Malware Analysis Report

2024-10-18 23:30

Sample ID 240913-e6pr3avepe
Target faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe
SHA256 faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe
Tags
amadey cryptbot redline stealc zharkbot 1176f2 @oleh_psp bundle default default2 fed3aa livetraffic botnet credential_access discovery evasion infostealer persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe

Threat Level: Known bad

The file faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe was found to be: Known bad.

Malicious Activity Summary

amadey cryptbot redline stealc zharkbot 1176f2 @oleh_psp bundle default default2 fed3aa livetraffic botnet credential_access discovery evasion infostealer persistence spyware stealer trojan

Stealc

RedLine payload

RedLine

Detects ZharkBot payload

CryptBot

ZharkBot

Amadey

Suspicious use of NtCreateUserProcessOtherParentProcess

Credentials from Password Stores: Credentials from Web Browsers

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Reads user/profile data of web browsers

Checks BIOS information in registry

Unsecured Credentials: Credentials In Files

Loads dropped DLL

Reads data files stored by FTP clients

Identifies Wine through registry keys

Checks computer location settings

Executes dropped EXE

Drops startup file

Adds Run key to start application

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates processes with tasklist

Suspicious use of SetThreadContext

Drops file in Windows directory

Unsigned PE

Program crash

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-13 04:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-13 04:33

Reported

2024-09-13 04:35

Platform

win10v2004-20240802-en

Max time kernel

148s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

CryptBot

spyware stealer cryptbot

Detects ZharkBot payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 5036 created 3396 N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif C:\Windows\Explorer.EXE
PID 5036 created 3396 N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif C:\Windows\Explorer.EXE

ZharkBot

botnet zharkbot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000223001\06b61a55f3.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000223001\06b61a55f3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000223001\06b61a55f3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000220001\crypteda.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\GYMaNoAMnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe N/A
N/A N/A C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000172001\3546345.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000220001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\poFZ7fIa7j.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\UYfJrdBvN5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000221001\exbuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000223001\06b61a55f3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000308001\kitty.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\appgate15.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000330001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000335001\ufw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000223001\06b61a55f3.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Subsystem Framework = "\"C:\\ProgramData\\Microsoft Subsystem Framework\\winmsbt.exe\"" C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update" C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update" C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A api64.ipify.org N/A N/A
N/A api64.ipify.org N/A N/A
N/A ipinfo.io N/A N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A
File created C:\Windows\Tasks\Hkbsse.job C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000308001\kitty.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000221001\exbuild.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\choice.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\GYMaNoAMnr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000220001\crypteda.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000335001\ufw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\poFZ7fIa7j.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\UYfJrdBvN5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000223001\06b61a55f3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000330001\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000172001\3546345.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000322001\appgate15.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\GYMaNoAMnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\GYMaNoAMnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\GYMaNoAMnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\GYMaNoAMnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\GYMaNoAMnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\GYMaNoAMnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000223001\06b61a55f3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000223001\06b61a55f3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\poFZ7fIa7j.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\poFZ7fIa7j.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\UYfJrdBvN5.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\UYfJrdBvN5.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\UYfJrdBvN5.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\UYfJrdBvN5.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\UYfJrdBvN5.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\UYfJrdBvN5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\GYMaNoAMnr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\poFZ7fIa7j.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\poFZ7fIa7j.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\poFZ7fIa7j.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\poFZ7fIa7j.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\poFZ7fIa7j.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\poFZ7fIa7j.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\UYfJrdBvN5.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4272 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 4272 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 4272 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 5048 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 5048 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 5048 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 756 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 756 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 756 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 756 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 756 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 756 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 756 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 756 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5048 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 5048 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 5048 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 3236 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe
PID 3236 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe
PID 3236 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe
PID 3236 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\GYMaNoAMnr.exe
PID 3236 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\GYMaNoAMnr.exe
PID 3236 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\GYMaNoAMnr.exe
PID 5048 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 5048 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 5048 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 4432 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 4432 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 4432 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 5048 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 5048 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 5048 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 5048 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 5048 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 5048 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 5048 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 5048 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 5048 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 5048 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 5048 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 5048 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 1964 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 1964 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 1964 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 1964 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 1964 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 1964 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 1964 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 1964 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 5048 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 5048 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 5048 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 5048 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
PID 5048 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
PID 5048 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
PID 5048 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
PID 5048 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
PID 5048 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
PID 680 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 680 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 680 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 680 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 680 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 680 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe

