Malware Analysis Report

2024-11-30 19:28

Sample ID 240923-fb83wswfqr
Target Vortex Grabber - Hotfix.rar
SHA256 ab2dab1968ab08e5bb5091376450b1de5fc87cc866faeecc42e1ec641fe83173
Tags
agilenet xworm discovery persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ab2dab1968ab08e5bb5091376450b1de5fc87cc866faeecc42e1ec641fe83173

Threat Level: Known bad

The file Vortex Grabber - Hotfix.rar was found to be: Known bad.

Malicious Activity Summary

agilenet xworm discovery persistence rat trojan

Xworm

Detect Xworm Payload

Checks computer location settings

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Drops startup file

Executes dropped EXE

Looks up external IP address via web service

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Scheduled Task/Job: Scheduled Task

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Checks SCSI registry key(s)

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-23 04:43

Signatures

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-23 04:43

Reported

2024-09-23 04:46

Platform

win7-20240903-en

Max time kernel

148s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steal.lnk C:\Users\Admin\AppData\Local\Temp\Vortex.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steal.lnk C:\Users\Admin\AppData\Local\Temp\Vortex.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steal = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Steal" C:\Users\Admin\AppData\Local\Temp\Vortex.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Vortex.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Vortex.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Steal N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Steal N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Steal N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2576 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe C:\Users\Admin\AppData\Local\Temp\Vortex.exe
PID 2576 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe C:\Users\Admin\AppData\Local\Temp\Vortex.exe
PID 2576 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe C:\Users\Admin\AppData\Local\Temp\Vortex.exe
PID 2576 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe C:\Users\Admin\AppData\Local\Temp\Vortex.exe
PID 2576 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe C:\Users\Admin\AppData\Roaming\PicassoGrabber.exe
PID 2576 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe C:\Users\Admin\AppData\Roaming\PicassoGrabber.exe
PID 2576 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe C:\Users\Admin\AppData\Roaming\PicassoGrabber.exe
PID 2576 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe C:\Users\Admin\AppData\Roaming\PicassoGrabber.exe
PID 2444 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Roaming\PicassoGrabber.exe C:\Windows\system32\WerFault.exe
PID 2444 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Roaming\PicassoGrabber.exe C:\Windows\system32\WerFault.exe
PID 2444 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Roaming\PicassoGrabber.exe C:\Windows\system32\WerFault.exe
PID 1148 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\Vortex.exe C:\Windows\System32\schtasks.exe
PID 1148 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\Vortex.exe C:\Windows\System32\schtasks.exe
PID 1148 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\Vortex.exe C:\Windows\System32\schtasks.exe
PID 2696 wrote to memory of 2680 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\Steal
PID 2696 wrote to memory of 2680 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\Steal
PID 2696 wrote to memory of 2680 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\Steal
PID 2696 wrote to memory of 596 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\Steal
PID 2696 wrote to memory of 596 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\Steal
PID 2696 wrote to memory of 596 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\Steal
PID 2696 wrote to memory of 2448 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\Steal
PID 2696 wrote to memory of 2448 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\Steal
PID 2696 wrote to memory of 2448 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\Steal

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe

"C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe"

C:\Users\Admin\AppData\Local\Temp\Vortex.exe

"C:\Users\Admin\AppData\Local\Temp\Vortex.exe"

C:\Users\Admin\AppData\Roaming\PicassoGrabber.exe

"C:\Users\Admin\AppData\Roaming\PicassoGrabber.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2444 -s 608

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Steal" /tr "C:\Users\Admin\AppData\Local\Temp\Steal"

C:\Windows\system32\taskeng.exe

taskeng.exe {039348E6-7814-4AF1-9525-2C447B7D8617} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\Steal

C:\Users\Admin\AppData\Local\Temp\Steal

C:\Users\Admin\AppData\Local\Temp\Steal

C:\Users\Admin\AppData\Local\Temp\Steal

C:\Users\Admin\AppData\Local\Temp\Steal

C:\Users\Admin\AppData\Local\Temp\Steal

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 allow-failing.gl.at.ply.gg udp
US 147.185.221.21:45394 allow-failing.gl.at.ply.gg tcp
US 147.185.221.21:45394 allow-failing.gl.at.ply.gg tcp
US 147.185.221.21:45394 allow-failing.gl.at.ply.gg tcp
US 147.185.221.21:45394 allow-failing.gl.at.ply.gg tcp
US 147.185.221.21:45394 allow-failing.gl.at.ply.gg tcp

Files

C:\Users\Admin\AppData\Local\Temp\Vortex.exe

MD5 72eaf2c0f7bde62e4a0500379454d7b1
SHA1 01bd16819a6429eec4842d66f2b849773dda31e8
SHA256 1c8f1ca92d851800e10dd73ddd30f3f1629754a4abb0b8770bbc782ad4fb494a
SHA512 c79530ff207471d542af7f8b939f3fbf22e12b19ae84d118481034af34ef56de5f0815f95825d14a14e923ecc96ab2c7d7e7c4956a92252d200e9a40d1f7569f

