Malware Analysis Report

2025-01-02 05:39

Sample ID 241005-se18nsvhqm
Target decrypted.exe
SHA256 58e38db883597286180f4a5bb97386c6b8c5c400a8b1ca7254f3da7ef40acf9c
Tags
sectoprat discovery persistence rat spyware trojan lumma stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

58e38db883597286180f4a5bb97386c6b8c5c400a8b1ca7254f3da7ef40acf9c

Threat Level: Known bad

The file decrypted.exe was found to be: Known bad.

Malicious Activity Summary

sectoprat discovery persistence rat spyware trojan lumma stealer

SectopRAT payload

SectopRAT

Lumma Stealer, LummaC

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates processes with tasklist

Drops file in Windows directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

System Network Configuration Discovery: Internet Connection Discovery

Office loads VBA resources, possible macro or embedded object present

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-05 15:03

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-05 15:03

Reported

2024-10-05 15:08

Platform

win7-20240903-en

Max time kernel

280s

Max time network

282s

Command Line

"C:\Users\Admin\AppData\Local\Temp\decrypted.exe"

Signatures

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eebbfca = "\"C:\\kgcchef\\AutoIt3.exe\" C:\\kgcchef\\eebbfca.a3x" C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1316 set thread context of 996 N/A C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-JGG96.tmp\decrypted.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\decrypted.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\decrypted.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Office loads VBA resources, possible macro or embedded object present

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2828 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-JGG96.tmp\decrypted.tmp
PID 2828 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-JGG96.tmp\decrypted.tmp
PID 2828 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-JGG96.tmp\decrypted.tmp
PID 2828 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-JGG96.tmp\decrypted.tmp
PID 2828 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-JGG96.tmp\decrypted.tmp
PID 2828 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-JGG96.tmp\decrypted.tmp
PID 2828 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-JGG96.tmp\decrypted.tmp
PID 840 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\is-JGG96.tmp\decrypted.tmp C:\Users\Admin\AppData\Local\Temp\decrypted.exe
PID 840 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\is-JGG96.tmp\decrypted.tmp C:\Users\Admin\AppData\Local\Temp\decrypted.exe
PID 840 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\is-JGG96.tmp\decrypted.tmp C:\Users\Admin\AppData\Local\Temp\decrypted.exe
PID 840 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\is-JGG96.tmp\decrypted.tmp C:\Users\Admin\AppData\Local\Temp\decrypted.exe
PID 2392 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp
PID 2392 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp
PID 2392 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp
PID 2392 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp
PID 2392 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp
PID 2392 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp
PID 2392 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp
PID 2136 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 2300 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1620 wrote to memory of 2300 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1620 wrote to memory of 2300 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1620 wrote to memory of 1284 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 1620 wrote to memory of 1284 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 1620 wrote to memory of 1284 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2136 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 932 wrote to memory of 568 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 932 wrote to memory of 568 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 932 wrote to memory of 568 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 932 wrote to memory of 588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 932 wrote to memory of 588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 932 wrote to memory of 588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2136 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 1904 wrote to memory of 2124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1904 wrote to memory of 2124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1904 wrote to memory of 2124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1904 wrote to memory of 2420 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 1904 wrote to memory of 2420 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 1904 wrote to memory of 2420 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2136 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 1396 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1396 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1396 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1396 wrote to memory of 2172 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 1396 wrote to memory of 2172 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 1396 wrote to memory of 2172 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2136 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2532 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2532 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe

Processes

C:\Users\Admin\AppData\Local\Temp\decrypted.exe

"C:\Users\Admin\AppData\Local\Temp\decrypted.exe"

C:\Users\Admin\AppData\Local\Temp\is-JGG96.tmp\decrypted.tmp

"C:\Users\Admin\AppData\Local\Temp\is-JGG96.tmp\decrypted.tmp" /SL5="$D0150,11050682,1125376,C:\Users\Admin\AppData\Local\Temp\decrypted.exe"

C:\Users\Admin\AppData\Local\Temp\decrypted.exe

"C:\Users\Admin\AppData\Local\Temp\decrypted.exe" /VERYSILENT /NORESTART

C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp

"C:\Users\Admin\AppData\Local\Temp\is-S4T33.tmp\decrypted.tmp" /SL5="$E0150,11050682,1125376,C:\Users\Admin\AppData\Local\Temp\decrypted.exe" /VERYSILENT /NORESTART

C:\Windows\system32\cmd.exe

"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH

C:\Windows\system32\find.exe

find /I "wrsa.exe"