"C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"

C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe

"C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe"

C:\Users\Admin\AppData\Roaming\GYMaNoAMnr.exe

"C:\Users\Admin\AppData\Roaming\GYMaNoAMnr.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"

C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe"

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"

C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe

"C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3724 -ip 3724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 412

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe

"C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe"

C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe

"C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe"

C:\Users\Admin\AppData\Local\Temp\1000172001\3546345.exe

"C:\Users\Admin\AppData\Local\Temp\1000172001\3546345.exe"

C:\Users\Admin\AppData\Local\Temp\1000220001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000220001\crypteda.exe"

C:\Users\Admin\AppData\Roaming\poFZ7fIa7j.exe

"C:\Users\Admin\AppData\Roaming\poFZ7fIa7j.exe"

C:\Users\Admin\AppData\Roaming\UYfJrdBvN5.exe

"C:\Users\Admin\AppData\Roaming\UYfJrdBvN5.exe"

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Users\Admin\AppData\Local\Temp\1000221001\exbuild.exe

"C:\Users\Admin\AppData\Local\Temp\1000221001\exbuild.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Users\Admin\AppData\Local\Temp\1000223001\06b61a55f3.exe

"C:\Users\Admin\AppData\Local\Temp\1000223001\06b61a55f3.exe"

C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe

"C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k move Luck Luck.bat & Luck.bat & exit

C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe

"C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa opssvc"

C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe

"C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 684126

C:\Windows\SysWOW64\findstr.exe

findstr /V "VegetablesIndividualBindingGba" Ever

C:\Users\Admin\AppData\Local\Temp\1000308001\kitty.exe

"C:\Users\Admin\AppData\Local\Temp\1000308001\kitty.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b ..\Wire + ..\Qualified + ..\Manufacturers + ..\Wesley + ..\Haiti + ..\Done + ..\Drop + ..\Runner + ..\Defend + ..\Judy + ..\Dow C

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4380 -ip 4380

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 488

C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif

Intake.pif C

C:\Windows\SysWOW64\choice.exe

choice /d y /t 5

C:\Windows\SysWOW64\cmd.exe

cmd /c schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F

C:\Windows\SysWOW64\cmd.exe

cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & echo URL="C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & exit

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F

C:\Users\Admin\AppData\Local\Temp\1000322001\appgate15.exe

"C:\Users\Admin\AppData\Local\Temp\1000322001\appgate15.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000330001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000330001\2.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3612 -ip 3612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 412

C:\Users\Admin\AppData\Local\Temp\1000335001\ufw.exe

"C:\Users\Admin\AppData\Local\Temp\1000335001\ufw.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\service123.exe

