Malware Analysis Report

2024-11-13 19:29

Sample ID 241108-a53v3stpgq
Target 6d42b89a86c2e85f79f6652889209d14c641cde35d7a8c43fc7ea6a657f80957
SHA256 6d42b89a86c2e85f79f6652889209d14c641cde35d7a8c43fc7ea6a657f80957
Tags
nullmixer socelars aspackv2 discovery dropper execution stealer vmprotect
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6d42b89a86c2e85f79f6652889209d14c641cde35d7a8c43fc7ea6a657f80957

Threat Level: Known bad

The file 6d42b89a86c2e85f79f6652889209d14c641cde35d7a8c43fc7ea6a657f80957 was found to be: Known bad.

Malicious Activity Summary

nullmixer socelars aspackv2 discovery dropper execution stealer vmprotect

Socelars

Socelars payload

Nullmixer family

NullMixer

Socelars family

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

VMProtect packed file

ASPack v2.12-2.42

AutoIT Executable

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-08 00:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-08 00:48

Reported

2024-11-08 00:51

Platform

win7-20241010-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe"

Signatures

NullMixer

dropper nullmixer

Nullmixer family

nullmixer

Socelars

stealer socelars

Socelars family

socelars

Socelars payload

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\setup_installer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2876 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 2876 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 2876 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 2876 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 2876 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 2876 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 2876 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 2332 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe
PID 2332 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe
PID 2332 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe
PID 2332 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe
PID 2332 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe
PID 2332 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe
PID 2332 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe
PID 2708 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe

"C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe"

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe

"C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 6242487ebee69_Mon2360fbbe475.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 6242487fd82aa_Mon2391599e.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 62424880dba59_Mon2373ae22.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 62424882a2d43_Mon2366e91c07.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248845c537_Mon23d60fef.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248871e3ed_Mon2348d8b4e.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bae0b4f_Mon2315c1392c.exe /mixtwo

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bc6d13c_Mon235f07b88ae.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bd917de_Mon2341a56212.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bf51749_Mon23fd163f29.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248c03c802_Mon23cf6fc42c67.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248c2870d6_Mon23e0b3b0.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248c3cb9af_Mon237bf16061.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\setup_installer.exe

MD5 e71bedc46122099d570715a1a7114d29
SHA1 b54aaf5dc06da686481e1801e1d7c84b731034c9
SHA256 bd2d33ab5f78ad9f2d7bb562dd217022694b7b737e131ee4e8ed6abc3610e3f8
SHA512 4435f7735acb93666960790f8dfebc0a1374121f6295cd638eeb4c1d80199d0422d982c539fb1ebaec22b22baab8d514725a81427c7bf2ec618c911e42cefb2f

\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\setup_install.exe

MD5 83c766fb0a8d71f559d79d600ea05297
SHA1 8f4e1868bef695539f2b7cb83b3e336e959f3087
SHA256 3572b5d2013141cee24aa859fdd60398ef7d1c4ac40d2c080ecdb12129cb70ee
SHA512 1a49b39dc87ef672308b4a8bab0d1f9f9c0c51296b46f5cc46fa39312f94edf7f2bf1936367e0f7dc75c3ecb052558a75ced42189b4a4b218e8fe715ab163d88

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\libwinpthread-1.dll

MD5 1e0d62c34ff2e649ebc5c372065732ee
SHA1 fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA512 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

memory/2708-65-0x000000006B280000-0x000000006B2A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\libcurl.dll

MD5 d09be1f47fd6b827c81a4812b4f7296f
SHA1 028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA256 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\libstdc++-6.dll

MD5 5e279950775baae5fea04d2cc4526bcc
SHA1 8aef1e10031c3629512c43dd8b0b5d9060878453
SHA256 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

memory/2708-72-0x000000006FE40000-0x000000006FFC6000-memory.dmp

\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\libgcc_s_dw2-1.dll

MD5 9aec524b616618b0d3d00b27b6f51da1
SHA1 64264300801a353db324d11738ffed876550e1d3
SHA256 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA512 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

memory/2708-68-0x000000006B440000-0x000000006B4CF000-memory.dmp

\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\libcurlpp.dll

MD5 e6e578373c2e416289a8da55f1dc5e8e
SHA1 b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA256 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA512 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

memory/2708-85-0x000000006B280000-0x000000006B2A6000-memory.dmp

memory/2708-84-0x000000006B280000-0x000000006B2A6000-memory.dmp

memory/2708-83-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/2708-82-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/2708-81-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/2708-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/2708-79-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/2708-78-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/2708-77-0x000000006B440000-0x000000006B4CF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\6242487ebee69_Mon2360fbbe475.exe