C:\Windows\system32\cmd.exe

"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH

C:\Windows\system32\find.exe

find /I "opssvc.exe"

C:\Windows\system32\cmd.exe

"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH

C:\Windows\system32\find.exe

find /I "avastui.exe"

C:\Windows\system32\cmd.exe

"cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH

C:\Windows\system32\find.exe

find /I "avgui.exe"

C:\Windows\system32\cmd.exe

"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH

C:\Windows\system32\find.exe

find /I "nswscsvc.exe"

C:\Windows\system32\cmd.exe

"cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH

C:\Windows\system32\find.exe

find /I "sophoshealth.exe"

C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe

"C:\Users\Admin\AppData\Local\fragaria\\AutoIt3.exe" "C:\Users\Admin\AppData\Local\fragaria\\VSIXConfigurationUpdater1.a3x"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && AutoIt3.exe C:\ProgramData\\Z9dGek.a3x && del C:\ProgramData\\Z9dGek.a3x

C:\Windows\SysWOW64\PING.EXE

ping -n 5 127.0.0.1

C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe

AutoIt3.exe C:\ProgramData\\Z9dGek.a3x

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\TraceDismount.docx"

Network

Country Destination Domain Proto
RU 45.141.87.50:15647 tcp
RU 45.141.87.50:9000 45.141.87.50 tcp

Files

memory/2828-1-0x0000000000090000-0x00000000001B1000-memory.dmp

memory/2828-2-0x0000000000091000-0x0000000000139000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-JGG96.tmp\decrypted.tmp

MD5 edf47d593acf0e39438d621e8357ad34
SHA1 5732a17515b0112ce47637393043a1a2e4836218
SHA256 5f0f2e763c33ef0d3bb30041927a39191a257b533e16f1f89bf2939d669c9412
SHA512 8f49244aa4d4ba31ecef404b9f42b7e9798951a8065dea3699e10464ab676f72227c3084e51c7c256e385605cfa95a35bd88fff01477ecf426153ffcf2f9994f

memory/840-8-0x0000000000110000-0x0000000000111000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-77IVM.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

memory/2392-16-0x0000000000090000-0x00000000001B1000-memory.dmp

memory/840-15-0x0000000000E10000-0x0000000001190000-memory.dmp

memory/2828-19-0x0000000000090000-0x00000000001B1000-memory.dmp

\Users\Admin\AppData\Local\fragaria\AutoIt3.exe

MD5 3f58a517f1f4796225137e7659ad2adb
SHA1 e264ba0e9987b0ad0812e5dd4dd3075531cfe269
SHA256 1da298cab4d537b0b7b5dabf09bff6a212b9e45731e0cc772f99026005fb9e48
SHA512 acf740aafce390d06c6a76c84e7ae7c0f721731973aadbe3e57f2eb63241a01303cc6bf11a3f9a88f8be0237998b5772bdaf569137d63ba3d0f877e7d27fc634

C:\Users\Admin\AppData\Local\fragaria\VSIXConfigurationUpdater1.a3x

MD5 292aad866f9decedfdb2b3126fab6061
SHA1 ea5273f207b22196dbed7e1ddc691ce4418a6d87
SHA256 5da1f6349763ccbf7ada3167e0a8e1eeeb158c6cdd0b2aee8f9278812be0d59b
SHA512 750573570f029858d689836c8ec7e49f9e3646783adeb34597a7cfd6411a86b2aa060626e7ed9d97ec7dac15d295b36ed03225fdd4238aad59cf2851c91a0119

memory/2392-182-0x0000000000090000-0x00000000001B1000-memory.dmp

memory/2136-180-0x0000000001220000-0x00000000015A0000-memory.dmp

C:\Users\Admin\AppData\Local\fragaria\VSIXConfigurationUpdater.wav

MD5 c25a5d1ff98e3558b128797de0f7ede8
SHA1 e6b742ba4fa0836f16b135ab530391ea52e7a83c
SHA256 7344920e5ee6ff4f75013be233fea20b872bd4d9adcf0434eaeebcba79099819
SHA512 f515507befee96cf2f86db0db2c8dda831063900729e0449df0f32a88c76c7752ee364d5d1e072175b5a9eccd6f54f72e5c08656b5bf8d711a414ceda91aa5c0

memory/996-195-0x0000000000400000-0x00000000004C6000-memory.dmp

memory/996-194-0x0000000000400000-0x00000000004C6000-memory.dmp

memory/996-192-0x0000000000400000-0x00000000004C6000-memory.dmp

memory/996-193-0x0000000000400000-0x00000000004C6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp45F8.tmp