C:\Users\Admin\AppData\Local\Temp\/service123.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.117:80 185.215.113.117 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 117.113.215.185.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
FI 65.21.18.51:45580 tcp
US 8.8.8.8:53 26.113.215.185.in-addr.arpa udp
RU 185.215.113.26:80 185.215.113.26 tcp
US 8.8.8.8:53 51.18.21.65.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 iakovosioannidis.com udp
FR 62.133.62.93:80 iakovosioannidis.com tcp
US 8.8.8.8:53 93.62.133.62.in-addr.arpa udp
RU 185.215.113.17:80 185.215.113.17 tcp
US 103.130.147.211:80 103.130.147.211 tcp
FI 95.216.107.53:12311 tcp
US 8.8.8.8:53 17.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 53.107.216.95.in-addr.arpa udp
US 8.8.8.8:53 211.147.130.103.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
TM 91.202.233.158:80 91.202.233.158 tcp
US 8.8.8.8:53 fivevd5ht.top udp
RU 185.244.181.38:80 fivevd5ht.top tcp
US 8.8.8.8:53 158.233.202.91.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
RU 185.215.113.67:15206 tcp
FI 95.216.143.20:12695 tcp
US 8.8.8.8:53 38.181.244.185.in-addr.arpa udp
US 8.8.8.8:53 67.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 20.143.216.95.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 185.244.181.38:80 fivevd5ht.top tcp
DE 95.179.250.45:26212 tcp
RU 185.244.181.38:80 fivevd5ht.top tcp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 conditionprovice.pro udp
FI 81.19.139.138:443 conditionprovice.pro tcp
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 138.139.19.81.in-addr.arpa udp
US 8.8.8.8:53 19.113.215.185.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
RU 185.215.113.26:80 185.215.113.26 tcp
FI 65.21.18.51:45580 tcp
DE 95.179.250.45:26212 tcp
FI 95.216.107.53:12311 tcp
US 8.8.8.8:53 240902175059845.std.kqve01.top udp
CH 179.43.188.227:80 240902175059845.std.kqve01.top tcp
NL 45.200.149.147:80 45.200.149.147 tcp
US 8.8.8.8:53 227.188.43.179.in-addr.arpa udp
US 8.8.8.8:53 147.149.200.45.in-addr.arpa udp
US 8.8.8.8:53 thizx13vt.top udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 CvcMEMMQKdoWtsiZdkN.CvcMEMMQKdoWtsiZdkN udp
US 8.8.8.8:53 haggaifashion.com udp
US 66.29.132.136:443 haggaifashion.com tcp
US 8.8.8.8:53 136.132.29.66.in-addr.arpa udp
US 8.8.8.8:53 thizx13vt.top udp
NL 45.66.231.48:80 tcp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 8.8.8.8:53 48.231.66.45.in-addr.arpa udp
US 8.8.8.8:53 thizx13vt.top udp
NL 45.91.200.135:80 45.91.200.135 tcp
US 8.8.8.8:53 api64.ipify.org udp
US 173.231.16.77:443 api64.ipify.org tcp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 135.200.91.45.in-addr.arpa udp
US 8.8.8.8:53 77.16.231.173.in-addr.arpa udp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.59.81:443 ipinfo.io tcp
US 8.8.8.8:53 81.59.117.34.in-addr.arpa udp
FI 95.216.107.53:12311 tcp
FI 81.19.139.138:443 conditionprovice.pro tcp
US 8.8.8.8:53 thizx13vt.top udp
DE 95.179.250.45:26212 tcp
US 52.111.227.11:443 tcp
US 8.8.8.8:53 thizx13vt.top udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 thizx13vt.top udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 thizx13vt.top udp
NL 45.200.149.147:27667 tcp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 thizx13vt.top udp
US 8.8.8.8:53 thizx13vt.top udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 thizx13vt.top udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 thizx13vt.top udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 thizx13vt.top udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 thizx13vt.top udp
US 8.8.8.8:53 thizx13vt.top udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 thizx13vt.top udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 thizx13vt.top udp

Files

memory/4272-0-0x0000000000A30000-0x0000000000EF5000-memory.dmp

memory/4272-1-0x00007FFBE29D0000-0x00007FFBE2BC5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 96b755dfe333ced8d955bb0cb35613cd
SHA1 e40dbd2a93c2b8a8104fe623962fdbce47d7b1b8
SHA256 faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe
SHA512 7e641636ec7a39720c02ca7cd9c49d0b10f4e11eec01661533916a79b7a578bc26f709e25e3128a79476614699cf417290efacc74b57507f0f11727a1f3f390d

memory/5048-16-0x0000000000EF0000-0x00000000013B5000-memory.dmp

memory/4272-15-0x00007FFBE29D0000-0x00007FFBE2BC5000-memory.dmp

memory/4272-14-0x0000000000A30000-0x0000000000EF5000-memory.dmp

memory/5048-17-0x00007FFBE29D0000-0x00007FFBE2BC5000-memory.dmp

memory/5048-18-0x00007FFBE29D0000-0x00007FFBE2BC5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

