Malware Analysis Report

2024-11-13 15:41

Sample ID 241107-tzeqvawbpe
Target dd6f0b9730529cfe145d5585eccfb6c68510758d16ffd02043bd1fe73842ee1b
SHA256 dd6f0b9730529cfe145d5585eccfb6c68510758d16ffd02043bd1fe73842ee1b
Tags
discovery redline sectoprat infostealer rat trojan stormkitty stealer persistence privilege_escalation spyware asyncrat default mercurialgrabber evasion nanocore keylogger njrat hacked lokibot collection
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dd6f0b9730529cfe145d5585eccfb6c68510758d16ffd02043bd1fe73842ee1b

Threat Level: Known bad

The file dd6f0b9730529cfe145d5585eccfb6c68510758d16ffd02043bd1fe73842ee1b was found to be: Known bad.

Malicious Activity Summary

discovery redline sectoprat infostealer rat trojan stormkitty stealer persistence privilege_escalation spyware asyncrat default mercurialgrabber evasion nanocore keylogger njrat hacked lokibot collection

Sectoprat family

AsyncRat

Mercurialgrabber family

NanoCore

Async RAT payload

StormKitty

Njrat family

Mercurial Grabber Stealer

RedLine

Lokibot family

RedLine payload

Asyncrat family

StormKitty payload

Nanocore family

SectopRAT payload

Stormkitty family

njRAT/Bladabindi

Redline family

SectopRAT

Lokibot

Looks for VirtualBox Guest Additions in registry

Async RAT payload

Looks for VMWare Tools registry key

Downloads MZ/PE file

Modifies Windows Firewall

Deletes itself

Reads user/profile data of web browsers

Drops startup file

Executes dropped EXE

Checks computer location settings

Checks BIOS information in registry

Loads dropped DLL

Unexpected DNS network traffic destination

Drops desktop.ini file(s)

Looks up external IP address via web service

Network Service Discovery

Maps connected drives based on registry

Accesses Microsoft Outlook profiles

Checks whether UAC is enabled

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Drops file in Program Files directory

Browser Information Discovery

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Wi-Fi Discovery

Program crash

Event Triggered Execution: Netsh Helper DLL

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

outlook_win_path

Delays execution with timeout.exe

Checks SCSI registry key(s)

outlook_office_path

Suspicious use of WriteProcessMemory

Checks processor information in registry

Kills process with taskkill

Suspicious use of SendNotifyMessage

Modifies system certificate store

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Reported

2024-11-07 16:29

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Mercurialgrabber family

mercurialgrabber

Nanocore family

nanocore

Njrat family

njrat

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Stormkitty family

stormkitty

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe"

Signatures

Network Service Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\arp.exe N/A
N/A N/A C:\Windows\SysWOW64\arp.exe N/A
N/A N/A C:\Windows\SysWOW64\arp.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\arp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\arp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\arp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3936 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe C:\Windows\SysWOW64\arp.exe
PID 3936 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe C:\Windows\SysWOW64\arp.exe
PID 3936 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe C:\Windows\SysWOW64\arp.exe
PID 3936 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe C:\Windows\SysWOW64\arp.exe
PID 3936 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe C:\Windows\SysWOW64\arp.exe
PID 3936 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe C:\Windows\SysWOW64\arp.exe
PID 3936 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe C:\Windows\SysWOW64\arp.exe
PID 3936 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe C:\Windows\SysWOW64\arp.exe
PID 3936 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe C:\Windows\SysWOW64\arp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe

"C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe"

C:\Windows\SysWOW64\arp.exe

"C:\Windows\System32\arp.exe" -a

C:\Windows\SysWOW64\arp.exe

"C:\Windows\System32\arp.exe" -a

C:\Windows\SysWOW64\arp.exe

"C:\Windows\System32\arp.exe" -a

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 api.auth.gg udp
US 172.67.164.78:443 api.auth.gg tcp
US 8.8.8.8:53 78.164.67.172.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 16.173.189.20.in-addr.arpa udp

Files

memory/3936-0-0x0000000074E9E000-0x0000000074E9F000-memory.dmp

memory/3936-1-0x0000000000F80000-0x0000000000F92000-memory.dmp

memory/3936-2-0x0000000005F60000-0x0000000006504000-memory.dmp

memory/3936-3-0x00000000059B0000-0x0000000005A42000-memory.dmp

memory/3936-4-0x0000000074E90000-0x0000000075640000-memory.dmp

memory/3936-5-0x0000000074E90000-0x0000000075640000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win7-20241010-en

Max time kernel

128s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Sectoprat family

sectoprat

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2384 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
PID 2384 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
PID 2384 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
PID 2384 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
PID 2384 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
PID 2384 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
PID 2384 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
PID 2384 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
PID 2384 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe

Processes

C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe

"C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe"

C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe

"{path}"

Network

Country Destination Domain Proto
US 8.8.8.8:53 newlife957.duckdns.org udp
IT 195.178.120.157:7225 newlife957.duckdns.org tcp
IT 195.178.120.157:7225 newlife957.duckdns.org tcp
IT 195.178.120.157:7225 newlife957.duckdns.org tcp
IT 195.178.120.157:7225 newlife957.duckdns.org tcp
IT 195.178.120.157:7225 newlife957.duckdns.org tcp

Files

memory/2384-0-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

memory/2384-1-0x0000000000DE0000-0x0000000000EC0000-memory.dmp

memory/2384-2-0x0000000074C10000-0x00000000752FE000-memory.dmp

memory/2384-3-0x0000000000860000-0x0000000000868000-memory.dmp

memory/2384-4-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

memory/2384-5-0x0000000074C10000-0x00000000752FE000-memory.dmp

memory/2384-6-0x0000000004F60000-0x0000000004FE6000-memory.dmp

memory/2384-7-0x0000000000CB0000-0x0000000000CE8000-memory.dmp

memory/2184-8-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2184-9-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2184-10-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2184-11-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2184-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2184-14-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2184-21-0x0000000074C10000-0x00000000752FE000-memory.dmp

memory/2384-20-0x0000000074C10000-0x00000000752FE000-memory.dmp

memory/2184-19-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2184-16-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2184-22-0x0000000074C10000-0x00000000752FE000-memory.dmp

memory/2184-23-0x0000000074C10000-0x00000000752FE000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win7-20240903-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe"