MD5 98c3385d313ae6d4cf1f192830f6b555
SHA1 31c572430094e9adbf5b7647c3621b2e8dfa7fe8
SHA256 4b2e2adafc390f535254a650a90e6a559fb3613a9f13ce648a024c078fcf40be
SHA512 fdd0406ef1abee43877c2ab2be9879e7232e773f7dac48f38a883b14306907c82110c712065a290bafac3cc8b0f4c0a13694847ad60a50a2b87e6aed2fd73aff

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\624248bd917de_Mon2341a56212.exe

MD5 0913c141934828228be4bee6b08cadfe
SHA1 caf2f7ea94afc62792d91c1f2c1b99c05b1a2a1f
SHA256 3fa1c49f7dd6657c195dc68c13b50a0d7e2f3ec641f7108ffb3e041ea3713c95
SHA512 29bece87e4080db7098115f568dc9f5c25206147020d94438bff7ef5f17a918fae8a7546932e310648bf31be27bc4a29edf3e49051dd6e72aa9cf82e0ecd254b

memory/2708-107-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/2708-106-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/2708-105-0x000000006B280000-0x000000006B2A6000-memory.dmp

memory/2708-103-0x000000006EB40000-0x000000006EB63000-memory.dmp

memory/2708-100-0x0000000064940000-0x0000000064959000-memory.dmp

memory/2708-99-0x0000000000400000-0x000000000051C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\624248c3cb9af_Mon237bf16061.exe

MD5 815d3b5cdc4aea7e8c8fe78434061694
SHA1 40aa8a3583d659aa86edf78db14f03917db6dda8
SHA256 226d6fc908bee0a523a09d1912f0b6b6958173ccd77997d45121d9091a7199b4
SHA512 b8cc6f302f86cbf3eea3c95ceda9302f543ebb6ed3cbbe5c038a1417a1536345cd44f8e89ec48579bc699d71c994eccd1dcbd43dca669931377f738072c2f95a

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\624248c03c802_Mon23cf6fc42c67.exe

MD5 79c79760259bd18332ca17a05dab283d
SHA1 b9afed2134363447d014b85c37820c5a44f33722
SHA256 e6eb127214bbef16c7372fbe85e1ba453f7aceee241398d2a8e0ec115c3625d3
SHA512 a4270de42d09caa42280b1a7538dc4e0897f17421987927ac8b37fde7e44f77feb9ce1386ffd594fe6262ebb817c2df5a2c20a4adb4b0261eae5d0b6a007aa06

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\624248bae0b4f_Mon2315c1392c.exe

MD5 dc3a42af98906ce86ad0e67ce7153b45
SHA1 83141ef3b732302806b27e1bd4332d2964418f07
SHA256 399d9c5dc78b7696e0984cc265c6b142d70949694e86a8e38474aedcda4ff6f1
SHA512 f3df4c782941bd130d302d63323edaccddf59a1cbad10ca3262118c948c78df6dc520bff67ec26918c31b575dce6580d72da0d6c170cabe34c98f52acadb9cb6

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\624248845c537_Mon23d60fef.exe

MD5 5bc6b4fcbdb2edbd8ca492b9ba9059f9
SHA1 6ad0140809c7f71769bf7bdd652442ffc4c2bc35
SHA256 f0d2a8fa7d23f6546e377a0c6dc9019cf513d6474afc462bba517c82e5c1d4b8
SHA512 953cb941a5fc7ea44b36bf70b984990a5d0b6c2b4cb614dcedbf254dbb1b6940d345dd8531ef1f489b0d467ac98208533c8b94e44a53c931d4e9bc91f5af2718

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\62424880dba59_Mon2373ae22.exe

MD5 81cf5e614873508b9ecba216112c276b
SHA1 cb3115f68ffe4f428fc141f113dff477530f17fb
SHA256 fae5984ff3106551dddee32196332ab4b9cabfe40476b80dd5aa8e1c9fcba413
SHA512 48fba232d56c6acd0a3e97a64d096a6782000cc4d6d34f7d2379a54e6339bf373c14e95ba966a1fd8ecc05582cfad4e9dea6d61bb5492a570fdc1f637db7d29f

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\624248c2870d6_Mon23e0b3b0.exe

MD5 9e7d2e1b5aac4613d906efa021b571a1
SHA1 b9665c6248bc56e1cbb8797d27aa6b0db5ba70f1
SHA256 52c5dea41a299961b4776d3794864ce84e9d51ac1858dd6afb395e0a638bc666
SHA512 5dfd847513b94feb7df2569518c5abf56723cf165a424e2ebfea9fb4b5d2d70a9d0a962d5f7c7f68b3fd9a005c7aeb1bf20d9c7bfb1ee7ed0a23455d78516549

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\624248bf51749_Mon23fd163f29.exe