MD5 389881b424cf4d7ec66de13f01c7232a
SHA1 d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78
SHA256 9d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746
SHA512 2b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96

memory/756-37-0x00007FFBE29D0000-0x00007FFBE2BC5000-memory.dmp

memory/756-38-0x00000000007F0000-0x0000000000844000-memory.dmp

memory/4412-41-0x0000000000400000-0x0000000000452000-memory.dmp

memory/756-44-0x00007FFBE29D0000-0x00007FFBE2BC5000-memory.dmp

memory/4412-45-0x0000000005930000-0x0000000005ED4000-memory.dmp

memory/4412-46-0x0000000005420000-0x00000000054B2000-memory.dmp

memory/4412-47-0x00000000053C0000-0x00000000053CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TmpA5C5.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/4412-64-0x00000000060E0000-0x0000000006156000-memory.dmp

memory/4412-65-0x00000000067B0000-0x00000000067CE000-memory.dmp

memory/4412-68-0x0000000007140000-0x0000000007758000-memory.dmp

memory/4412-69-0x0000000006D70000-0x0000000006E7A000-memory.dmp

memory/4412-70-0x0000000006CA0000-0x0000000006CB2000-memory.dmp

memory/4412-71-0x0000000006D00000-0x0000000006D3C000-memory.dmp

memory/4412-72-0x0000000006EC0000-0x0000000006F0C000-memory.dmp

memory/5048-73-0x0000000000EF0000-0x00000000013B5000-memory.dmp

memory/5048-74-0x00007FFBE29D0000-0x00007FFBE2BC5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

MD5 ec23d4868753f523df127f531451dcbd
SHA1 8a172e091d057a8db1e3e1999d48060967b99f36
SHA256 5a4308d45dc245870376ece2209450e5ca46872e632c81c3c61178f139ef223d
SHA512 2e7b63f43a49514d9c98f4ef1964d4ad2b2eef5d88500098246a31d6391f68715bd2a216a662836815615fe4cc2410fe32eacfdd0d7b3cf16f58c816a0c651fb

C:\Users\Admin\AppData\Roaming\Ka0s0NOZP9.exe

MD5 4c82ed5f54457b13b25a60c6a0544a9c
SHA1 e6e8ff2456ee580fa8d62bb13c679859bf3e0856
SHA256 39867afa37975fadeb1a58a7e427c8f2a5c9e0d81bdaf23ce6e51c05a91087e6
SHA512 474db526dc64e6558df217442a85fe1614489c9c2f917619eb5f6b62ed37a8ca5079aab147b0bcb63193b3995889702f3eec2eeb0b6dff1103fe5f2b00d42cb9

C:\Users\Admin\AppData\Roaming\GYMaNoAMnr.exe

MD5 7e39ccb9926a01051635f3c2675ff01d
SHA1 00518801574c9a475b86847db9ff2635ffe4b08b
SHA256 4a5d76a51f341950e5588b373dc03cfc6a107a2799f5e8778d6994f5c15a52fc
SHA512 6c768ba63793dcec3a64f96a8e4cdf12ab4f165e4e343b33eeeed6c6473a52cca86f9275ac8689eafaaf58e6daa2ea1b8c87ebefa80152c04475c57f182dbf1d

memory/2900-111-0x0000000000170000-0x00000000001C2000-memory.dmp

memory/532-113-0x0000000000B30000-0x0000000000BD2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1194130065-3471212556-1656947724-1000\76b53b3ec448f7ccdda2063b15d2bfc3_a53bb4ca-6113-48bb-9609-441860fdd0d7