Signatures

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Stormkitty family

stormkitty

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\chcp.com N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2588 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe C:\Windows\SysWOW64\cmd.exe
PID 2588 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe C:\Windows\SysWOW64\cmd.exe
PID 2588 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe C:\Windows\SysWOW64\cmd.exe
PID 2588 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 1212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2964 wrote to memory of 1212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2964 wrote to memory of 1212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2964 wrote to memory of 1212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2964 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2964 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2964 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2964 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2964 wrote to memory of 1260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2964 wrote to memory of 1260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2964 wrote to memory of 1260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2964 wrote to memory of 1260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe

"C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpD81D.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpD81D.tmp.bat

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\taskkill.exe

TaskKill /F /IM 2588

C:\Windows\SysWOW64\timeout.exe

Timeout /T 2 /Nobreak

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp

Files

memory/2588-0-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

memory/2588-1-0x0000000000C80000-0x0000000000CA2000-memory.dmp

memory/2588-2-0x0000000074BD0000-0x00000000752BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabAD61.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarAD83.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dfd529a13f9a5cc45b9d4cde3092e2ac
SHA1 ad06e46671a8a0b571b67d9ef784498adbd0f74d
SHA256 2ab9de0d2b0ade90048b497828966ae80faf5960a050c40792148dbb6c710c0f
SHA512 c368e9e907eb78cf0bb2fd6e23b652e35834e44d16ded636b5bc863b7632411cffaa96481ff6623dd71fb90670dde4e3d2a466a62928dff96de8067fc34c7110

memory/2588-99-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

memory/2588-100-0x0000000074BD0000-0x00000000752BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpD81D.tmp.bat

MD5 e55c91983cc8bdfec3057011b1869b81
SHA1 a60846fdc465110e37c6afdb9497abee7e477eb1
SHA256 af8b2e1b27ee04afe8b7f88fc31d4efd39e304ffbd1442a99e719a98ccc04f74
SHA512 0f6b4a3dbbe4cb3c6bafc1e71115f112190d9ba1f51d58649639e11b4fbf0a5293ca9051e47f5d3ec8337ac11f99feb54b6150b28a3b7e39d6e38eea3e9b600d

memory/2588-103-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe"

Signatures

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Stormkitty family

stormkitty

Downloads MZ/PE file

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\0e4ee70d89575d257d7ab2a752a7290f\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe N/A
File created C:\Users\Admin\AppData\Local\0e4ee70d89575d257d7ab2a752a7290f\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe N/A
File created C:\Users\Admin\AppData\Local\0e4ee70d89575d257d7ab2a752a7290f\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe N/A
File created C:\Users\Admin\AppData\Local\0e4ee70d89575d257d7ab2a752a7290f\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe N/A
File created C:\Users\Admin\AppData\Local\0e4ee70d89575d257d7ab2a752a7290f\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe N/A
File created C:\Users\Admin\AppData\Local\0e4ee70d89575d257d7ab2a752a7290f\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Browser Information Discovery

discovery

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\chcp.com N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\chcp.com N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: 33 N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5016 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe C:\Windows\SysWOW64\cmd.exe
PID 5016 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe C:\Windows\SysWOW64\cmd.exe
PID 5016 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe C:\Windows\SysWOW64\cmd.exe
PID 4744 wrote to memory of 3668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4744 wrote to memory of 3668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4744 wrote to memory of 3668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4744 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 4744 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 4744 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 4744 wrote to memory of 3196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4744 wrote to memory of 3196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4744 wrote to memory of 3196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 5016 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe C:\Windows\SysWOW64\cmd.exe
PID 5016 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe C:\Windows\SysWOW64\cmd.exe
PID 5016 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 1628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2568 wrote to memory of 1628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2568 wrote to memory of 1628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2568 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2568 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2568 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe

"C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5016 -ip 5016

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 2692

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 106.208.201.84.in-addr.arpa udp

Files

memory/5016-0-0x000000007449E000-0x000000007449F000-memory.dmp

memory/5016-1-0x0000000000F10000-0x0000000000F32000-memory.dmp

memory/5016-2-0x0000000005900000-0x0000000005966000-memory.dmp

memory/5016-3-0x0000000074490000-0x0000000074C40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DotNetZip.dll

MD5 6d1c62ec1c2ef722f49b2d8dd4a4df16
SHA1 1bb08a979b7987bc7736a8cfa4779383cb0ecfa6
SHA256 00da1597d92235d3f84da979e2fa5dbf049bafb52c33bd6fc8ee7b29570c124c
SHA512 c0dce8eaa52eb6c319d4be2eec4622bb3380c65b659cfb77ff51a4ada7d3e591e791ee823dad67b5556ffac5c060ff45d09dd1cc21baaf70ba89806647cb3bd2

C:\Users\Admin\AppData\Local\0e4ee70d89575d257d7ab2a752a7290f\Admin@GYHASOLS_en-US\Browsers\Firefox\Bookmarks.txt

MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

memory/5016-66-0x0000000007290000-0x0000000007322000-memory.dmp

memory/5016-69-0x0000000007B30000-0x00000000080D4000-memory.dmp

memory/5016-84-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/2960-87-0x00000242A5460000-0x00000242A5461000-memory.dmp

memory/2960-86-0x00000242A5460000-0x00000242A5461000-memory.dmp

memory/2960-85-0x00000242A5460000-0x00000242A5461000-memory.dmp

memory/2960-92-0x00000242A5460000-0x00000242A5461000-memory.dmp

memory/2960-97-0x00000242A5460000-0x00000242A5461000-memory.dmp

memory/2960-96-0x00000242A5460000-0x00000242A5461000-memory.dmp

memory/2960-95-0x00000242A5460000-0x00000242A5461000-memory.dmp

memory/2960-94-0x00000242A5460000-0x00000242A5461000-memory.dmp

memory/2960-93-0x00000242A5460000-0x00000242A5461000-memory.dmp

memory/2960-91-0x00000242A5460000-0x00000242A5461000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:30

Platform

win7-20240903-en

Max time kernel

67s

Max time network

67s

Command Line

"C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe"

Signatures

AsyncRat

rat asyncrat

Asyncrat family

asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2212 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe C:\Windows\SysWOW64\cmd.exe
PID 2556 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2556 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2556 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2556 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2572 wrote to memory of 1312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2572 wrote to memory of 1312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2572 wrote to memory of 1312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2572 wrote to memory of 1312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2572 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe
PID 2572 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe
PID 2572 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe
PID 2572 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe

Processes

C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe

"C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "12376w8q09dq" /tr '"C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp915.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "12376w8q09dq" /tr '"C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe

"C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

Network

Country Destination Domain Proto
US 206.123.141.239:7777 tcp
US 206.123.141.239:7777 tcp
US 206.123.141.239:7777 tcp

Files

memory/2212-0-0x0000000074E1E000-0x0000000074E1F000-memory.dmp

memory/2212-1-0x0000000000220000-0x0000000000232000-memory.dmp

memory/2212-2-0x0000000074E10000-0x00000000754FE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp915.tmp.bat

MD5 b3fc987efb54ee1b3ab0d38d9a4cc4de
SHA1 f725285f5085f8267deb45b2b440ec338bc4e4ae
SHA256 a3c7093d05353e21a622658da54190867a0f9e1def4e1bfc4b97adde28752953
SHA512 e13af8cf55ba2a3319498a2a1a4e418f4fa845edd1ad6b3bb4f80673737b406f0099c709824a81217d438b27efa14bdab8acb3d5a98febb89d414dfe2b6fa00a

memory/2212-11-0x0000000074E10000-0x00000000754FE000-memory.dmp

\Users\Admin\AppData\Roaming\12376w8q09dq.exe

MD5 5af5a9087ecf42eb83fb358d49b06e92
SHA1 0d4a5c5d90e6306c476036ca097a01a17b4295db
SHA256 878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453
SHA512 d0608f648dd26b81d262741c373737dba3bfeb1508f86d8c448ec634a78bd9f86f52961d22cf027418c5012f2f7388928480495003dfeac7b94deb590bb7d22c

memory/2612-16-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

memory/2588-17-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2588-18-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2588-19-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2588-20-0x0000000140000000-0x00000001405E8000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win7-20241010-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe"

Signatures

Mercurial Grabber Stealer

stealer mercurialgrabber

Mercurialgrabber family

mercurialgrabber

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip4.seeip.org N/A N/A
N/A ip-api.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe

"C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1596 -s 1400

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip4.seeip.org udp
US 23.128.64.141:443 ip4.seeip.org tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 162.159.138.232:443 discord.com tcp

Files

memory/1596-0-0x000007FEF5E13000-0x000007FEF5E14000-memory.dmp

memory/1596-1-0x0000000000130000-0x0000000000140000-memory.dmp

memory/1596-2-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

memory/1596-3-0x000007FEF5E13000-0x000007FEF5E14000-memory.dmp

memory/1596-4-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

memory/1596-5-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe"

Signatures

Mercurial Grabber Stealer

stealer mercurialgrabber

Mercurialgrabber family

mercurialgrabber

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip4.seeip.org N/A N/A
N/A ip-api.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe

"C:\Users\Admin\AppData\Local\Temp\98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip4.seeip.org udp
US 23.128.64.141:443 ip4.seeip.org tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 233.128.159.162.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 106.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/876-1-0x00007FF9F5A73000-0x00007FF9F5A75000-memory.dmp

memory/876-0-0x0000000000DC0000-0x0000000000DD0000-memory.dmp

memory/876-2-0x00007FF9F5A70000-0x00007FF9F6531000-memory.dmp

memory/876-3-0x00007FF9F5A70000-0x00007FF9F6531000-memory.dmp

memory/876-7-0x00007FF9F5A70000-0x00007FF9F6531000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Nanocore family

nanocore

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 84.200.70.40 N/A N/A
Destination IP 84.200.69.80 N/A N/A
Destination IP 84.200.70.40 N/A N/A
Destination IP 84.200.69.80 N/A N/A
Destination IP 84.200.69.80 N/A N/A
Destination IP 84.200.70.40 N/A N/A
Destination IP 84.200.70.40 N/A N/A
Destination IP 84.200.69.80 N/A N/A
Destination IP 84.200.70.40 N/A N/A
Destination IP 84.200.69.80 N/A N/A
Destination IP 84.200.69.80 N/A N/A
Destination IP 84.200.70.40 N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LAN Service = "C:\\Program Files (x86)\\LAN Service\\lansv.exe" C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\LAN Service\lansv.exe C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A
File opened for modification C:\Program Files (x86)\LAN Service\lansv.exe C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe

"C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "LAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpCD04.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "LAN Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpCD53.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 24.101.234.141:4782 tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 24.101.234.141:4782 tcp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 24.101.234.141:4782 tcp
DE 84.200.69.80:53 mcserversetup.serveminecraft.net udp
DE 84.200.70.40:53 mcserversetup.serveminecraft.net udp
US 8.8.8.8:53 mcserversetup.serveminecraft.net udp
US 8.8.8.8:53 80.69.200.84.in-addr.arpa udp
US 8.8.8.8:53 40.70.200.84.in-addr.arpa udp
DE 84.200.69.80:53 mcserversetup.serveminecraft.net udp
DE 84.200.70.40:53 mcserversetup.serveminecraft.net udp
DE 84.200.69.80:53 mcserversetup.serveminecraft.net udp
DE 84.200.70.40:53 mcserversetup.serveminecraft.net udp
US 8.8.8.8:53 mcserversetup.serveminecraft.net udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 24.101.234.141:4782 tcp
US 24.101.234.141:4782 tcp
US 8.8.8.8:53 106.209.201.84.in-addr.arpa udp
US 24.101.234.141:4782 tcp
DE 84.200.69.80:53 mcserversetup.serveminecraft.net udp
DE 84.200.70.40:53 mcserversetup.serveminecraft.net udp
US 8.8.8.8:53 mcserversetup.serveminecraft.net udp
DE 84.200.69.80:53 mcserversetup.serveminecraft.net udp
DE 84.200.70.40:53 mcserversetup.serveminecraft.net udp
DE 84.200.69.80:53 mcserversetup.serveminecraft.net udp
DE 84.200.70.40:53 mcserversetup.serveminecraft.net udp
US 8.8.8.8:53 mcserversetup.serveminecraft.net udp
US 24.101.234.141:4782 tcp
US 24.101.234.141:4782 tcp

Files

memory/1320-0-0x0000000074742000-0x0000000074743000-memory.dmp

memory/1320-1-0x0000000074740000-0x0000000074CF1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpCD04.tmp

MD5 f8d94348e9e0b4a67b3be7e5c3e4924f
SHA1 b70034fe263152e267998fbed76c06a7e0daf83e
SHA256 8049a27b744d605b123011957117d752424135d35e8e3340d2b9b05164fb73f8
SHA512 78e9c58bab031123f54057d0bbd9c7dccf8da6e84bd9e32d6b4b0ecbd7737899a4f7a6f27999e38cdfc17b8c26c2ffad2dfde73b72cd38893ceddf7aad287b88

C:\Users\Admin\AppData\Local\Temp\tmpCD53.tmp

MD5 6b30dba7972c92c9a1b881e88c108b15
SHA1 f76207985cc5a1f70edb2fb5bd45678f195a4564
SHA256 578f5b0ff051f02f8e0a67fc3424dad554fa9489875475ea624fbb63eabfcbf7
SHA512 e3dd368937f863cb07453de12173580fb63b8d3983db7119c24860f227c89ded76401c47607f5b1134d215d46fe2b40d4bc3d7299374f1e8abecdeaefc7b9099

memory/1320-9-0x0000000074740000-0x0000000074CF1000-memory.dmp

memory/1320-10-0x0000000074742000-0x0000000074743000-memory.dmp

memory/1320-11-0x0000000074740000-0x0000000074CF1000-memory.dmp

memory/1320-12-0x0000000074740000-0x0000000074CF1000-memory.dmp

memory/1320-13-0x0000000074740000-0x0000000074CF1000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win7-20240903-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe"

Signatures

Njrat family

njrat

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XTdl5rknHl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\602fdca88735a1a1338352d8ae49ef80 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\602fdca88735a1a1338352d8ae49ef80 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A 8.tcp.ngrok.io N/A N/A
N/A 8.tcp.ngrok.io N/A N/A
N/A 8.tcp.ngrok.io N/A N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\XTdl5rknHl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2312 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe C:\Users\Admin\AppData\Local\Temp\XTdl5rknHl.exe
PID 2312 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe C:\Users\Admin\AppData\Local\Temp\XTdl5rknHl.exe
PID 2312 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe C:\Users\Admin\AppData\Local\Temp\XTdl5rknHl.exe
PID 2312 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe C:\Users\Admin\AppData\Local\Temp\XTdl5rknHl.exe
PID 2312 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe C:\Windows\SysWOW64\WerFault.exe
PID 2312 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe C:\Windows\SysWOW64\WerFault.exe
PID 2312 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe C:\Windows\SysWOW64\WerFault.exe
PID 2312 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe C:\Windows\SysWOW64\WerFault.exe
PID 2896 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\XTdl5rknHl.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2896 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\XTdl5rknHl.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2896 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\XTdl5rknHl.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2896 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\XTdl5rknHl.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2776 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\netsh.exe
PID 2776 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\netsh.exe
PID 2776 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\netsh.exe
PID 2776 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe

"C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe"

C:\Users\Admin\AppData\Local\Temp\XTdl5rknHl.exe

"C:\Users\Admin\AppData\Local\Temp\XTdl5rknHl.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 1304

C:\Users\Admin\AppData\Local\Temp\server.exe

"C:\Users\Admin\AppData\Local\Temp\server.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 ipv4bot.whatismyipaddress.com udp
US 8.8.8.8:53 8.tcp.ngrok.io udp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 3.142.129.56:12342 8.tcp.ngrok.io tcp
US 8.8.8.8:53 8.tcp.ngrok.io udp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 8.8.8.8:53 8.tcp.ngrok.io udp
US 3.142.81.166:12342 8.tcp.ngrok.io tcp