MD5 98362f1952eb1349f17f77bb70a9fbcc
SHA1 e8a2273215c3cea3100fa40536b0791fea27af8f
SHA256 9aa8aeb0262bc901878bda3a41b6ac7f727f1c3fe4e7bb9afa0000c371750321
SHA512 6faceb7a7d6c0b3d7ebd8afbd2e4dcfb95a6407bb4acf1012d50f462713b8f34adf51c2dc7f82281a6b84dfcb8bc0cbea68318f12ad9ad95558b9361500e0679

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\624248bc6d13c_Mon235f07b88ae.exe

MD5 a128f3490a3d62ec1f7c969771c9cb52
SHA1 73f71a45f68e317222ac704d30319fcbecdb8476
SHA256 4040769cb6796be3af8bd8b2c9d4be701155760766fddbd015b0bcb2b4fca52a
SHA512 ccf34b78a577bc12542e774574d21f3673710868705bf2c0ecdf6ce3414406ec63d5f65e3ff125f65e749a54d64e642492ee53d91a04d309228e2a73d7ab0a19

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\624248871e3ed_Mon2348d8b4e.exe

MD5 327366acede3d33a1d9b93396aee3eb9
SHA1 3df53825a46673b9fb97e68b2372f9dc27437b7f
SHA256 12183f88314a86429c1685dacb2cd7f87d1eac7094d52a19a92b45432800e051
SHA512 a7ce948ede1b8d02972322bb88498d6607dce39fd215df37ca58f016f5658436a556ec2425207f2434db7728b1ad1c19c7ec05110d82c094525c4bae7bf4894f

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\62424882a2d43_Mon2366e91c07.exe

MD5 52142a360efa5a88aa469593f3961bb4
SHA1 bb06f4b274789d3998ea3cbdc7d2056d4a99950f
SHA256 3a53d2f99cf9562803815dc1df898557919db19d54956b53840cbcf89c696dad
SHA512 de1e51dfb2a06bd0ad3142f7b2f33d78f5c2b07d0effc23074011d76a12a0d0591ea8a1b4fe753cf1482f8a438d2927fb92c4fb7a184029f35721e8b3f7fb5cc

C:\Users\Admin\AppData\Local\Temp\7zSC19CD5A6\6242487fd82aa_Mon2391599e.exe

MD5 7bdeeadd41822f3c024fba58b16e2cdc
SHA1 13a3319b0545e7ff1d17f678093db9f8785bba5a
SHA256 d46ceb96d549e329a60607d9d4acca2d62560f8daaaa5fc60b50823567b9c24f
SHA512 1942f19d694616c56f874fc8df73da26beed8f290cf619d9f8443a03289c5d36ae830d1f6bf0e8adf79eddf062c9e48373677e0a2d593ee1666fae5148a3e4ad

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-08 00:48

Reported

2024-11-08 00:51

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe"

Signatures

NullMixer

dropper nullmixer

Nullmixer family

nullmixer

Socelars

stealer socelars

Socelars family

socelars

Socelars payload

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\setup_installer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\setup_installer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2716 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 2716 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 2716 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 1784 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe
PID 1784 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe
PID 1784 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe
PID 3172 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 3508 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3508 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3508 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe

"C:\Users\Admin\AppData\Local\Temp\96b2519e5fb8dba738fa1abc23712b589d0a06ecdb6690045c769ab52420bd0a.exe"

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe

"C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 6242487ebee69_Mon2360fbbe475.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 6242487fd82aa_Mon2391599e.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 62424880dba59_Mon2373ae22.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 62424882a2d43_Mon2366e91c07.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248845c537_Mon23d60fef.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248871e3ed_Mon2348d8b4e.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bae0b4f_Mon2315c1392c.exe /mixtwo

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bc6d13c_Mon235f07b88ae.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bd917de_Mon2341a56212.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bf51749_Mon23fd163f29.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248c03c802_Mon23cf6fc42c67.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248c2870d6_Mon23e0b3b0.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248c3cb9af_Mon237bf16061.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 73.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

MD5 e71bedc46122099d570715a1a7114d29
SHA1 b54aaf5dc06da686481e1801e1d7c84b731034c9
SHA256 bd2d33ab5f78ad9f2d7bb562dd217022694b7b737e131ee4e8ed6abc3610e3f8
SHA512 4435f7735acb93666960790f8dfebc0a1374121f6295cd638eeb4c1d80199d0422d982c539fb1ebaec22b22baab8d514725a81427c7bf2ec618c911e42cefb2f

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\setup_install.exe

MD5 83c766fb0a8d71f559d79d600ea05297
SHA1 8f4e1868bef695539f2b7cb83b3e336e959f3087
SHA256 3572b5d2013141cee24aa859fdd60398ef7d1c4ac40d2c080ecdb12129cb70ee
SHA512 1a49b39dc87ef672308b4a8bab0d1f9f9c0c51296b46f5cc46fa39312f94edf7f2bf1936367e0f7dc75c3ecb052558a75ced42189b4a4b218e8fe715ab163d88