MD5 7d8a9f996bdd95ee3685b5a08d41ad81
SHA1 6cf4ec3441d443c197b7874ffc6dd4902ebdfb1e
SHA256 3e6fd6c24776a0a171b0e124de154175b51dd2f318d94cb2dd245462931f70c4
SHA512 ef1e57c358bbe17f7f72e90f4d7bc870cec50ef63965af811c0ac033b4367bbc1626e1075d297aa4424f68e45323529da6cc37dd05c5f7feb531df430aa1b867

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 51009d72444cb05fbcb8ef922ff5f972
SHA1 267a957d2793962a195a7c35881d82edf3c3888f
SHA256 631bbcd7284379288485627b96e167c094eea72403a07658de060e3c12e8f5a4
SHA512 0c9073e5edb16329cad7ede2211f0f86f672889319acb2bf18e3e07ed409fe87a6ab6a8b62503589e303e1259a1bd9c2262d69730d2f1d60b051ea6c83e78a59

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 214c86c5bb09ce53497596fee3bfafbc
SHA1 b6bf6ff1623e2007119c687f5e14a40bb29ddddf
SHA256 9347e4b3cdada8ec28158151e363da7721579f67503d93965b84224f43b6ada3
SHA512 eb4912e6ac6e492538c73a084ac657e7331ce6bb0da60a05dfeba31e62deed6a470adbf7ccb4d6575bd1c00946e846bbd253d892d38172e0ef4bcff299d7b08e

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

memory/5048-151-0x00007FFBE29D0000-0x00007FFBE2BC5000-memory.dmp

memory/5048-163-0x00007FFBE29D0000-0x00007FFBE2BC5000-memory.dmp

memory/5048-162-0x0000000000EF0000-0x00000000013B5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

memory/1284-179-0x0000000000330000-0x0000000000573000-memory.dmp

memory/532-182-0x0000000008DD0000-0x0000000008E36000-memory.dmp

memory/532-183-0x0000000009FE0000-0x000000000A1A2000-memory.dmp

memory/532-184-0x000000000A6E0000-0x000000000AC0C000-memory.dmp

memory/1284-185-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/2900-229-0x00000000070C0000-0x0000000007110000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/5048-256-0x0000000000EF0000-0x00000000013B5000-memory.dmp

memory/1284-257-0x0000000000330000-0x0000000000573000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe

MD5 d3c7b81361bcdec87ed267f8051f3b7b
SHA1 3e331947d48f99a09383e058614f51d6aee36afb
SHA256 ac1215cc2139f065412387a57b24c04c91fb160fb33f6c153e2aede45ceece70
SHA512 bedb36b6daf342f52b8e2530cecde0aabfb96b7ee911778e2ebae374540ebb70d77e5193e381b6a76621cdebfe9df1340b62e9ed1495f0d1035325e7ab207da3

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

MD5 7fa5c660d124162c405984d14042506f
SHA1 69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f
SHA256 fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
SHA512 d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

MD5 6760374f17416485fa941b354d3dd800
SHA1 d88389ec19ac3e87bc743ba3f8b7c518601fdbf9
SHA256 9dc31fbd03da881700908423eb50c6b0c42c87fec28e817449d3dd931802c9f5
SHA512 6e4d2f17cb93fe831198c2eaa35bf030d6a06d620645d3e1452c6bd6e77e42baa9dc323fd60a2c5ae1d89124adde69972c489739d4bd73ba01b95b829a777eab

memory/2488-309-0x00000000009C0000-0x0000000000A40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