Files

memory/2312-0-0x00000000744BE000-0x00000000744BF000-memory.dmp

memory/2312-1-0x0000000001300000-0x00000000015A2000-memory.dmp

memory/2312-2-0x00000000744B0000-0x0000000074B9E000-memory.dmp

memory/2312-3-0x00000000744B0000-0x0000000074B9E000-memory.dmp

memory/2312-5-0x00000000744B0000-0x0000000074B9E000-memory.dmp

memory/2312-4-0x00000000744B0000-0x0000000074B9E000-memory.dmp

memory/2312-6-0x0000000000FB0000-0x000000000102C000-memory.dmp

\Users\Admin\AppData\Local\Temp\XTdl5rknHl.exe

MD5 059302e210a714b3cebd8c6400d7d12e
SHA1 eed4e297cdffff9815bf456e4f237b699b33de6d
SHA256 7b49bca136184f784b52ca6499108288da623944a0a97eff19e3318364a0a999
SHA512 5ae9f86dc384be6d7acb085132846ef690d0e069f43837e8e9edb89558bfb8c3a5232e47332df10b79ee8df2e4e84c509386c5fbb9f8b5a7659ff8cacb1a4dcc

memory/2896-14-0x000000006FB31000-0x000000006FB32000-memory.dmp

memory/2896-15-0x000000006FB30000-0x00000000700DB000-memory.dmp

memory/2896-16-0x000000006FB30000-0x00000000700DB000-memory.dmp

memory/2312-17-0x00000000744BE000-0x00000000744BF000-memory.dmp

memory/2312-18-0x00000000744B0000-0x0000000074B9E000-memory.dmp

memory/2312-19-0x00000000744B0000-0x0000000074B9E000-memory.dmp

memory/2896-27-0x000000006FB30000-0x00000000700DB000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe"

Signatures

Njrat family

njrat

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\wODEMFASj5.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\wODEMFASj5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\602fdca88735a1a1338352d8ae49ef80 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\602fdca88735a1a1338352d8ae49ef80 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A 8.tcp.ngrok.io N/A N/A
N/A 8.tcp.ngrok.io N/A N/A
N/A 8.tcp.ngrok.io N/A N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wODEMFASj5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe

"C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe"

C:\Users\Admin\AppData\Local\Temp\wODEMFASj5.exe

"C:\Users\Admin\AppData\Local\Temp\wODEMFASj5.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5108 -ip 5108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 2076

C:\Users\Admin\AppData\Local\Temp\server.exe

"C:\Users\Admin\AppData\Local\Temp\server.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 ipv4bot.whatismyipaddress.com udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 8.tcp.ngrok.io udp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 67.209.201.84.in-addr.arpa udp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 3.142.167.54:12342 8.tcp.ngrok.io tcp
US 8.8.8.8:53 8.tcp.ngrok.io udp
US 13.58.157.220:12342 8.tcp.ngrok.io tcp
US 13.58.157.220:12342 8.tcp.ngrok.io tcp
US 13.58.157.220:12342 8.tcp.ngrok.io tcp
US 13.58.157.220:12342 8.tcp.ngrok.io tcp
US 13.58.157.220:12342 8.tcp.ngrok.io tcp
US 13.58.157.220:12342 8.tcp.ngrok.io tcp
US 13.58.157.220:12342 8.tcp.ngrok.io tcp
US 13.58.157.220:12342 8.tcp.ngrok.io tcp
US 13.58.157.220:12342 8.tcp.ngrok.io tcp
US 13.58.157.220:12342 8.tcp.ngrok.io tcp
US 13.58.157.220:12342 8.tcp.ngrok.io tcp
US 13.58.157.220:12342 8.tcp.ngrok.io tcp
US 13.58.157.220:12342 8.tcp.ngrok.io tcp
US 8.8.8.8:53 8.tcp.ngrok.io udp
US 3.19.130.43:12342 8.tcp.ngrok.io tcp
US 3.19.130.43:12342 8.tcp.ngrok.io tcp

Files

memory/5108-0-0x00000000750CE000-0x00000000750CF000-memory.dmp

memory/5108-1-0x0000000000FF0000-0x0000000001292000-memory.dmp

memory/5108-2-0x00000000750C0000-0x0000000075870000-memory.dmp

memory/5108-3-0x00000000750C0000-0x0000000075870000-memory.dmp

memory/5108-4-0x00000000750C0000-0x0000000075870000-memory.dmp

memory/5108-5-0x000000000A470000-0x000000000A4EC000-memory.dmp

memory/5108-6-0x00000000750C0000-0x0000000075870000-memory.dmp

memory/5108-7-0x00000000750C0000-0x0000000075870000-memory.dmp

memory/5108-8-0x0000000006180000-0x0000000006724000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wODEMFASj5.exe

MD5 059302e210a714b3cebd8c6400d7d12e
SHA1 eed4e297cdffff9815bf456e4f237b699b33de6d
SHA256 7b49bca136184f784b52ca6499108288da623944a0a97eff19e3318364a0a999
SHA512 5ae9f86dc384be6d7acb085132846ef690d0e069f43837e8e9edb89558bfb8c3a5232e47332df10b79ee8df2e4e84c509386c5fbb9f8b5a7659ff8cacb1a4dcc

memory/3656-17-0x0000000070532000-0x0000000070533000-memory.dmp

memory/3656-18-0x0000000070530000-0x0000000070AE1000-memory.dmp

memory/3656-19-0x0000000070530000-0x0000000070AE1000-memory.dmp

memory/5108-20-0x00000000750C0000-0x0000000075870000-memory.dmp

memory/2396-30-0x0000000070530000-0x0000000070AE1000-memory.dmp

memory/3656-31-0x0000000070530000-0x0000000070AE1000-memory.dmp

memory/2396-32-0x0000000070530000-0x0000000070AE1000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win10v2004-20241007-en

Max time kernel

118s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe"

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5076 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 5076 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 5076 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 5076 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 5076 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 5076 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 5076 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 5076 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 5076 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 5076 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 5076 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 5076 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe

"C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe"

C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe

"C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe"

C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe

"C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
TR 185.227.139.18:80 185.227.139.18 tcp
TR 185.227.139.18:80 185.227.139.18 tcp
TR 185.227.139.18:80 185.227.139.18 tcp
US 8.8.8.8:53 18.139.227.185.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
TR 185.227.139.18:80 185.227.139.18 tcp

