Malware Analysis Report

2024-10-19 02:39

Sample ID 240907-3vqf8avbrd
Target 8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11
SHA256 8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11
Tags
amadey cryptbot redline stealc @cloudytteam bundle default default2 fed3aa livetraffic credential_access discovery evasion infostealer persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11

Threat Level: Known bad

The file 8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11 was found to be: Known bad.

Malicious Activity Summary

amadey cryptbot redline stealc @cloudytteam bundle default default2 fed3aa livetraffic credential_access discovery evasion infostealer persistence spyware stealer trojan

Stealc

RedLine payload

Amadey

RedLine

CryptBot

Credentials from Password Stores: Credentials from Web Browsers

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Checks computer location settings

Unsecured Credentials: Credentials In Files

Identifies Wine through registry keys

Checks BIOS information in registry

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Modifies system certificate store

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-07 23:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-07 23:50

Reported

2024-09-07 23:53

Platform

win7-20240903-en

Max time kernel

148s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe"

Signatures

Amadey

trojan amadey

CryptBot

spyware stealer cryptbot

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\BabElmddCo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000260001\5KNCHALAH.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000265001\broadcom5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000266001\broadcom6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\km111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\km111.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000266001\broadcom6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000266001\broadcom6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000266001\broadcom6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\km111.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update" C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A

Checks installed software on the system

discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe N/A
File created C:\Windows\Tasks\Hkbsse.job C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000265001\broadcom5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\km111.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\BabElmddCo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000266001\broadcom6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\km111.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 190000000100000010000000dbd91ea86008fd8536f2b37529666c7b0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000020000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\BabElmddCo.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000260001\5KNCHALAH.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000260001\5KNCHALAH.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000266001\broadcom6.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\km111.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\km111.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2592 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2592 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2592 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2592 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2880 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2880 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2880 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2880 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2468 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2880 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2880 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2880 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2880 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 936 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 936 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 936 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 936 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 936 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 936 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 936 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 936 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 936 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 936 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 936 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 936 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 936 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 936 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2880 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2880 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2880 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2880 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2308 wrote to memory of 1448 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe
PID 2308 wrote to memory of 1448 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe
PID 2308 wrote to memory of 1448 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe
PID 2308 wrote to memory of 1448 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe
PID 2308 wrote to memory of 1544 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\BabElmddCo.exe
PID 2308 wrote to memory of 1544 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\BabElmddCo.exe
PID 2308 wrote to memory of 1544 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\BabElmddCo.exe
PID 2308 wrote to memory of 1544 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\BabElmddCo.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe

"C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"

C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe

"C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe"

C:\Users\Admin\AppData\Roaming\BabElmddCo.exe

"C:\Users\Admin\AppData\Roaming\BabElmddCo.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"

C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe

"C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"

C:\Users\Admin\AppData\Local\Temp\1000260001\5KNCHALAH.exe

"C:\Users\Admin\AppData\Local\Temp\1000260001\5KNCHALAH.exe"

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\1000265001\broadcom5.exe

"C:\Users\Admin\AppData\Local\Temp\1000265001\broadcom5.exe"

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Users\Admin\AppData\Local\Temp\1000266001\broadcom6.exe

"C:\Users\Admin\AppData\Local\Temp\1000266001\broadcom6.exe"

C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe

"C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe"

C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe

"C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe"

C:\Users\Admin\AppData\Local\Temp\km111.exe

"C:\Users\Admin\AppData\Local\Temp\km111.exe"

C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe

"C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe"

C:\Users\Admin\AppData\Local\Temp\km111.exe

"C:\Users\Admin\AppData\Local\Temp\km111.exe"