MD5 30daa686c1f31cc4833bd3d7283d8cdc
SHA1 70f74571fafe1b359cfe9ce739c3752e35d16cf5
SHA256 504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822
SHA512 9f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9

memory/3248-331-0x0000000000400000-0x0000000000643000-memory.dmp

memory/3248-323-0x0000000000400000-0x0000000000643000-memory.dmp

memory/1964-333-0x0000000000400000-0x000000000081B000-memory.dmp

memory/4128-336-0x0000000000800000-0x0000000000852000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

memory/3248-320-0x0000000000400000-0x0000000000643000-memory.dmp

memory/3248-353-0x0000000000400000-0x0000000000643000-memory.dmp

memory/5048-359-0x0000000000EF0000-0x00000000013B5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe

MD5 37d198ad751d31a71acc9cb28ed0c64e
SHA1 8eb519b7a6df66d84c566605da9a0946717a921d
SHA256 1ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde
SHA512 60923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96

memory/4236-378-0x0000000000E70000-0x0000000000EE8000-memory.dmp

memory/4008-381-0x0000000000EF0000-0x00000000013B5000-memory.dmp

memory/4008-383-0x0000000000EF0000-0x00000000013B5000-memory.dmp

memory/5068-384-0x0000000000400000-0x000000000106E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe

MD5 b859d1252109669c1a82b235aaf40932
SHA1 b16ea90025a7d0fad9196aa09d1091244af37474
SHA256 083d9bc8566b22e67b553f9e0b2f3bf6fe292220665dcc2fc10942cdc192125c
SHA512 9c0006055afd089ef2acbb253628494dd8c29bab9d5333816be8404f875c85ac342df82ae339173f853d3ebdb2261e59841352f78f6b4bd3bff3d0d606f30655

memory/680-403-0x0000000000970000-0x0000000000A1E000-memory.dmp

C:\Users\Admin\AppData\Roaming\d3d9.dll

MD5 a6da8d868dbd5c9fe6b505db0ee7eb71
SHA1 3dad32b3b3230ad6f44b82d1eb1749c67800c6f8
SHA256 4ad69afb341c6d8021db1d9b0b7e56d14b020a0d70739e31f0b65861f3c4eb2c
SHA512 132f54ac3116fd644c57840c893dae2128f571a784ceaa6dd78bafa3e05fc8f2a9d2458f1e1cf321b6cecc2423d3c57ff6d3c4b6b60f92a41b665105a3262dd0

memory/3724-410-0x0000000000400000-0x0000000000454000-memory.dmp

memory/3724-412-0x0000000000400000-0x0000000000454000-memory.dmp

memory/4236-416-0x0000000008650000-0x000000000866A000-memory.dmp

memory/5048-417-0x0000000000EF0000-0x00000000013B5000-memory.dmp

memory/5068-419-0x0000000000400000-0x000000000106E000-memory.dmp

memory/2520-421-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2520-423-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2520-424-0x0000000000400000-0x0000000000471000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe

MD5 771b8e84ba4f0215298d9dadfe5a10bf
SHA1 0f5e4c440cd2e7b7d97723424ba9c56339036151
SHA256 3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0
SHA512 2814ef23653c9be5f5e7245af291cf330c355ed12b4db76f71b4de699c67a9ffd1bdc0cc1df5352335b57ab920404b9c8e81cd9257527264bde4f72a53700164

memory/2520-438-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2520-447-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4332-450-0x0000000000B00000-0x0000000000B20000-memory.dmp

memory/4332-451-0x0000000002C00000-0x0000000002C06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\194130065347

MD5 a78b1fc0f2f76c0a1b9660c84da8ea17
SHA1 69c10bb49bae5c63aadaa10351f1d26fba2022c0
SHA256 982364fe93fb1f89f194c72f2e9f8299d4d1eb09e3a9b3886f2c24b9f1ec991e
SHA512 f70f24f942d715183fdfccf12b5203bfe46f403e9c57e013a75b8a68daa080d32c174e1c98d1b4346a1523c7f691324749afca22f1d6e79a362d8675cd2ac70b

memory/5048-468-0x0000000000EF0000-0x00000000013B5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000172001\3546345.exe

