E0000-memory.dmp

C:\Users\Admin\Documents\iofolko5\d_LqOyosQVBLJULcMwoiDt6h.exe

MD5 998f7fb6068e4377618bcdb2138bc6f0
SHA1 2339b59c00bbe3707926a0f4a5964b5e76d18d57
SHA256 15a0da7dfccb96d1a46f5eef42ceaa7fcb49da5c88e32fc78921d6a9b20f12be
SHA512 d0896f66aa2422c467daa57612afdf4dffaca1b788ee4f34ecf6f15225aafe879142e9d3bac4db584bcfe9bb8ad47a32c26c9ea0dc7e04370251eac64d4bc9d6

C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe

MD5 b2e864c2f8f6e243822a5c133bb41061
SHA1 5571df4cdc5b65cdc315c95ee52344dda7f12b20
SHA256 2cccbfbe95b716e6f8b5ed1634b9ae4e6ab87e1355804ca5aea8d353673ff6a2
SHA512 32a6087702abe92daab3e2c194b07006f5b9d3cdf48c692d23775f0d75e2941882920767148564ac7fedc417beadb1ae75734f240d07bec30eb262ae4f534e73

C:\Users\Admin\Documents\iofolko5\mrfH53W_UOps4E2YW2zcAy43.exe

MD5 d8ecb462d3046a0ee172551c5d505c8e
SHA1 54f9e16b497579964e9afc90c3c0c208f16b4418
SHA256 afb9edbf499a4726d798cda9f0f372b4b1019033b68d5eb87a8a83ecb7463d6f
SHA512 9eed44c24a71b44e90efc853b75d2103faa3f8518e1efad45c8c4733ee0396c51e8ea11ba6e7d2ac4f30234e6380c3325227cced8d1753373581eb45073c012e

C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe

MD5 5bf21229b0e8c6361a56f0aec0121cc4
SHA1 a46472a1168dad39660f923bb25dc333d24cd2cb
SHA256 249001bdb6015ef538d4654e6f5c5a1522b7382987ec926d062578ae973f8a71
SHA512 5de8222c9ae3a6f89a368722cb226f1f82d4b290831c44d3ab84f0d21a3d9432c4dfa126ec53501d0f49227d27c911cd4fe89361d13951117b06897cc52baf0f

C:\Users\Admin\Documents\iofolko5\cl72WfKJXpWJZQ8APmUcRgLS.exe

MD5 6f99968cc27d2d6a07a921ab703a5d5d
SHA1 1b1f72a9ca325b2d7b01f66ae1ebef646b167ec0
SHA256 5ef282479f0c6f082f15d3f878f8c4b418259ebc6d7941a472e0f28cdcc43c88
SHA512 3ea9cbbb6ab281c02aef8473f40ec00412a05b613d4a45e228e06f4a585ae25ba35dc2eb2a772cf9ab38e86a05b67a4388b4ef306483ef030666d1c242ba370a

C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe

MD5 7a2ac5711382c571a1adc3f296cf10dd
SHA1 101ea008e9556045ca374e7304680e164bcbeda8
SHA256 5ee907cd468e9d572557e7b8326cd1c577edb733117fa47949fde2989d32144f
SHA512 7d7a710b66dc015428e230182761094aa16cd5e48f459aa6e1a64bcdefbbcf5a37118a04bd79ba81f97b69ec8d0c75c9ba5cf8ed2cbae7389fdfb02dd28907a6

memory/2640-96-0x0000000000400000-0x00000000005E0000-memory.dmp

C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe

MD5 b5887a19fe50bfa32b524aaad0a453bc
SHA1 cd1f3905959cd596c83730a5b03ceef4e9f2a877
SHA256 fce5cbeec1eb5274fc3afa55e57fb2f724688cb9d4661a8a86716011493564c7
SHA512 5b9914c94101b53314b14335e687552e5da0a4085afb826ae94f45769e9b1e66a35624b6e6b60257514f4adf2acc5c9e048bfa3a24aafb891d203e3011c02538

C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe

MD5 7972b08246e568495d9d116fc2d0b159
SHA1 3e12225494f08369858453fd9fc7481b4f788165
SHA256 2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84
SHA512 f0ead246f31d1badb3cd5fd67cb5b3081f027fdad44dd50364734d61722f1bc2cacb1ad5d842ca3f7000a2699e7bdf059a508b54a95f5e155ae274d70e833ff7