Network

Country Destination Domain Proto
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.117:80 185.215.113.117 tcp
DE 95.179.250.45:26212 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
FI 65.21.18.51:45580 tcp
RU 185.215.113.17:80 185.215.113.17 tcp
FI 95.216.107.53:12311 tcp
RU 185.215.113.67:15206 tcp
FI 95.216.143.20:12695 tcp
US 8.8.8.8:53 fivev5sb.top udp
RU 80.249.144.180:80 fivev5sb.top tcp
TM 91.202.233.158:80 91.202.233.158 tcp
RU 80.249.144.180:80 fivev5sb.top tcp
US 103.130.147.211:80 103.130.147.211 tcp
RU 80.249.144.180:80 fivev5sb.top tcp
FR 176.150.119.15:56002 tcp
US 8.8.8.8:53 mxstat8.cfd udp
DE 78.111.67.222:80 mxstat8.cfd tcp
FR 176.150.119.15:56003 tcp
FR 176.150.119.15:56001 tcp
US 8.8.8.8:53 conditionprovice.pro udp
FI 81.19.139.138:443 conditionprovice.pro tcp
FR 176.150.119.15:56002 tcp

Files

memory/2592-0-0x00000000009E0000-0x0000000000E98000-memory.dmp

memory/2592-1-0x0000000077850000-0x0000000077852000-memory.dmp

memory/2592-2-0x00000000009E1000-0x0000000000A0F000-memory.dmp

memory/2592-5-0x00000000009E0000-0x0000000000E98000-memory.dmp

memory/2592-4-0x00000000009E0000-0x0000000000E98000-memory.dmp

memory/2592-3-0x00000000009E0000-0x0000000000E98000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 aa2f2d08c69ff02aa0aa06c29cd23bf4
SHA1 357ed7040132d57d828d68cac28d3c3aea4bf62d
SHA256 8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11
SHA512 400d39b05afaf9fdb58a1247e71667c534d941803475f394abf6ce1964a5ac0559bdefc7012ae5526718bc146f8ae13f5dff06c80ebc87667e46144341c5f077

memory/2880-18-0x0000000000050000-0x0000000000508000-memory.dmp

memory/2592-16-0x00000000066F0000-0x0000000006BA8000-memory.dmp

memory/2592-15-0x00000000009E0000-0x0000000000E98000-memory.dmp

memory/2880-19-0x0000000000051000-0x000000000007F000-memory.dmp

memory/2880-20-0x0000000000050000-0x0000000000508000-memory.dmp

memory/2880-22-0x0000000000050000-0x0000000000508000-memory.dmp

memory/2880-23-0x0000000000050000-0x0000000000508000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

MD5 2d647cf43622ed10b6d733bb5f048fc3
SHA1 6b9c5f77a9ef064a23e5018178f982570cbc64c6
SHA256 41426dd54fcabbf30a68b2aa11aa4f61f3862bea83109d3e3c50cfebed1359e6
SHA512 62400f1e9646268f0326aab5b95efacb0303f4c5879cccf0cbb24d1f66d0db40d0fdfebb09ba785b5dfd54df2d32e8aab48c1f5f333956b606112de68635ac3a

memory/2468-38-0x0000000000F10000-0x0000000000F64000-memory.dmp

memory/2932-42-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2932-51-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2932-50-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2932-49-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2932-48-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2932-46-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2932-40-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2932-44-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tmp1891.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/2880-65-0x0000000000050000-0x0000000000508000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

MD5 8e74497aff3b9d2ddb7e7f819dfc69ba
SHA1 1d18154c206083ead2d30995ce2847cbeb6cdbc1
SHA256 d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66
SHA512 9aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97

memory/936-80-0x00000000008F0000-0x0000000000A02000-memory.dmp

memory/2880-81-0x0000000000050000-0x0000000000508000-memory.dmp

memory/2308-100-0x0000000000400000-0x000000000050D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