MD5 fd2defc436fc7960d6501a01c91d893e
SHA1 5faa092857c3c892eab49e7c0e5ac12d50bce506
SHA256 ba13da01c41fa50ec5e340061973bc912b1f41cd1f96a7cae5d40afc00ff7945
SHA512 9a3e1f2dc5104d8636dc27af4c0f46bdb153fcfada98831b5af95eeb09bb7ef3c7e19927d8f06884a6837e10889380645b6138644f0c08b9cb2e59453041ec42

memory/2520-477-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2520-483-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2520-495-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2520-501-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2520-559-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2520-565-0x0000000000400000-0x0000000000471000-memory.dmp

memory/5068-572-0x0000000000400000-0x000000000106E000-memory.dmp

memory/2520-582-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2520-588-0x0000000000400000-0x0000000000471000-memory.dmp

memory/228-590-0x00000000003C0000-0x0000000000885000-memory.dmp

memory/228-592-0x00000000003C0000-0x0000000000885000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000226001\fikbbm0902845.exe

MD5 c965aa525ae4cfbc3b45c6b7e9271a59
SHA1 3a84d4c1c9277173b530263107af4caf1f61213f
SHA256 50ea6c698e72e13b8132b66bbca9479b7f4815ebb2f8adb3ca1cfec79523107e
SHA512 bfddf9f5cb766b20f564b6a94048d1779431794b02cbd0993f4f3554b46b1a4e17bd3def58200da665fd991d1480b22992181ef543413d8013a19889484c3f1c

C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe

MD5 db2a12edc73769f2f2b6b01545afe2c3
SHA1 73dc44fb0753296f51b851299f468031ceb77b54
SHA256 e6db7d34b498982601b2c45ac5b2a1c1b9502e502514ccffae9862f2aa719f42
SHA512 dadf36bc9c5d88c28b9064892cc263c912ce668435b71802df756c0a4e680f8407011d36498a2511dda7165aea866c0ae794f9ec8fbcc42c7da1661399316ce4

memory/2520-608-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2520-616-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2520-639-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2520-648-0x0000000000400000-0x0000000000471000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe

MD5 1b2583d84dca4708d7a0309cf1087a89
SHA1 cae0d1e16db95b9269b96c06caa66fa3dab99f48
SHA256 e0d9f3b8d36e9b4a44bc093b47ba3ba80cabd7e08b3f1a64dec7e3a2c5421bac
SHA512 a51b8ed6a6cf403b4b19fc7e9f22d5f60265b16cdf24a7033bc0ee0da8c31861caa212dc5fb3bf17e28842fc28a263564076ad4e9905afd483763859bafd4493

memory/5048-657-0x0000000000EF0000-0x00000000013B5000-memory.dmp

memory/2520-658-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2520-667-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4620-669-0x0000000000850000-0x00000000008DC000-memory.dmp

memory/1400-670-0x0000000000400000-0x0000000000C61000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000308001\kitty.exe

MD5 0ec1f7cc17b6402cd2df150e0e5e92ca
SHA1 8405b9bf28accb6f1907fbe28d2536da4fba9fc9
SHA256 4c5ca5701285337a96298ebf994f8ba013d290c63afa65b5c2b05771fbbb9ed4
SHA512 7caa2416bc7878493b62a184ddc844d201a9ab5282abfa77a616316af39ff65309e37bb566b3e29d9e764e08f4eda43a06464acaf9962f911b33e6dbc60c1861

memory/2520-683-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2520-689-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4620-700-0x000000001EDD0000-0x000000001EEDA000-memory.dmp

memory/4620-701-0x000000001ECC0000-0x000000001ECD2000-memory.dmp

memory/4620-702-0x000000001ED20000-0x000000001ED5C000-memory.dmp

memory/3636-709-0x0000000000880000-0x0000000000891000-memory.dmp

memory/3636-710-0x000000006BEB0000-0x000000006BFEC000-memory.dmp

memory/4620-711-0x000000001F360000-0x000000001F3D6000-memory.dmp

memory/4620-712-0x000000001ED00000-0x000000001ED1E000-memory.dmp

memory/4620-713-0x000000001FB40000-0x000000001FD02000-memory.dmp

memory/4620-714-0x00000000205D0000-0x0000000020AF8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000322001\appgate15.exe