C:\Users\Admin\Documents\iofolko5\MlIQrhcIhmVCbQDsrEQn6hL4.exe

MD5 025ebe0a476fe1a27749e6da0eea724f
SHA1 fe844380280463b927b9368f9eace55eb97baab7
SHA256 2a51d50f42494c6ab6027dbd35f8861bdd6fe1551f5fb30bf10138619f4bc4b2
SHA512 5f2b40713cc4c54098da46f390bbeb0ac2fc0c0872c7fbdfdca26ab087c81ff0144b89347040cc93e35b5e5dd5dc102db28737baea616183bef4caecebfb9799

memory/2640-124-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-134-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-138-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-170-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-182-0x00000000058A0000-0x0000000005F2F000-memory.dmp

memory/2640-185-0x00000000058A0000-0x0000000005F2F000-memory.dmp

memory/2676-187-0x0000000000AF0000-0x000000000117F000-memory.dmp

memory/2640-179-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-174-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-156-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2744-149-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2640-164-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-146-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2640-129-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2188-195-0x0000000077C80000-0x0000000077C82000-memory.dmp

memory/2188-193-0x0000000077C80000-0x0000000077C82000-memory.dmp

memory/2188-191-0x0000000077C80000-0x0000000077C82000-memory.dmp

memory/2640-196-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/1188-197-0x00000000001E0000-0x0000000000A22000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp

MD5 fcb9a039e355dca5927a620396662e9d
SHA1 ebd8951e470635332cbf43afaf277e6eeaa1aaaf
SHA256 7e94a78d2279d7b9760b5c720c4cab64cfe4384ec6ea6f4e39e1a65609890976
SHA512 653b0fe17c4074a3c5e8058873b4a2ce7dcb2738f6f2e28dd00ca089214a8554b3782a1f152288cef96dd4027bf31b1d5672a906ccc21e4ceae14a43fa4d020d

memory/2368-207-0x00000000002D0000-0x000000000031A000-memory.dmp

memory/1188-209-0x0000000004EE0000-0x0000000005090000-memory.dmp

memory/984-221-0x0000000000400000-0x0000000000452000-memory.dmp

memory/984-220-0x0000000000400000-0x0000000000452000-memory.dmp

memory/984-219-0x0000000000400000-0x0000000000452000-memory.dmp

memory/984-218-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/984-216-0x0000000000400000-0x0000000000452000-memory.dmp

memory/984-214-0x0000000000400000-0x0000000000452000-memory.dmp

memory/984-212-0x0000000000400000-0x0000000000452000-memory.dmp

memory/984-210-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2772-203-0x00000000000D0000-0x0000000000124000-memory.dmp

memory/1204-225-0x0000000000400000-0x0000000000657000-memory.dmp

memory/1204-223-0x0000000000400000-0x0000000000657000-memory.dmp

memory/1724-222-0x0000000000CA0000-0x0000000000D28000-memory.dmp

memory/2880-243-0x0000000000870000-0x00000000008A8000-memory.dmp

memory/1188-261-0x0000000000DB0000-0x0000000000DD2000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-DGQRR.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/2676-275-0x0000000000AF0000-0x000000000117F000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-DGQRR.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

memory/2972-294-0x0000000000400000-0x0000000000486000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tmp9D2A.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

C:\Users\Admin\AppData\Local\Temp\nlvwyuxd.exe

MD5 57a370a3c9d8153daaf354c2a93e807f
SHA1 725692cc0351419495c2795b99e1a94c94299361
SHA256 2630ac035e1ff15ff73702b3bf372cfc5af2eae5b5c2b833f076df98cb6ab4a4
SHA512 f6e54d2dc29a40d2ba5c8d789e083f824c10acdc5be271bc054627dbfe786f73bc553a53481c427c515acef9a665d257e83a7040811231939db999b78b9ca93c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\Local\Temp\CabA709.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 0c7ab8bca7a846177c305f8a839ae6be
SHA1 5d331608f4879f0c31b75b39a846303e8b2ca9bf
SHA256 5c0ef93db3944a4d8b7e47a76681345c8e0baf793e1c698f897902188d5ae820
SHA512 c496bbb6b4bd23afd440cc58079f8eb92ec61d0979452f217910a3965f20498c421306abc5923cd4363f521dc6fbab16d07ea7050ab2f784b6c6024b93b10fb4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 dd776116027bf05105d0b67762a4b1fd
SHA1 83ba015fca8305a4850fc92d1e510e13451c8176
SHA256 cce25db7c21eecfaf30081e72c913ffb4e116a0a3ee7e98b95bea365131cd94f
SHA512 82a5b72f659429413e8b2c85909703d6ed1c589da00eb19db9ede116cd65a83dfd1e6fb11462e79c3bd11fe5a626e8d2c3f074384fec296fe6d21e78f6e2a1ec

C:\Users\Admin\AppData\Local\Temp\TarA748.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\ProgramData\FCGIJKJJKEBG\GHJDHD