Files

memory/5076-0-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

memory/5076-1-0x0000000000990000-0x0000000000A60000-memory.dmp

memory/5076-2-0x0000000005980000-0x0000000005F24000-memory.dmp

memory/5076-3-0x0000000005470000-0x0000000005502000-memory.dmp

memory/5076-4-0x0000000005510000-0x00000000055AC000-memory.dmp

memory/5076-5-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/5076-6-0x0000000005460000-0x000000000546A000-memory.dmp

memory/5076-7-0x0000000006870000-0x0000000006884000-memory.dmp

memory/5076-8-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

memory/5076-9-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/5076-10-0x0000000008F80000-0x0000000008FEE000-memory.dmp

memory/5076-11-0x000000000B760000-0x000000000B792000-memory.dmp

memory/3956-12-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/3956-14-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/3956-16-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/5076-17-0x0000000074EE0000-0x0000000075690000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1045960512-3948844814-3059691613-1000\0f5007522459c86e95ffcc62f32308f1_a4172161-d53d-48af-8f36-a00b057e74d4

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1045960512-3948844814-3059691613-1000\0f5007522459c86e95ffcc62f32308f1_a4172161-d53d-48af-8f36-a00b057e74d4

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

memory/3956-36-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/3956-44-0x0000000000400000-0x00000000004A2000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win7-20241023-en

Max time kernel

141s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Nanocore family

nanocore

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 84.200.69.80 N/A N/A
Destination IP 84.200.69.80 N/A N/A
Destination IP 84.200.70.40 N/A N/A
Destination IP 84.200.69.80 N/A N/A
Destination IP 84.200.70.40 N/A N/A
Destination IP 84.200.70.40 N/A N/A
Destination IP 84.200.70.40 N/A N/A
Destination IP 84.200.69.80 N/A N/A
Destination IP 84.200.70.40 N/A N/A
Destination IP 84.200.69.80 N/A N/A
Destination IP 84.200.69.80 N/A N/A
Destination IP 84.200.70.40 N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Subsystem = "C:\\Program Files (x86)\\SCSI Subsystem\\scsiss.exe" C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\SCSI Subsystem\scsiss.exe C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A
File opened for modification C:\Program Files (x86)\SCSI Subsystem\scsiss.exe C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe

"C:\Users\Admin\AppData\Local\Temp\304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "SCSI Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB490.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "SCSI Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB51D.tmp"

Network

Country Destination Domain Proto
US 24.101.234.141:4782 tcp
US 24.101.234.141:4782 tcp
US 24.101.234.141:4782 tcp
DE 84.200.69.80:53 mcserversetup.serveminecraft.net udp
DE 84.200.70.40:53 mcserversetup.serveminecraft.net udp
US 8.8.8.8:53 mcserversetup.serveminecraft.net udp
DE 84.200.69.80:53 mcserversetup.serveminecraft.net udp
DE 84.200.70.40:53 mcserversetup.serveminecraft.net udp
DE 84.200.69.80:53 mcserversetup.serveminecraft.net udp
DE 84.200.70.40:53 mcserversetup.serveminecraft.net udp
US 24.101.234.141:4782 tcp
US 24.101.234.141:4782 tcp
US 24.101.234.141:4782 tcp
DE 84.200.69.80:53 mcserversetup.serveminecraft.net udp
DE 84.200.70.40:53 mcserversetup.serveminecraft.net udp
DE 84.200.69.80:53 mcserversetup.serveminecraft.net udp
DE 84.200.70.40:53 mcserversetup.serveminecraft.net udp
DE 84.200.69.80:53 mcserversetup.serveminecraft.net udp
DE 84.200.70.40:53 mcserversetup.serveminecraft.net udp
US 24.101.234.141:4782 tcp
US 24.101.234.141:4782 tcp

Files

memory/2092-0-0x0000000074371000-0x0000000074372000-memory.dmp

memory/2092-1-0x0000000074370000-0x000000007491B000-memory.dmp

memory/2092-2-0x0000000074370000-0x000000007491B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB490.tmp

MD5 f8d94348e9e0b4a67b3be7e5c3e4924f
SHA1 b70034fe263152e267998fbed76c06a7e0daf83e
SHA256 8049a27b744d605b123011957117d752424135d35e8e3340d2b9b05164fb73f8
SHA512 78e9c58bab031123f54057d0bbd9c7dccf8da6e84bd9e32d6b4b0ecbd7737899a4f7a6f27999e38cdfc17b8c26c2ffad2dfde73b72cd38893ceddf7aad287b88

C:\Users\Admin\AppData\Local\Temp\tmpB51D.tmp

MD5 bd110f9fc6c1a842f1d9b269010b0611
SHA1 ef71c062902602faef9b66dcd1cfc9fe5baaf389
SHA256 8135c4e4eeaa741f752c0ab8f4ee33e3bb8a0cac5923812234f2e5177d50eb5b
SHA512 b8a7943a3126880b26407800bbdad5402c5b0e2aa106e7dbbb35d0cb145ca9de114401573a6aa66042a2e13674cfbcc2981d66b813f9b923fff5302210afba1f

memory/2092-10-0x0000000074370000-0x000000007491B000-memory.dmp

memory/2092-11-0x0000000074370000-0x000000007491B000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win10v2004-20241007-en

Max time kernel

141s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe"

Signatures

AsyncRat

rat asyncrat

Asyncrat family

asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3776 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe C:\Windows\SysWOW64\cmd.exe
PID 3776 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe C:\Windows\SysWOW64\cmd.exe
PID 3776 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe C:\Windows\SysWOW64\cmd.exe
PID 3776 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe C:\Windows\SysWOW64\cmd.exe
PID 3776 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe C:\Windows\SysWOW64\cmd.exe
PID 3776 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe C:\Windows\SysWOW64\cmd.exe
PID 3080 wrote to memory of 2908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3080 wrote to memory of 2908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3080 wrote to memory of 2908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4956 wrote to memory of 444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4956 wrote to memory of 444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4956 wrote to memory of 444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4956 wrote to memory of 1440 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe
PID 4956 wrote to memory of 1440 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe
PID 4956 wrote to memory of 1440 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe

Processes

C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe

"C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "12376w8q09dq" /tr '"C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA316.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "12376w8q09dq" /tr '"C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe

"C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 206.123.141.239:7777 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
US 206.123.141.239:7777 tcp
US 206.123.141.239:7777 tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 206.123.141.239:7777 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 206.123.141.239:7777 tcp
US 206.123.141.239:7777 tcp

Files

memory/3776-0-0x00000000752CE000-0x00000000752CF000-memory.dmp

memory/3776-1-0x0000000000950000-0x0000000000962000-memory.dmp

memory/3776-2-0x00000000752C0000-0x0000000075A70000-memory.dmp

memory/3776-3-0x0000000005340000-0x00000000053A6000-memory.dmp

memory/3776-4-0x0000000005790000-0x000000000582C000-memory.dmp

memory/3776-9-0x00000000752C0000-0x0000000075A70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpA316.tmp.bat

MD5 174e8b5874cb0d5f5e19d6c55e17e5b5
SHA1 c64fc4170fd3169998ba09e47d54242c87be4a2c
SHA256 6e0cbb568ada1d53373be5ec20544a1aad40052158444b66e93de2bc5503270c
SHA512 92c0bf683ae13f0d816178fc1126d198c7a9d479e1a47906838a87313910aad2dd38ba0e23699be875200ba6eea11f675a85a31b05ac6b2ad824c8a73c1483ec

C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe

MD5 5af5a9087ecf42eb83fb358d49b06e92
SHA1 0d4a5c5d90e6306c476036ca097a01a17b4295db
SHA256 878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453
SHA512 d0608f648dd26b81d262741c373737dba3bfeb1508f86d8c448ec634a78bd9f86f52961d22cf027418c5012f2f7388928480495003dfeac7b94deb590bb7d22c

memory/1440-14-0x0000000075230000-0x00000000759E0000-memory.dmp

memory/1440-15-0x0000000075230000-0x00000000759E0000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win7-20240903-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe"

Signatures

Network Service Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\arp.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\arp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe

"C:\Users\Admin\AppData\Local\Temp\15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe"

C:\Windows\SysWOW64\arp.exe

"C:\Windows\System32\arp.exe" -a

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.auth.gg udp
US 172.67.164.78:443 api.auth.gg tcp

Files

memory/304-0-0x00000000742EE000-0x00000000742EF000-memory.dmp

memory/304-1-0x00000000012C0000-0x00000000012D2000-memory.dmp

memory/304-2-0x00000000742E0000-0x00000000749CE000-memory.dmp

memory/304-3-0x00000000742E0000-0x00000000749CE000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Redline family

redline

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Sectoprat family

sectoprat

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4736 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
PID 4736 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
PID 4736 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
PID 4736 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
PID 4736 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
PID 4736 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
PID 4736 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
PID 4736 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe

Processes

C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe

"C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe"

C:\Users\Admin\AppData\Local\Temp\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe

"{path}"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 105.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 newlife957.duckdns.org udp
IT 195.178.120.157:7225 newlife957.duckdns.org tcp
IT 195.178.120.157:7225 newlife957.duckdns.org tcp
IT 195.178.120.157:7225 newlife957.duckdns.org tcp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
IT 195.178.120.157:7225 newlife957.duckdns.org tcp
IT 195.178.120.157:7225 newlife957.duckdns.org tcp
IT 195.178.120.157:7225 newlife957.duckdns.org tcp

Files

memory/4736-0-0x00000000744CE000-0x00000000744CF000-memory.dmp

memory/4736-1-0x0000000000710000-0x00000000007F0000-memory.dmp

memory/4736-2-0x0000000005880000-0x0000000005E24000-memory.dmp

memory/4736-3-0x00000000051D0000-0x0000000005262000-memory.dmp

memory/4736-4-0x00000000744C0000-0x0000000074C70000-memory.dmp

memory/4736-5-0x0000000005290000-0x000000000529A000-memory.dmp

memory/4736-7-0x0000000006770000-0x0000000006778000-memory.dmp

memory/4736-6-0x0000000006800000-0x000000000689C000-memory.dmp

memory/4736-8-0x00000000744CE000-0x00000000744CF000-memory.dmp

memory/4736-9-0x00000000744C0000-0x0000000074C70000-memory.dmp

memory/4736-10-0x00000000069C0000-0x0000000006A46000-memory.dmp

memory/4736-11-0x000000000AF20000-0x000000000AF58000-memory.dmp

memory/4344-12-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe.log

MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

memory/4344-17-0x00000000744C0000-0x0000000074C70000-memory.dmp

memory/4736-18-0x00000000744C0000-0x0000000074C70000-memory.dmp

memory/4344-16-0x0000000005860000-0x0000000005872000-memory.dmp

memory/4344-15-0x0000000005E50000-0x0000000006468000-memory.dmp

memory/4344-19-0x00000000058C0000-0x00000000058FC000-memory.dmp

memory/4344-20-0x00000000744C0000-0x0000000074C70000-memory.dmp

memory/4344-21-0x0000000005950000-0x000000000599C000-memory.dmp

memory/4344-22-0x0000000005B70000-0x0000000005C7A000-memory.dmp

memory/4344-23-0x00000000744C0000-0x0000000074C70000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win7-20240708-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe"

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 824 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 824 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 824 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 824 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 824 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 824 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 824 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 824 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 824 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
PID 824 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe

"C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe"

C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe

"C:\Users\Admin\AppData\Local\Temp\922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe"