memory/2308-99-0x0000000000400000-0x000000000050D000-memory.dmp

C:\Users\Admin\AppData\Roaming\WxFEFB8OYd.exe

MD5 88367533c12315805c059e688e7cdfe9
SHA1 64a107adcbac381c10bd9c5271c2087b7aa369ec
SHA256 c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9
SHA512 7a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 64dac8316063005732778edd56bb99ca
SHA1 5dfb87b3d5091dda07ddd2db73775e964e4c32bc
SHA256 b6d0423b14c29e89ccee3beb38809675495faa35ff9a9cc7873ece4f2ff2ff3a
SHA512 06aadd7ac3d2fae26673ddc098554a3553e98b5520e94987774df9442b9effa9281a3b6a4b5d7a89f31a7d65a5e21dbe5351beeff45b4e7b9d2066e8bd6e29f5

memory/936-82-0x0000000002130000-0x0000000004130000-memory.dmp

memory/1448-124-0x0000000000B10000-0x0000000000B9E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-457978338-2990298471-2379561640-1000\76b53b3ec448f7ccdda2063b15d2bfc3_7ab03691-fc7c-4787-903d-423aed4b9dc2

MD5 f7662bcd964f9d7b519e28d5f9839757
SHA1 47ec94f4ac2f61d76adff0326f4c29fbbabbeb89
SHA256 0bbc63ba60112945ccef003ff21fb058b0075180aa6b6b2f6b8d47f7c6dfa2a6
SHA512 772b772c34604c58a9f5f03b9cb94dcef451b3ed5f4722cf05084f03485460d325de3c0364f5c2e0e73995d090db5052f5e20237b7c10819c565f42466e08320

memory/1544-131-0x0000000001270000-0x00000000012C2000-memory.dmp

C:\Users\Admin\AppData\Roaming\BabElmddCo.exe

MD5 30f46f4476cdc27691c7fdad1c255037
SHA1 b53415af5d01f8500881c06867a49a5825172e36
SHA256 3a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0
SHA512 271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f

memory/2308-128-0x0000000000400000-0x000000000050D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

memory/2308-97-0x0000000000400000-0x000000000050D000-memory.dmp

memory/2308-96-0x0000000000400000-0x000000000050D000-memory.dmp

memory/2308-93-0x0000000000400000-0x000000000050D000-memory.dmp

memory/2308-91-0x0000000000400000-0x000000000050D000-memory.dmp

memory/2308-89-0x0000000000400000-0x000000000050D000-memory.dmp

memory/2308-87-0x0000000000400000-0x000000000050D000-memory.dmp

memory/2308-85-0x0000000000400000-0x000000000050D000-memory.dmp

memory/2308-83-0x0000000000400000-0x000000000050D000-memory.dmp

memory/2880-163-0x0000000000050000-0x0000000000508000-memory.dmp

memory/2880-173-0x00000000061A0000-0x00000000063E3000-memory.dmp

memory/2880-176-0x0000000000050000-0x0000000000508000-memory.dmp

memory/2044-175-0x0000000000030000-0x0000000000273000-memory.dmp

memory/2880-174-0x00000000061A0000-0x00000000063E3000-memory.dmp

memory/2044-177-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab4990.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar4AAC.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/2880-234-0x0000000000050000-0x0000000000508000-memory.dmp

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/2044-259-0x0000000000030000-0x0000000000273000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe

MD5 45b55d1e5d2bf60cc572f541ae6fa7d1
SHA1 2329f56147a299bcdbf20520e626cc8253e49a8d
SHA256 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8
SHA512 5483964e050b2be073d3cf966b6dd6271556d4adfb420fb9ecf81f42f27cd06727016292dceb9a282f9fdcb451507309d1a78f58dd5d84e3022c0ea20c58dbe2

memory/2880-270-0x0000000000050000-0x0000000000508000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

MD5 7e6a519688246fe1180f35fe0d25d370
SHA1 8e8719ac897dfef7305311dc216f570af40709af
SHA256 32a927e9b33371b82bae9f02b5ebf07c19ae5a3a7e3c0cd3fcbee7cfff7f257a
SHA512 a751e911eb254749a3c8c98740f455a5be32ce1af94dc90eba8fc677d6d7379303f80247748dfcfe9c8570edb3488a5af97fa7ff29c815bec6824dd491e27972