MD5 d27f0f74b4381fb585068b4afdb81afc
SHA1 59d8efea4a87a203f6941efef0700edd95e2e38c
SHA256 aa66c3988f3631925873757ae73ac5630508a43e2eebe6c0502a4d3194de8e41
SHA512 5070e522c922636b36cced63719558b52249faec5289e68174d03295c4630f200c3db7757c7f96b84200944cd13ee396d0ae733d33aaba9c861c05610938425c

memory/2520-723-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2520-732-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2784-734-0x0000000000710000-0x0000000000B6C000-memory.dmp

memory/2784-735-0x00000000053F0000-0x000000000548C000-memory.dmp

memory/2784-736-0x0000000005550000-0x0000000005876000-memory.dmp

memory/2784-737-0x0000000005500000-0x0000000005522000-memory.dmp

memory/2536-738-0x0000000000400000-0x00000000005E1000-memory.dmp

memory/2536-742-0x0000000000400000-0x00000000005E1000-memory.dmp

memory/2536-740-0x0000000000400000-0x00000000005E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000335001\ufw.exe

MD5 6b4b9ced2c07fb6c8eb710e0b1f2c4cf
SHA1 b6b4dd343d86d3f95a862744dbf74e31654bee0b
SHA256 8742d826742550fc07f65ac00f1e1e037a3941862aa85cde104945fa0decbff6
SHA512 686b38e389a228771ad09bad5dea31f0994eb7009a5d52883fc6a931544654166c9d3303907c0445b6487f8f05840cb27188d339a6678965e77eda5a05088f7d

memory/968-786-0x0000000000D40000-0x0000000000D9C000-memory.dmp

memory/1168-792-0x0000000000400000-0x000000000045A000-memory.dmp

memory/2032-810-0x0000000000EF0000-0x00000000013B5000-memory.dmp

memory/1244-811-0x0000000001100000-0x000000000118C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-13 04:33

Reported

2024-09-13 04:35

Platform

win11-20240802-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe"

Signatures

Amadey

trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe

"C:\Users\Admin\AppData\Local\Temp\faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Network

Country Destination Domain Proto
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp

Files

memory/4860-0-0x0000000000090000-0x0000000000555000-memory.dmp

memory/4860-1-0x0000000077916000-0x0000000077918000-memory.dmp

memory/4860-2-0x0000000000091000-0x00000000000BF000-memory.dmp

memory/4860-3-0x0000000000090000-0x0000000000555000-memory.dmp

memory/4860-4-0x0000000000090000-0x0000000000555000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 96b755dfe333ced8d955bb0cb35613cd
SHA1 e40dbd2a93c2b8a8104fe623962fdbce47d7b1b8
SHA256 faaf9f21e8b060c731e959930b54c7caccb6cfb31eda9cf5540c80e9adcaf8fe
SHA512 7e641636ec7a39720c02ca7cd9c49d0b10f4e11eec01661533916a79b7a578bc26f709e25e3128a79476614699cf417290efacc74b57507f0f11727a1f3f390d

memory/4860-18-0x0000000000090000-0x0000000000555000-memory.dmp

memory/1152-17-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-19-0x00000000007C1000-0x00000000007EF000-memory.dmp

memory/1152-20-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-21-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-22-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-24-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-25-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-26-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/4864-28-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/4864-29-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/4864-30-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/4864-32-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-33-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-34-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-35-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-36-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-37-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-38-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/2124-40-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-41-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-42-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-43-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-44-0x00000000007C0000-0x0000000000C85000-memory.dmp

memory/1152-45-0x00000000007C0000-0x0000000000C85000-memory.dmp