Malware Analysis Report

2024-11-30 15:03

Sample ID 241030-c8wx2swndn
Target 72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe
SHA256 72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad
Tags
vipkeylogger collection discovery evasion keylogger persistence stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad

Threat Level: Known bad

The file 72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe was found to be: Known bad.

Malicious Activity Summary

vipkeylogger collection discovery evasion keylogger persistence stealer

Modifies WinLogon for persistence

VIPKeylogger

Vipkeylogger family

Modifies visiblity of hidden/system files in Explorer

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Adds Run key to start application

AutoIT Executable

Suspicious use of SetThreadContext

Drops file in Windows directory

Browser Information Discovery

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

outlook_win_path

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

outlook_office_path

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-30 02:45

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-30 02:45

Reported

2024-10-30 02:47

Platform

win7-20241023-en

Max time kernel

150s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2140 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe 
PID 2140 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe 
PID 2140 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe 
PID 2140 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe 
PID 2140 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 2140 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 2140 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 2140 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 2592 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 2592 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 2592 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 2592 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 2248 wrote to memory of 2852 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2248 wrote to memory of 2852 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2248 wrote to memory of 2852 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2248 wrote to memory of 2852 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2852 wrote to memory of 2656 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2852 wrote to memory of 2656 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2852 wrote to memory of 2656 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2852 wrote to memory of 2656 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2656 wrote to memory of 2736 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2656 wrote to memory of 2736 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2656 wrote to memory of 2736 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2656 wrote to memory of 2736 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2656 wrote to memory of 2328 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2656 wrote to memory of 2328 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2656 wrote to memory of 2328 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2656 wrote to memory of 2328 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1988 wrote to memory of 2280 N/A \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1988 wrote to memory of 2280 N/A \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1988 wrote to memory of 2280 N/A \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1988 wrote to memory of 2280 N/A \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1988 wrote to memory of 2280 N/A \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1988 wrote to memory of 2280 N/A \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1988 wrote to memory of 2280 N/A \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1988 wrote to memory of 2280 N/A \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2656 wrote to memory of 2940 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2656 wrote to memory of 2940 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2656 wrote to memory of 2940 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2656 wrote to memory of 2940 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2656 wrote to memory of 1640 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2656 wrote to memory of 1640 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2656 wrote to memory of 1640 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2656 wrote to memory of 1640 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe

"C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe"

\??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe 

c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe 

C:\Users\Admin\AppData\Local\icsys.icn.exe

C:\Users\Admin\AppData\Local\icsys.icn.exe

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 02:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe 

C:\Windows\SysWOW64\at.exe

at 02:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 02:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 checkip.dyndns.org udp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 mail.tlakovec.si udp
SI 212.44.112.138:587 mail.tlakovec.si tcp
SI 212.44.112.138:587 mail.tlakovec.si tcp

Files

memory/2140-0-0x0000000000400000-0x000000000043E000-memory.dmp

\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe 

MD5 6a6157cd22cd9558f8579c30632e62c1
SHA1 7451d8e77a65ff7e9ddebdf73183cbd684d3fdfd
SHA256 c3e272af01d2b5739d8f91ce17d80e13818a59fe50f5545d09fea9a669520667
SHA512 4e41562a7279af1b4b4a0513b4f75965f04729fc3d6d71a9c74634a24257143bee308c942abb3e5de5b29bdafde86ccfac5f906f1c26b4a0b40c54b0fe47fa3a

\Users\Admin\AppData\Local\icsys.icn.exe

MD5 30957be4d1d5957a9d6433367cef30ef
SHA1 df2d8a795bd221d77b0bc167d05203ab6b6b2fca
SHA256 cedcf4e2ffc34660e6e4bdd8e3cab70b2c805704ceb302f29e3b5a3c4e6eac5c
SHA512 36382e3597704764ae1300ca3c857b50f2fabe7f557c36240206749dfa89fb435f313511d72d5ded60db9b38237f0d983f0af78f3440ac7dfaa7014e3085e161

\Windows\system\explorer.exe

MD5 03b1a8fb2c851d422a09e42ca0fbcf45
SHA1 15322e0b58a8de39d23c8d3648fba67383c2d937
SHA256 20f3f16569ed83afa4fb0afb12170ef912c44e61aa48a45c39546346810fc0e6
SHA512 fb60183694e1ed2b97e66606f6e91ac4f29826ab414a18c2752aa387fd1d7fd4f99b2848bac7d545194e5cdee73fc79353385a4e90fa62fe15fa859484e7d48b

memory/2592-27-0x0000000002020000-0x000000000205E000-memory.dmp

memory/2248-34-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2592-32-0x0000000002020000-0x000000000205E000-memory.dmp