MD5 2cd7a684788f438d7a7ae3946df2e26f
SHA1 3e5a60f38395f3c10d9243ba696468d2bb698a14
SHA256 2ebed8dd3531958e857c87ddbf46376b8a10ea2f364d2399d9fcc604da0bee1d
SHA512 0fec4b36e2173d1ad5eca880e1be1d0c7093d459aeb612d371e4ac92fbeaea55beb36e9228d36d57fe1851bd4d57b26dd5b8edb4620fb17b91441e840669c7d1

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\vcruntime140.dll

MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\softokn3.dll

MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

C:\ProgramData\msvcp140.dll

MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

C:\ProgramData\freebl3.dll

MD5 550686c0ee48c386dfcb40199bd076ac
SHA1 ee5134da4d3efcb466081fb6197be5e12a5b22ab
SHA256 edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa
SHA512 0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

memory/1944-494-0x0000000000290000-0x00000000002DA000-memory.dmp

C:\ProgramData\FCGIJKJJKEBG\JDGCFB

MD5 267d46a0d5fc4c0fbe1ac157d62955c3
SHA1 8b5e6f3a399e18c27dd84fafa2d0ad1f6e0c55b0
SHA256 4fec4b334e7835087b88c216478e031aca0e2d70ead95c0f7a7037eaa5594eed
SHA512 0cd1accf3970e5f509a08342aafb886cdec3a867d11e0d4770b69b765a70da02e5ee6691247e4cc734ac0de9738a7cf51a0bb9112e80e9e8cd45da7e7431c0f2

memory/2504-525-0x0000000000800000-0x0000000000858000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-03 16:16

Reported

2024-09-03 16:30

Platform

win10-20240611-es

Max time kernel

186s

Max time network

301s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FileApp.exe"

Signatures

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A api64.ipify.org N/A N/A
N/A api64.ipify.org N/A N/A
N/A ipinfo.io N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3612 set thread context of 2804 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\FileApp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\FileApp.exe

"C:\Users\Admin\AppData\Local\Temp\FileApp.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
US 185.143.223.148:80 185.143.223.148 tcp
US 8.8.8.8:53 api64.ipify.org udp
US 104.237.62.213:443 api64.ipify.org tcp
US 8.8.8.8:53 213.62.237.104.in-addr.arpa udp
US 8.8.8.8:53 148.223.143.185.in-addr.arpa udp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.59.81:443 ipinfo.io tcp
US 8.8.8.8:53 81.59.117.34.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp

Files

memory/3612-0-0x000000007376E000-0x000000007376F000-memory.dmp

memory/3612-1-0x0000000000CE0000-0x00000000015FC000-memory.dmp

memory/3612-2-0x0000000006010000-0x00000000060AC000-memory.dmp

memory/3612-3-0x00000000063B0000-0x00000000066AE000-memory.dmp

memory/3612-4-0x00000000061B0000-0x00000000061D2000-memory.dmp

memory/2804-5-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2804-8-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2804-10-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2804-7-0x0000000000400000-0x00000000005E0000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-09-03 16:16

Reported

2024-09-03 16:29

Platform

win10v2004-20240802-es

Max time kernel

233s

Max time network

266s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FileApp.exe"

Signatures

Looks up external IP address via web service

Description Indicator Process Target
N/A api64.ipify.org N/A N/A
N/A api64.ipify.org N/A N/A
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2764 set thread context of 1344 N/A C:\Users\Admin\AppData\Local\Temp\FileApp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\FileApp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\FileApp.exe

"C:\Users\Admin\AppData\Local\Temp\FileApp.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --field-trial-handle=4244,i,6361023742586262739,9517381529795161260,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
NL 62.133.61.172:80 62.133.61.172 tcp
US 8.8.8.8:53 api64.ipify.org udp
US 104.237.62.213:443 api64.ipify.org tcp
US 8.8.8.8:53 172.61.133.62.in-addr.arpa udp
US 8.8.8.8:53 213.62.237.104.in-addr.arpa udp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.59.81:443 ipinfo.io tcp
US 8.8.8.8:53 81.59.117.34.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 82.242.123.52.in-addr.arpa udp

Files

memory/2764-0-0x000000007534E000-0x000000007534F000-memory.dmp

memory/2764-1-0x0000000000D00000-0x000000000161C000-memory.dmp

memory/2764-2-0x00000000060B0000-0x000000000614C000-memory.dmp

memory/2764-3-0x0000000006310000-0x000000000660E000-memory.dmp

memory/2764-4-0x0000000006090000-0x00000000060B2000-memory.dmp

memory/1344-5-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/1344-7-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/1344-10-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/1344-8-0x0000000000400000-0x00000000005E0000-memory.dmp