C:\Users\Admin\AppData\Roaming\PicassoGrabber.exe

MD5 ba5e45700c95e55f40b5fed7a10d6455
SHA1 56133f2bb673be42cf81a69afdcbf1e20876bb72
SHA256 6ba6a04acda0de38ff6ced8e7dcd0a022a1dd450e3ef6ea128c0ff9b9e41cc40
SHA512 391962167558c82294092816ab464e8b942435465a4ea0074a6883c6e3206245cb6ed524d95570db387decc22f6c1e8fab50584f9208d8790eed224dd4db3de4

memory/1148-12-0x0000000000EF0000-0x0000000000F06000-memory.dmp

memory/2444-13-0x0000000000280000-0x0000000000480000-memory.dmp

memory/2680-20-0x0000000000240000-0x0000000000256000-memory.dmp

memory/596-23-0x00000000008F0000-0x0000000000906000-memory.dmp

memory/2448-25-0x00000000012E0000-0x00000000012F6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-23 04:43

Reported

2024-09-23 04:44

Platform

win10v2004-20240802-en

Max time kernel

45s

Max time network

45s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Vortex.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steal.lnk C:\Users\Admin\AppData\Local\Temp\Vortex.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steal.lnk C:\Users\Admin\AppData\Local\Temp\Vortex.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Vortex.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\PicassoGrabber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Steal N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steal = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Steal" C:\Users\Admin\AppData\Local\Temp\Vortex.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Vortex.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Vortex.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Steal N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe

"C:\Users\Admin\AppData\Local\Temp\Vortex Grabber - Hotfix\Vortex Grabber\Vortex.exe"

C:\Users\Admin\AppData\Local\Temp\Vortex.exe

"C:\Users\Admin\AppData\Local\Temp\Vortex.exe"

C:\Users\Admin\AppData\Roaming\PicassoGrabber.exe

"C:\Users\Admin\AppData\Roaming\PicassoGrabber.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Steal" /tr "C:\Users\Admin\AppData\Local\Temp\Steal"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Users\Admin\AppData\Local\Temp\Steal

C:\Users\Admin\AppData\Local\Temp\Steal

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 allow-failing.gl.at.ply.gg udp
US 147.185.221.21:45394 allow-failing.gl.at.ply.gg tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 147.185.221.21:45394 allow-failing.gl.at.ply.gg tcp

Files

C:\Users\Admin\AppData\Local\Temp\Vortex.exe

MD5 72eaf2c0f7bde62e4a0500379454d7b1
SHA1 01bd16819a6429eec4842d66f2b849773dda31e8
SHA256 1c8f1ca92d851800e10dd73ddd30f3f1629754a4abb0b8770bbc782ad4fb494a
SHA512 c79530ff207471d542af7f8b939f3fbf22e12b19ae84d118481034af34ef56de5f0815f95825d14a14e923ecc96ab2c7d7e7c4956a92252d200e9a40d1f7569f

C:\Users\Admin\AppData\Roaming\PicassoGrabber.exe

MD5 ba5e45700c95e55f40b5fed7a10d6455
SHA1 56133f2bb673be42cf81a69afdcbf1e20876bb72
SHA256 6ba6a04acda0de38ff6ced8e7dcd0a022a1dd450e3ef6ea128c0ff9b9e41cc40
SHA512 391962167558c82294092816ab464e8b942435465a4ea0074a6883c6e3206245cb6ed524d95570db387decc22f6c1e8fab50584f9208d8790eed224dd4db3de4

memory/1860-20-0x00007FFF447A3000-0x00007FFF447A5000-memory.dmp

memory/1860-23-0x0000000000670000-0x0000000000686000-memory.dmp

memory/1876-24-0x000001D7BDCE0000-0x000001D7BDEE0000-memory.dmp

memory/1876-25-0x00007FFF447A0000-0x00007FFF45261000-memory.dmp

memory/1876-26-0x00007FFF447A0000-0x00007FFF45261000-memory.dmp

memory/1876-27-0x00007FFF447A0000-0x00007FFF45261000-memory.dmp

memory/1860-28-0x00007FFF447A0000-0x00007FFF45261000-memory.dmp

memory/1200-32-0x0000027F53620000-0x0000027F53621000-memory.dmp

memory/1200-34-0x0000027F53620000-0x0000027F53621000-memory.dmp

memory/1200-33-0x0000027F53620000-0x0000027F53621000-memory.dmp

memory/1200-42-0x0000027F53620000-0x0000027F53621000-memory.dmp

memory/1200-44-0x0000027F53620000-0x0000027F53621000-memory.dmp

memory/1200-43-0x0000027F53620000-0x0000027F53621000-memory.dmp

memory/1200-41-0x0000027F53620000-0x0000027F53621000-memory.dmp

memory/1200-40-0x0000027F53620000-0x0000027F53621000-memory.dmp

memory/1200-39-0x0000027F53620000-0x0000027F53621000-memory.dmp

memory/1200-38-0x0000027F53620000-0x0000027F53621000-memory.dmp

memory/1860-45-0x00007FFF447A0000-0x00007FFF45261000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steal.lnk

MD5 bbd5b7ea1cf0bc0bab419d25452449f3
SHA1 d4ab189d551beb98380dfd2c444d53cc665d37c3
SHA256 8fb66eab43208e90c8d8bf0e4c708c2bee46aea0eb0a01e704527ee8580d529e
SHA512 72c52789657432031d9c4d048094a984c153770696465d059e40c5da4a780d4f7d9ba9ef70dab5ce17cb3c6a4ec8495d6798b4465a830e2ea1cddbc6e5ad27f9