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

MD5 03cf06e01384018ac325de8bc160b4b2
SHA1 1853505e502b392fd556a9ce6050207230cc70cd
SHA256 5ab3785b2b72eaf7edff8961eb8ff8dd3dc6cc7031bc96ceb06a899b6fb3bbbc
SHA512 be1f2cf898db93e96e8817bf2d0ab0ef0f49d5bba4efba2de4046f6b381e8eda6ff5fcfdc057b6cbc4de5b3a7b096612c1e0d6b0d395ee685b3844ba5dc0e1b6

memory/2784-307-0x0000000000110000-0x00000000001A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

MD5 30daa686c1f31cc4833bd3d7283d8cdc
SHA1 70f74571fafe1b359cfe9ce739c3752e35d16cf5
SHA256 504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822
SHA512 9f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9

memory/2448-322-0x0000000001130000-0x0000000001182000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 127b2780fa898ad13750e7a1f8494eba
SHA1 3e8f4f6fd783dcb8c0d6fdd85f4b43996ed13148
SHA256 8815364875c8a41557e7be845e20c952c7b2ddf92147c3812396fdb4819dfb78
SHA512 ffbf0259f28cb82f1457997348a93fd9fd824cf79e0d4ff3b250a2b39d396802559367165ea4193d8463598dbef5d0091439ed9dbc290b7fde254530a76ecb67

C:\Users\Admin\AppData\Local\Temp\1000260001\5KNCHALAH.exe

MD5 3f99c2698fc247d19dd7f42223025252
SHA1 043644883191079350b2f2ffbefef5431d768f99
SHA256 ba8561bf19251875a15471812042adac49f825c69c3087054889f6107297c6f3
SHA512 6a88d1049059bba8f0c9498762502e055107d9f82dbc0aacfdd1e1c138bdb875cf68c2b7998408f8235e53b2bb864ba6f43c249395640b62af305a62b9bfcd67

memory/2880-367-0x0000000000050000-0x0000000000508000-memory.dmp

memory/2576-368-0x0000000000400000-0x0000000001069000-memory.dmp

memory/2372-369-0x0000000000F80000-0x000000000111A000-memory.dmp

\Users\Admin\AppData\Local\Temp\svchost015.exe

MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

memory/2420-374-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2420-380-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2420-388-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2420-387-0x0000000000400000-0x0000000000643000-memory.dmp

memory/3048-386-0x0000000000400000-0x000000000079D000-memory.dmp

memory/2420-384-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2420-382-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2420-378-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2420-376-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2420-389-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2372-391-0x000000001BC50000-0x000000001BD7A000-memory.dmp

memory/2372-1482-0x0000000000DC0000-0x0000000000E0C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000265001\broadcom5.exe

MD5 36a627b26fae167e6009b4950ff15805
SHA1 f3cb255ab3a524ee05c8bab7b4c01c202906b801
SHA256 a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a
SHA512 2133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094

memory/2372-1478-0x000000001B600000-0x000000001B6A4000-memory.dmp

memory/2372-1487-0x000000001B6A0000-0x000000001B6F4000-memory.dmp

memory/2372-1488-0x000000001BB20000-0x000000001BB7C000-memory.dmp

memory/2372-1491-0x000000001C5A0000-0x000000001C65A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000266001\broadcom6.exe

MD5 cacfbf90da4dee64c89e3c808965aa4f
SHA1 4bbd2cb08097b9d303809cb11d1f6d5cda796051
SHA256 d3525969bc52fe879a43236b9abfdd0348157031cfa215e820d7205686e7556e
SHA512 5f7517b77021e0b8d18280ad2eedee7954d6c446cbd09f37d4e37fbc94c40c9bbae1520645a4bbf4175b4d166edfad3d4f3dc28148fc165537c48deb8e814ab8

memory/5948-1526-0x0000000000D90000-0x000000000223A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe

MD5 886224a4982435e68ed383051e7afd54
SHA1 36f2a13cf3071f5076c199476933105c84a81b5d
SHA256 075b787a1c1952697af1b747b896f2422ce61e3ec8f7a2ae39d380f652de3558
SHA512 948009a8bb4f201f3bcd24d4ff4ceb4c0dd949644761eecf55cc159ea0e4bc6c374746212fc663822cf70c600ab2aa824a39500ab2d592e4997e672161c83b7d

memory/5948-1541-0x0000000003870000-0x000000000390E000-memory.dmp

memory/6052-1542-0x0000000000EC0000-0x000000000111A000-memory.dmp

memory/6052-1543-0x0000000004EC0000-0x00000000050E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe

MD5 37d198ad751d31a71acc9cb28ed0c64e
SHA1 8eb519b7a6df66d84c566605da9a0946717a921d
SHA256 1ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde
SHA512 60923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96

memory/6052-1553-0x0000000006210000-0x0000000006432000-memory.dmp

memory/3844-1610-0x0000000000A50000-0x0000000000AC8000-memory.dmp

memory/2880-1609-0x00000000061A0000-0x00000000063E3000-memory.dmp

memory/6052-2637-0x00000000064E0000-0x000000000667C000-memory.dmp

memory/2264-2642-0x0000000000E90000-0x0000000000FF2000-memory.dmp

memory/2264-2643-0x0000000004C50000-0x0000000004D7A000-memory.dmp

memory/2264-2644-0x00000000050D0000-0x00000000051FA000-memory.dmp

memory/3844-2972-0x0000000000750000-0x000000000076A000-memory.dmp

memory/3268-3742-0x0000000000400000-0x000000000045E000-memory.dmp

memory/3268-3743-0x0000000000CE0000-0x0000000000D9C000-memory.dmp

memory/2264-3729-0x0000000004790000-0x0000000004836000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-07 23:50

Reported

2024-09-07 23:52

Platform

win10v2004-20240802-en

Max time kernel

142s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe"

Signatures

Amadey

trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe

"C:\Users\Admin\AppData\Local\Temp\8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 35.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

memory/2836-0-0x00000000004E0000-0x0000000000998000-memory.dmp

memory/2836-1-0x0000000077DA4000-0x0000000077DA6000-memory.dmp

memory/2836-2-0x00000000004E1000-0x000000000050F000-memory.dmp

memory/2836-3-0x00000000004E0000-0x0000000000998000-memory.dmp

memory/2836-4-0x00000000004E0000-0x0000000000998000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 aa2f2d08c69ff02aa0aa06c29cd23bf4
SHA1 357ed7040132d57d828d68cac28d3c3aea4bf62d
SHA256 8c52d73af2b643188fe09ebc53e7641ab77f2e9a3aee2cecd57b1ff84089dd11
SHA512 400d39b05afaf9fdb58a1247e71667c534d941803475f394abf6ce1964a5ac0559bdefc7012ae5526718bc146f8ae13f5dff06c80ebc87667e46144341c5f077

memory/2836-17-0x00000000004E0000-0x0000000000998000-memory.dmp

memory/3184-18-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-19-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-20-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-21-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-22-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-23-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-25-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-26-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-27-0x0000000000080000-0x0000000000538000-memory.dmp

memory/5072-29-0x0000000000080000-0x0000000000538000-memory.dmp

memory/5072-30-0x0000000000080000-0x0000000000538000-memory.dmp

memory/5072-31-0x0000000000080000-0x0000000000538000-memory.dmp

memory/5072-33-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-34-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-35-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-36-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-37-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-38-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-39-0x0000000000080000-0x0000000000538000-memory.dmp

memory/1572-41-0x0000000000080000-0x0000000000538000-memory.dmp

memory/1572-43-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-44-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-45-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-46-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-47-0x0000000000080000-0x0000000000538000-memory.dmp

memory/3184-48-0x0000000000080000-0x0000000000538000-memory.dmp