MD5 c9ff7748d8fcef4cf84a5501e996a641
SHA1 02867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA256 4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512 d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

memory/1588-220-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 a6c137e6c8d2b7b472996cd64c4ad1b4
SHA1 115129e91f92e48608c1b59cfb15d50a23fdd63f
SHA256 9e3633dfd7ea5f34fe9afea541394405d6203874e56ba0238011cd1398035773
SHA512 1ae659454cc6e84c12080e220c9043441dea2450545321f4eb321f9c2909fe6bfefa7e674d3335571e11e4ac98134e9245f87c5e268dfa7ce432a640784fd5e0

memory/1588-256-0x000000005FFF0000-0x0000000060000000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-05 15:03

Reported

2024-10-05 15:08

Platform

win10v2004-20240802-en

Max time kernel

295s

Max time network

297s

Command Line

"C:\Users\Admin\AppData\Local\Temp\decrypted.exe"

Signatures

Lumma Stealer, LummaC

stealer lumma

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\is-KO7JT.tmp\decrypted.tmp N/A
Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\eebbfca = "\"C:\\kgcchef\\AutoIt3.exe\" C:\\kgcchef\\eebbfca.a3x" C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1060 set thread context of 4940 N/A C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-KO7JT.tmp\decrypted.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmpE6BE.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\decrypted.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\decrypted.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1612 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-KO7JT.tmp\decrypted.tmp
PID 1612 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-KO7JT.tmp\decrypted.tmp
PID 1612 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-KO7JT.tmp\decrypted.tmp
PID 1288 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\is-KO7JT.tmp\decrypted.tmp C:\Users\Admin\AppData\Local\Temp\decrypted.exe
PID 1288 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\is-KO7JT.tmp\decrypted.tmp C:\Users\Admin\AppData\Local\Temp\decrypted.exe
PID 1288 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\is-KO7JT.tmp\decrypted.tmp C:\Users\Admin\AppData\Local\Temp\decrypted.exe
PID 2516 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp
PID 2516 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp
PID 2516 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\decrypted.exe C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp
PID 4636 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 4636 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 1072 wrote to memory of 2744 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1072 wrote to memory of 2744 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1072 wrote to memory of 3256 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 1072 wrote to memory of 3256 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 4636 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 4636 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 4552 wrote to memory of 924 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4552 wrote to memory of 924 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4552 wrote to memory of 3652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 4552 wrote to memory of 3652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 4636 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 4636 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 1472 wrote to memory of 3732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1472 wrote to memory of 3732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1472 wrote to memory of 2988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 1472 wrote to memory of 2988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 4636 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 4636 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 3268 wrote to memory of 4012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3268 wrote to memory of 4012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3268 wrote to memory of 436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 3268 wrote to memory of 436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 4636 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 4636 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 1496 wrote to memory of 2072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1496 wrote to memory of 2072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1496 wrote to memory of 628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 1496 wrote to memory of 628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 4636 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 4636 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp C:\Windows\system32\cmd.exe
PID 2256 wrote to memory of 1344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2256 wrote to memory of 1344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2256 wrote to memory of 1080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2256 wrote to memory of 1080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 4636 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe
PID 4636 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe
PID 4636 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe
PID 4120 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe C:\Windows\SysWOW64\cmd.exe
PID 4756 wrote to memory of 4420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4756 wrote to memory of 4420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4756 wrote to memory of 4420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4756 wrote to memory of 1060 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe
PID 4756 wrote to memory of 1060 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe
PID 4756 wrote to memory of 1060 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe
PID 1060 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1060 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1060 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1060 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1060 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4940 wrote to memory of 2876 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Users\Admin\AppData\Local\Temp\tmpE6BE.tmp.exe
PID 4940 wrote to memory of 2876 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Users\Admin\AppData\Local\Temp\tmpE6BE.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\decrypted.exe

"C:\Users\Admin\AppData\Local\Temp\decrypted.exe"

C:\Users\Admin\AppData\Local\Temp\is-KO7JT.tmp\decrypted.tmp

"C:\Users\Admin\AppData\Local\Temp\is-KO7JT.tmp\decrypted.tmp" /SL5="$80054,11050682,1125376,C:\Users\Admin\AppData\Local\Temp\decrypted.exe"