\Windows\system\spoolsv.exe

MD5 feb7a3c8e863e2799073958aa54c3f59
SHA1 9a3d9c010b1f468fc63a7c423e92f2c314205277
SHA256 6ce4b01d9817815b1124fb32bf819cb86f0d3360efc33d3a02971386ef3387d7
SHA512 6b6381ea1a958b8b96f62d05116a8eeac0e98eff8ad2fe5942cd4fdf7a11c930cc81b99f2a8b220f9a80ddf15cf64eb7d76122469bb2e5eab8bc6fd680f3c4d4

memory/2248-48-0x0000000002720000-0x000000000275E000-memory.dmp

\Windows\system\svchost.exe

MD5 a5d4d8786ccd4d557ee5ebec494aaff2
SHA1 d3e8e1d2d29a81cf037d652ddf880b5910aee2ae
SHA256 58e20686f478990b650153f8fd1d1b1381b55543ad5679b5754469b2ebf940ab
SHA512 ca4cdc4bc7ddc7b4bf0dd3208c27ac9a5b45655bcceefef7e51e87b58abcced94e193c428c22b0f1dba26e0645f721bac34e7e6b3fce0451bf84586af6b8caa5

memory/2656-67-0x0000000002690000-0x00000000026CE000-memory.dmp

memory/2736-73-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2852-74-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2592-78-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2140-77-0x0000000000400000-0x000000000043E000-memory.dmp

memory/1988-79-0x0000000003BC0000-0x0000000003DC0000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 8c89eb73f1b4c0dce58bff0568de3392
SHA1 609a4b6a2bcd2b70d70803005efb1e9d2c7851d4
SHA256 23a0174586b08363e5071366d40571b74d6a8e3050febd9cb2e1afd8b7ccb218
SHA512 8e4abd1f8235c8c6ac88dc1d636c27555126feb10189f847b8dad2b53c4937fa8d7bab3d6b2759816e862e3dc88f794157363887c1ad7c662504ff5651d0bbff

memory/2280-81-0x0000000000400000-0x000000000044A000-memory.dmp

memory/2280-83-0x0000000000400000-0x000000000044A000-memory.dmp

memory/2280-82-0x0000000000400000-0x000000000044A000-memory.dmp

memory/2248-84-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2656-85-0x0000000000400000-0x000000000043E000-memory.dmp

\??\PIPE\atsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-30 02:45

Reported

2024-10-30 02:47

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4104 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe 
PID 4104 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe 
PID 4104 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe 
PID 4104 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 4104 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 4104 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 4916 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 4916 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 4916 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 4412 wrote to memory of 4072 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 4412 wrote to memory of 4072 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 4412 wrote to memory of 4072 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 4072 wrote to memory of 896 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 4072 wrote to memory of 896 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 4072 wrote to memory of 896 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 896 wrote to memory of 1636 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 896 wrote to memory of 1636 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 896 wrote to memory of 1636 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 896 wrote to memory of 4540 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 896 wrote to memory of 4540 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 896 wrote to memory of 4540 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2376 wrote to memory of 4528 N/A \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2376 wrote to memory of 4528 N/A \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2376 wrote to memory of 4528 N/A \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2376 wrote to memory of 4528 N/A \??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 896 wrote to memory of 1608 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 896 wrote to memory of 1608 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 896 wrote to memory of 1608 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 896 wrote to memory of 64 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 896 wrote to memory of 64 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 896 wrote to memory of 64 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe

"C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe"

\??\c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe 

c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe 

C:\Users\Admin\AppData\Local\icsys.icn.exe

C:\Users\Admin\AppData\Local\icsys.icn.exe

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 02:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

c:\users\admin\appdata\local\temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe 

C:\Windows\SysWOW64\at.exe

at 02:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 02:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 168.6.122.193.in-addr.arpa udp
US 8.8.8.8:53 134.177.67.172.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 mail.tlakovec.si udp
SI 212.44.112.138:587 mail.tlakovec.si tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 138.112.44.212.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
SI 212.44.112.138:587 mail.tlakovec.si tcp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp

Files

memory/4104-0-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad.exe 

MD5 6a6157cd22cd9558f8579c30632e62c1
SHA1 7451d8e77a65ff7e9ddebdf73183cbd684d3fdfd
SHA256 c3e272af01d2b5739d8f91ce17d80e13818a59fe50f5545d09fea9a669520667
SHA512 4e41562a7279af1b4b4a0513b4f75965f04729fc3d6d71a9c74634a24257143bee308c942abb3e5de5b29bdafde86ccfac5f906f1c26b4a0b40c54b0fe47fa3a

C:\Users\Admin\AppData\Local\icsys.icn.exe

MD5 30957be4d1d5957a9d6433367cef30ef
SHA1 df2d8a795bd221d77b0bc167d05203ab6b6b2fca
SHA256 cedcf4e2ffc34660e6e4bdd8e3cab70b2c805704ceb302f29e3b5a3c4e6eac5c
SHA512 36382e3597704764ae1300ca3c857b50f2fabe7f557c36240206749dfa89fb435f313511d72d5ded60db9b38237f0d983f0af78f3440ac7dfaa7014e3085e161

\??\c:\windows\system\explorer.exe

MD5 bab42f83cdcf8100708a37e628c3303f
SHA1 c62dc588404ebdfd557de11992ad270969e04693
SHA256 19df062e705bdc3dbf701586f02b167e954be72e7b170434c4c65c06cb77a937
SHA512 1a8549ba54de09ede9f8ba114e5ed5a766f9b82b8a5764313dbd199346f2fd95990688367d0f14687f4d1f638eb37f4307e3a911e01ab7ddfc24842538f2e8b7

memory/4412-21-0x0000000000400000-0x000000000043E000-memory.dmp

\??\c:\windows\system\spoolsv.exe

MD5 ee2eb104663495e67b2a0c44e409550c
SHA1 7de609a8414cf0bd692ef8971f45a2e67b478e96
SHA256 2ca513358a1693ff2b49242740b21da5a60e84903669d1edb16e19304ade48a8
SHA512 730661ce86d4c4eaff18c274ef4aaaea4bb770916afa93831fe02e323246865952a34648fe8e67f515e27b862c908f51e400ce465ca617bf25d258d9c0eb2f7d

\??\c:\windows\system\svchost.exe

MD5 73d723cb84bb65f5b3c0313f5059ec04
SHA1 fad342df6eae24870439670b241257e49b4e02d5
SHA256 03c2a49776e6c6df7a10e0a091d396b201e21b4023627dce285d73466189e5a4
SHA512 e893272ced1f5b4c1af5ad9f6d5dd0c63230f2ba2861c5450834ef897f928e0c54eb57108bb6aa8d3eb4c32017d991e4c93bd6b674e9c5d680a505b1b26aac81

memory/1636-45-0x0000000000400000-0x000000000043E000-memory.dmp

memory/4072-48-0x0000000000400000-0x000000000043E000-memory.dmp

memory/4916-49-0x0000000000400000-0x000000000043E000-memory.dmp

memory/4104-50-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 02a74b5275541136031a6816a83c4c5d
SHA1 daaa3ccc998ccc19f4e4abdbafb86a66d8997f9a
SHA256 350e2aaabc35c8095d7babbf3bfeedc7aa411103de0bf30f86d7055c79bf73e2
SHA512 1146f2412a9926e0c839ae104bb40c5c92b6d84b5659063daa3861c7ee725e839ab2da7f239fba97982e46b55215f16bd57f39ad5e1cdfeccac73cdb51d2e17d

memory/4528-53-0x0000000000400000-0x000000000044A000-memory.dmp

memory/4528-54-0x00000000058E0000-0x0000000005E84000-memory.dmp

memory/4528-55-0x00000000053D0000-0x000000000546C000-memory.dmp

memory/4528-56-0x00000000066A0000-0x0000000006862000-memory.dmp

memory/4528-57-0x0000000006520000-0x0000000006570000-memory.dmp

memory/4528-58-0x0000000006DA0000-0x00000000072CC000-memory.dmp

memory/4528-59-0x0000000006870000-0x0000000006902000-memory.dmp

memory/4528-60-0x0000000006A00000-0x0000000006A0A000-memory.dmp

memory/4412-61-0x0000000000400000-0x000000000043E000-memory.dmp

memory/896-62-0x0000000000400000-0x000000000043E000-memory.dmp

\??\PIPE\atsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e