Malware Analysis Report

2024-11-15 07:56

Sample ID 241001-h3l4js1dlc
Target SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
SHA256 c6ae41874ccd5d6c3e6da49cae6d0a0e8eee20e7037896b38f1e4523dd9543c8
Tags
vipkeylogger collection discovery execution keylogger spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c6ae41874ccd5d6c3e6da49cae6d0a0e8eee20e7037896b38f1e4523dd9543c8

Threat Level: Known bad

The file SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe was found to be: Known bad.

Malicious Activity Summary

vipkeylogger collection discovery execution keylogger spyware stealer

VIPKeylogger

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Checks computer location settings

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Browser Information Discovery

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

outlook_office_path

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

outlook_win_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-01 07:15

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-01 07:15

Reported

2024-10-01 07:18

Platform

win7-20240704-en

Max time kernel

118s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2596 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\schtasks.exe
PID 2596 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\schtasks.exe
PID 2596 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\schtasks.exe
PID 2596 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\schtasks.exe
PID 2596 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 2596 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iJAISuNbz.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iJAISuNbz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA573.tmp"

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe"

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe"

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 checkip.dyndns.org udp
US 158.101.44.242:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp

Files

memory/2596-0-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

memory/2596-1-0x0000000000850000-0x000000000090E000-memory.dmp

memory/2596-2-0x0000000074C30000-0x000000007531E000-memory.dmp

memory/2596-3-0x00000000047D0000-0x0000000004880000-memory.dmp

memory/2596-4-0x00000000005D0000-0x00000000005EE000-memory.dmp

memory/2596-5-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

memory/2596-6-0x0000000074C30000-0x000000007531E000-memory.dmp

memory/2596-7-0x0000000000520000-0x00000000005A4000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 763dcdc5a4adef1a143b645b3a8cc1fe
SHA1 87a2e60246730c495de000669532aef2b8c86106
SHA256 1d19e12b8a7d8623a0e5a2434dadcbdeec7cc562c75799e3ff9f025ff34b95b5
SHA512 057e8f51295b201c04a50ba13bf6250bd3f62b72404a3026dad7145d4b931605ab238a47da280211b04e7183923622721817c1aca0af1e0907d1624c74cc65d9

C:\Users\Admin\AppData\Local\Temp\tmpA573.tmp

MD5 c8fc87c37732378c43f390dc7c34bb6f
SHA1 b2a298e0e745147a213a92091563b5609c7e0eec
SHA256 a208f59706958e9f0536dea85293240030b1b076686ebc265a3f9d3490976718
SHA512 0ca71d070fc7b133c18af9e7d766b9da4737a8a1b12b29b0e97aa35f60a882be52fbfff46b870aa129d8babaed3f2c1dbb70dbe90d44e70f9c896fd942bfed1f

memory/984-21-0x0000000000400000-0x0000000000442000-memory.dmp

memory/984-22-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2596-33-0x0000000074C30000-0x000000007531E000-memory.dmp

memory/984-32-0x0000000000400000-0x0000000000442000-memory.dmp

memory/984-30-0x0000000000400000-0x0000000000442000-memory.dmp

memory/984-29-0x0000000000400000-0x0000000000442000-memory.dmp

memory/984-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/984-26-0x0000000000400000-0x0000000000442000-memory.dmp

memory/984-24-0x0000000000400000-0x0000000000442000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-01 07:15

Reported

2024-10-01 07:18

Platform

win10v2004-20240802-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4244 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4244 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4244 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4244 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4244 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4244 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4244 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\schtasks.exe
PID 4244 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\schtasks.exe
PID 4244 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Windows\SysWOW64\schtasks.exe
PID 4244 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 4244 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 4244 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 4244 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 4244 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 4244 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 4244 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe
PID 4244 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iJAISuNbz.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iJAISuNbz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC265.tmp"

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterXgen.16913.10158.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
US 158.101.44.242:80 checkip.dyndns.org tcp
US 8.8.8.8:53 242.44.101.158.in-addr.arpa udp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 152.67.21.104.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp

Files

memory/4244-0-0x00000000751EE000-0x00000000751EF000-memory.dmp

memory/4244-1-0x0000000000820000-0x00000000008DE000-memory.dmp

memory/4244-2-0x0000000005700000-0x0000000005CA4000-memory.dmp

memory/4244-3-0x0000000005150000-0x00000000051E2000-memory.dmp

memory/4244-4-0x00000000751E0000-0x0000000075990000-memory.dmp

memory/4244-5-0x0000000005300000-0x000000000530A000-memory.dmp

memory/4244-6-0x00000000067A0000-0x0000000006850000-memory.dmp

memory/4244-7-0x00000000056E0000-0x00000000056FE000-memory.dmp

memory/4244-8-0x00000000751EE000-0x00000000751EF000-memory.dmp

memory/4244-9-0x00000000751E0000-0x0000000075990000-memory.dmp

memory/4244-10-0x00000000029E0000-0x0000000002A64000-memory.dmp

memory/4244-11-0x000000000B1E0000-0x000000000B27C000-memory.dmp

memory/2144-17-0x00000000751E0000-0x0000000075990000-memory.dmp

memory/2144-16-0x0000000002910000-0x0000000002946000-memory.dmp

memory/2144-18-0x00000000751E0000-0x0000000075990000-memory.dmp

memory/316-19-0x0000000004D30000-0x0000000005358000-memory.dmp

memory/316-20-0x00000000751E0000-0x0000000075990000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpC265.tmp

MD5 5dc6bd414099ee894ba2453479c3b324
SHA1 563bbc3acc38a2127d3861d025b72fa803954494
SHA256 f97a96d98d5ec4f2b25c7f891e7391a4a0be15e6ad18e0b841bd4f45716f6093
SHA512 f15635cf441424c684dfd76074cc878914ef02f568c9349ffe724f7c50cccac704fca0cbd2920238edd2950c72b43743cf22e7e5d648355bb6d591c3bbcdaf6f

memory/2144-23-0x00000000052F0000-0x0000000005356000-memory.dmp

memory/2144-22-0x0000000005250000-0x0000000005272000-memory.dmp

memory/316-25-0x00000000751E0000-0x0000000075990000-memory.dmp

memory/316-36-0x0000000005540000-0x0000000005894000-memory.dmp

memory/2144-35-0x00000000751E0000-0x0000000075990000-memory.dmp

memory/3328-46-0x0000000000400000-0x0000000000442000-memory.dmp

memory/316-47-0x00000000751E0000-0x0000000075990000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ifi2zh5y.jv3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/316-24-0x00000000053D0000-0x0000000005436000-memory.dmp

memory/4244-49-0x00000000751E0000-0x0000000075990000-memory.dmp

memory/2144-50-0x0000000006230000-0x000000000624E000-memory.dmp

memory/2144-51-0x00000000067D0000-0x000000000681C000-memory.dmp

memory/316-52-0x0000000006BC0000-0x0000000006BF2000-memory.dmp

memory/2144-53-0x00000000717B0000-0x00000000717FC000-memory.dmp

memory/316-74-0x0000000006C00000-0x0000000006CA3000-memory.dmp

memory/2144-64-0x00000000067B0000-0x00000000067CE000-memory.dmp

memory/316-63-0x00000000717B0000-0x00000000717FC000-memory.dmp

memory/2144-75-0x0000000007BA0000-0x000000000821A000-memory.dmp

memory/2144-76-0x0000000007550000-0x000000000756A000-memory.dmp

memory/2144-77-0x00000000075C0000-0x00000000075CA000-memory.dmp

memory/316-78-0x00000000071B0000-0x0000000007246000-memory.dmp

memory/316-79-0x0000000007130000-0x0000000007141000-memory.dmp

memory/316-80-0x0000000007160000-0x000000000716E000-memory.dmp

memory/316-81-0x0000000007170000-0x0000000007184000-memory.dmp

memory/316-82-0x0000000007270000-0x000000000728A000-memory.dmp

memory/316-83-0x0000000007250000-0x0000000007258000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 64a948b4b1d5e5302ac4303c25457574
SHA1 5fa5d2966ff00eee6a43e3509a5abf41708e686f
SHA256 3ac5158781454b0eba872ea026ccfefe305ac8b6bd8df475e20ae80f4b463863
SHA512 9bec08c4ebfeb2da125fd230490a72d86aa998539fec5897ebcd0fb6b2d42de12d3c6056456b64cd9a51223198a8988a0bc6465ee18124bf937ac818aa2fe9f0

memory/2144-90-0x00000000751E0000-0x0000000075990000-memory.dmp

memory/316-89-0x00000000751E0000-0x0000000075990000-memory.dmp

memory/3328-91-0x0000000006780000-0x0000000006942000-memory.dmp

memory/3328-92-0x0000000006610000-0x0000000006660000-memory.dmp