C:\Users\Admin\AppData\Local\Temp\decrypted.exe

"C:\Users\Admin\AppData\Local\Temp\decrypted.exe" /VERYSILENT /NORESTART

C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp

"C:\Users\Admin\AppData\Local\Temp\is-4LHIJ.tmp\decrypted.tmp" /SL5="$E0050,11050682,1125376,C:\Users\Admin\AppData\Local\Temp\decrypted.exe" /VERYSILENT /NORESTART

C:\Windows\system32\cmd.exe

"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH

C:\Windows\system32\find.exe

find /I "wrsa.exe"

C:\Windows\system32\cmd.exe

"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH

C:\Windows\system32\find.exe

find /I "opssvc.exe"

C:\Windows\system32\cmd.exe

"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH

C:\Windows\system32\find.exe

find /I "avastui.exe"

C:\Windows\system32\cmd.exe

"cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH

C:\Windows\system32\find.exe

find /I "avgui.exe"

C:\Windows\system32\cmd.exe

"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH

C:\Windows\system32\find.exe

find /I "nswscsvc.exe"

C:\Windows\system32\cmd.exe

"cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH

C:\Windows\system32\find.exe

find /I "sophoshealth.exe"

C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe

"C:\Users\Admin\AppData\Local\fragaria\\AutoIt3.exe" "C:\Users\Admin\AppData\Local\fragaria\\VSIXConfigurationUpdater1.a3x"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && AutoIt3.exe C:\ProgramData\\RopfISG.a3x && del C:\ProgramData\\RopfISG.a3x

C:\Windows\SysWOW64\PING.EXE

ping -n 5 127.0.0.1

C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe

AutoIt3.exe C:\ProgramData\\RopfISG.a3x

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\tmpE6BE.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpE6BE.tmp.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 101.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
RU 45.141.87.50:15647 tcp
US 8.8.8.8:53 50.87.141.45.in-addr.arpa udp
RU 45.141.87.50:9000 45.141.87.50 tcp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 52.111.227.11:443 tcp
US 8.8.8.8:53 crimsonbike.com udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
RU 45.143.167.133:443 crimsonbike.com tcp
US 8.8.8.8:53 133.167.143.45.in-addr.arpa udp
US 8.8.8.8:53 professitonwqu.shop udp
US 104.21.63.11:443 professitonwqu.shop tcp
US 8.8.8.8:53 mobbipenju.store udp
US 172.67.208.181:443 mobbipenju.store tcp
US 8.8.8.8:53 11.63.21.104.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 eaglepawnoy.store udp
US 172.67.156.136:443 eaglepawnoy.store tcp
US 8.8.8.8:53 dissapoiznw.store udp
US 104.21.63.7:443 dissapoiznw.store tcp
US 8.8.8.8:53 181.208.67.172.in-addr.arpa udp
US 8.8.8.8:53 studennotediw.store udp
US 172.67.186.147:443 studennotediw.store tcp
US 8.8.8.8:53 bathdoomgaz.store udp
US 104.21.6.95:443 bathdoomgaz.store tcp
US 8.8.8.8:53 136.156.67.172.in-addr.arpa udp
US 8.8.8.8:53 7.63.21.104.in-addr.arpa udp
US 8.8.8.8:53 147.186.67.172.in-addr.arpa udp
US 8.8.8.8:53 spirittunek.store udp
US 172.67.130.202:443 spirittunek.store tcp
US 8.8.8.8:53 licendfilteo.site udp
US 8.8.8.8:53 clearancek.site udp
US 8.8.8.8:53 95.6.21.104.in-addr.arpa udp
US 8.8.8.8:53 202.130.67.172.in-addr.arpa udp
US 8.8.8.8:53 steamcommunity.com udp
GB 104.82.234.109:443 steamcommunity.com tcp
US 8.8.8.8:53 feelystroll.buzz udp
US 172.67.151.30:443 feelystroll.buzz tcp
US 8.8.8.8:53 109.234.82.104.in-addr.arpa udp
US 8.8.8.8:53 30.151.67.172.in-addr.arpa udp

Files

memory/1612-0-0x0000000000EE0000-0x0000000001001000-memory.dmp

memory/1612-2-0x0000000000EE1000-0x0000000000F89000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-KO7JT.tmp\decrypted.tmp