Network

Country Destination Domain Proto
TR 185.227.139.18:80 185.227.139.18 tcp
TR 185.227.139.18:80 185.227.139.18 tcp
TR 185.227.139.18:80 185.227.139.18 tcp
TR 185.227.139.18:80 185.227.139.18 tcp

Files

memory/824-0-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

memory/824-1-0x0000000000D80000-0x0000000000E50000-memory.dmp

memory/824-2-0x0000000074CB0000-0x000000007539E000-memory.dmp

memory/824-3-0x00000000001F0000-0x0000000000204000-memory.dmp

memory/824-4-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

memory/824-5-0x0000000074CB0000-0x000000007539E000-memory.dmp

memory/824-6-0x0000000004A20000-0x0000000004A8E000-memory.dmp

memory/824-7-0x0000000000450000-0x0000000000482000-memory.dmp

memory/2600-9-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2600-19-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2600-21-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2600-22-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2600-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2600-16-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2600-14-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2600-12-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2600-10-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/824-23-0x0000000074CB0000-0x000000007539E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

memory/2600-42-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2600-51-0x0000000000400000-0x00000000004A2000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win7-20240903-en

Max time kernel

148s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b67bc3d9578e037d7cf91795a1015008d2ee5629c5b8089a16ae3d3bac92168f.exe"

Signatures

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8e4c2eb5abb39c5a0a944c9995d0ce64.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8e4c2eb5abb39c5a0a944c9995d0ce64.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\8e4c2eb5abb39c5a0a944c9995d0ce64 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8e4c2eb5abb39c5a0a944c9995d0ce64 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b67bc3d9578e037d7cf91795a1015008d2ee5629c5b8089a16ae3d3bac92168f.exe

"C:\Users\Admin\AppData\Local\Temp\b67bc3d9578e037d7cf91795a1015008d2ee5629c5b8089a16ae3d3bac92168f.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Windows\system32\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE

Network

Country Destination Domain Proto
US 26.150.193.200:1604 tcp
US 26.150.193.200:1604 tcp
US 26.150.193.200:1604 tcp
US 26.150.193.200:1604 tcp
US 26.150.193.200:1604 tcp
US 26.150.193.200:1604 tcp

Files

memory/276-0-0x000007FEF58FE000-0x000007FEF58FF000-memory.dmp

memory/276-1-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmp

memory/276-2-0x0000000000430000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 4c8326862379b2d2d6fbc47a8c33777b
SHA1 3d5d4d3f340ca4c1e004fa25588cff11f5034e3b
SHA256 b67bc3d9578e037d7cf91795a1015008d2ee5629c5b8089a16ae3d3bac92168f
SHA512 3cc74d73d8548a9a16d4cb3921c40a0641d5c0818c81d494f6fff5b16d9389c31da825dc9e1f3fa81d8b2a72b659a51c1f57047aac98cb56f1234bfab99d02e7

memory/276-9-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmp

memory/2292-10-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmp

memory/276-8-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmp

memory/2292-13-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmp

memory/2292-14-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-11-07 16:29

Reported

2024-11-07 16:32

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b67bc3d9578e037d7cf91795a1015008d2ee5629c5b8089a16ae3d3bac92168f.exe"

Signatures

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b67bc3d9578e037d7cf91795a1015008d2ee5629c5b8089a16ae3d3bac92168f.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8e4c2eb5abb39c5a0a944c9995d0ce64.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8e4c2eb5abb39c5a0a944c9995d0ce64.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8e4c2eb5abb39c5a0a944c9995d0ce64 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8e4c2eb5abb39c5a0a944c9995d0ce64 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\SYSTEM32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\SYSTEM32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\SYSTEM32\netsh.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b67bc3d9578e037d7cf91795a1015008d2ee5629c5b8089a16ae3d3bac92168f.exe

"C:\Users\Admin\AppData\Local\Temp\b67bc3d9578e037d7cf91795a1015008d2ee5629c5b8089a16ae3d3bac92168f.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Windows\SYSTEM32\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 26.150.193.200:1604 tcp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 26.150.193.200:1604 tcp
US 26.150.193.200:1604 tcp
US 26.150.193.200:1604 tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 26.150.193.200:1604 tcp
US 26.150.193.200:1604 tcp

Files

memory/4108-0-0x00007FFA57950000-0x00007FFA57B45000-memory.dmp

memory/4108-2-0x00007FFA57950000-0x00007FFA57B45000-memory.dmp

memory/4108-1-0x00007FFA57950000-0x00007FFA57B45000-memory.dmp

memory/4108-3-0x000000001B290000-0x000000001B336000-memory.dmp

memory/4108-4-0x0000000000A10000-0x0000000000A1E000-memory.dmp

memory/4108-5-0x000000001BF20000-0x000000001C3EE000-memory.dmp

memory/4108-6-0x00007FFA57950000-0x00007FFA57B45000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 4c8326862379b2d2d6fbc47a8c33777b
SHA1 3d5d4d3f340ca4c1e004fa25588cff11f5034e3b
SHA256 b67bc3d9578e037d7cf91795a1015008d2ee5629c5b8089a16ae3d3bac92168f
SHA512 3cc74d73d8548a9a16d4cb3921c40a0641d5c0818c81d494f6fff5b16d9389c31da825dc9e1f3fa81d8b2a72b659a51c1f57047aac98cb56f1234bfab99d02e7

memory/740-21-0x00007FFA57950000-0x00007FFA57B45000-memory.dmp

memory/4108-20-0x00007FFA57950000-0x00007FFA57B45000-memory.dmp

memory/4108-19-0x00007FFA57950000-0x00007FFA57B45000-memory.dmp

memory/740-24-0x00007FFA57950000-0x00007FFA57B45000-memory.dmp

memory/740-25-0x000000001DFE0000-0x000000001E07C000-memory.dmp

memory/740-26-0x00000000029A0000-0x00000000029A8000-memory.dmp