MD5 edf47d593acf0e39438d621e8357ad34
SHA1 5732a17515b0112ce47637393043a1a2e4836218
SHA256 5f0f2e763c33ef0d3bb30041927a39191a257b533e16f1f89bf2939d669c9412
SHA512 8f49244aa4d4ba31ecef404b9f42b7e9798951a8065dea3699e10464ab676f72227c3084e51c7c256e385605cfa95a35bd88fff01477ecf426153ffcf2f9994f

memory/1288-6-0x0000000001010000-0x0000000001011000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-9P47R.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

memory/2516-13-0x0000000000EE0000-0x0000000001001000-memory.dmp

memory/1288-15-0x0000000000AA0000-0x0000000000E20000-memory.dmp

memory/1612-17-0x0000000000EE0000-0x0000000001001000-memory.dmp

memory/4636-21-0x0000000001170000-0x0000000001171000-memory.dmp

C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe

MD5 3f58a517f1f4796225137e7659ad2adb
SHA1 e264ba0e9987b0ad0812e5dd4dd3075531cfe269
SHA256 1da298cab4d537b0b7b5dabf09bff6a212b9e45731e0cc772f99026005fb9e48
SHA512 acf740aafce390d06c6a76c84e7ae7c0f721731973aadbe3e57f2eb63241a01303cc6bf11a3f9a88f8be0237998b5772bdaf569137d63ba3d0f877e7d27fc634

C:\Users\Admin\AppData\Local\fragaria\VSIXConfigurationUpdater1.a3x

MD5 292aad866f9decedfdb2b3126fab6061
SHA1 ea5273f207b22196dbed7e1ddc691ce4418a6d87
SHA256 5da1f6349763ccbf7ada3167e0a8e1eeeb158c6cdd0b2aee8f9278812be0d59b
SHA512 750573570f029858d689836c8ec7e49f9e3646783adeb34597a7cfd6411a86b2aa060626e7ed9d97ec7dac15d295b36ed03225fdd4238aad59cf2851c91a0119

memory/4636-175-0x0000000000940000-0x0000000000CC0000-memory.dmp

C:\Users\Admin\AppData\Local\fragaria\VSIXConfigurationUpdater.wav

MD5 c25a5d1ff98e3558b128797de0f7ede8
SHA1 e6b742ba4fa0836f16b135ab530391ea52e7a83c
SHA256 7344920e5ee6ff4f75013be233fea20b872bd4d9adcf0434eaeebcba79099819
SHA512 f515507befee96cf2f86db0db2c8dda831063900729e0449df0f32a88c76c7752ee364d5d1e072175b5a9eccd6f54f72e5c08656b5bf8d711a414ceda91aa5c0

memory/2516-178-0x0000000000EE0000-0x0000000001001000-memory.dmp

memory/4940-187-0x0000000000400000-0x00000000004C6000-memory.dmp

memory/4940-188-0x0000000000400000-0x00000000004C6000-memory.dmp

memory/4940-189-0x0000000004A50000-0x0000000004AE2000-memory.dmp

memory/4940-190-0x00000000050A0000-0x0000000005644000-memory.dmp

memory/4940-191-0x0000000004E60000-0x0000000005022000-memory.dmp

memory/4940-192-0x0000000004BB0000-0x0000000004C26000-memory.dmp

memory/4940-193-0x0000000004C90000-0x0000000004CE0000-memory.dmp

memory/4940-194-0x0000000004B60000-0x0000000004B6A000-memory.dmp

memory/4940-195-0x0000000005D00000-0x000000000622C000-memory.dmp

memory/4940-196-0x0000000005850000-0x000000000586E000-memory.dmp

memory/4940-197-0x0000000005940000-0x00000000059A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp12E9.tmp

MD5 a603e09d617fea7517059b4924b1df93
SHA1 31d66e1496e0229c6a312f8be05da3f813b3fa9e
SHA256 ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7
SHA512 eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

C:\Users\Admin\AppData\Local\Temp\tmp131B.tmp

MD5 49693267e0adbcd119f9f5e02adf3a80
SHA1 3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512 b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

memory/4940-221-0x00000000078A0000-0x00000000078AA000-memory.dmp

memory/4940-223-0x0000000004D00000-0x0000000004D12000-memory.dmp

memory/4940-224-0x0000000004D60000-0x0000000004D9C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpE6BE.tmp.exe

MD5 40ec60bf0761652fc0f5cc888128acff
SHA1 1fde0d7c443e47efbcd26135b8bdf961bec46a89
SHA256 0d7341486b8814c8de2dd5660308e103f293d707da933289ca709ce0be39507e
SHA512 7a863d1322947c0781ea839a918ac018d34545a75d2eb61612cea3aadf43f2221d8e993bc0f2a0c8b8f4f5250245142ca9a61d2573a305ea21a38b01e692ef85

memory/2876-254-0x00000000025D0000-0x000000000262E000-memory.dmp

memory/2876-256-0x0000000000400000-0x0000000000922000-memory.dmp