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\libcurl.dll

MD5 d09be1f47fd6b827c81a4812b4f7296f
SHA1 028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA256 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\libgcc_s_dw2-1.dll

MD5 9aec524b616618b0d3d00b27b6f51da1
SHA1 64264300801a353db324d11738ffed876550e1d3
SHA256 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA512 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\libstdc++-6.dll

MD5 5e279950775baae5fea04d2cc4526bcc
SHA1 8aef1e10031c3629512c43dd8b0b5d9060878453
SHA256 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

memory/3172-73-0x0000000064940000-0x0000000064959000-memory.dmp

memory/3172-76-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/3172-82-0x000000006B280000-0x000000006B2A6000-memory.dmp

memory/3172-102-0x000000006B280000-0x000000006B2A6000-memory.dmp

memory/3172-104-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/432-107-0x0000000005900000-0x0000000005F28000-memory.dmp

memory/432-106-0x0000000005200000-0x0000000005236000-memory.dmp

memory/432-108-0x0000000005F60000-0x0000000005F82000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3lwzexx5.i5w.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/432-120-0x00000000062E0000-0x0000000006634000-memory.dmp

memory/432-110-0x0000000006170000-0x00000000061D6000-memory.dmp

memory/432-121-0x00000000067C0000-0x00000000067DE000-memory.dmp

memory/432-122-0x0000000006810000-0x000000000685C000-memory.dmp

memory/432-109-0x0000000006100000-0x0000000006166000-memory.dmp

memory/3172-105-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/3172-103-0x0000000064940000-0x0000000064959000-memory.dmp

memory/3172-100-0x000000006EB40000-0x000000006EB63000-memory.dmp

memory/3172-96-0x0000000000400000-0x000000000051C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\624248c3cb9af_Mon237bf16061.exe

MD5 815d3b5cdc4aea7e8c8fe78434061694
SHA1 40aa8a3583d659aa86edf78db14f03917db6dda8
SHA256 226d6fc908bee0a523a09d1912f0b6b6958173ccd77997d45121d9091a7199b4
SHA512 b8cc6f302f86cbf3eea3c95ceda9302f543ebb6ed3cbbe5c038a1417a1536345cd44f8e89ec48579bc699d71c994eccd1dcbd43dca669931377f738072c2f95a

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\624248c2870d6_Mon23e0b3b0.exe

MD5 9e7d2e1b5aac4613d906efa021b571a1
SHA1 b9665c6248bc56e1cbb8797d27aa6b0db5ba70f1
SHA256 52c5dea41a299961b4776d3794864ce84e9d51ac1858dd6afb395e0a638bc666
SHA512 5dfd847513b94feb7df2569518c5abf56723cf165a424e2ebfea9fb4b5d2d70a9d0a962d5f7c7f68b3fd9a005c7aeb1bf20d9c7bfb1ee7ed0a23455d78516549

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\624248c03c802_Mon23cf6fc42c67.exe

MD5 79c79760259bd18332ca17a05dab283d
SHA1 b9afed2134363447d014b85c37820c5a44f33722
SHA256 e6eb127214bbef16c7372fbe85e1ba453f7aceee241398d2a8e0ec115c3625d3
SHA512 a4270de42d09caa42280b1a7538dc4e0897f17421987927ac8b37fde7e44f77feb9ce1386ffd594fe6262ebb817c2df5a2c20a4adb4b0261eae5d0b6a007aa06

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\624248bf51749_Mon23fd163f29.exe

MD5 98362f1952eb1349f17f77bb70a9fbcc
SHA1 e8a2273215c3cea3100fa40536b0791fea27af8f
SHA256 9aa8aeb0262bc901878bda3a41b6ac7f727f1c3fe4e7bb9afa0000c371750321
SHA512 6faceb7a7d6c0b3d7ebd8afbd2e4dcfb95a6407bb4acf1012d50f462713b8f34adf51c2dc7f82281a6b84dfcb8bc0cbea68318f12ad9ad95558b9361500e0679

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\624248bd917de_Mon2341a56212.exe

MD5 0913c141934828228be4bee6b08cadfe
SHA1 caf2f7ea94afc62792d91c1f2c1b99c05b1a2a1f
SHA256 3fa1c49f7dd6657c195dc68c13b50a0d7e2f3ec641f7108ffb3e041ea3713c95
SHA512 29bece87e4080db7098115f568dc9f5c25206147020d94438bff7ef5f17a918fae8a7546932e310648bf31be27bc4a29edf3e49051dd6e72aa9cf82e0ecd254b

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\624248bc6d13c_Mon235f07b88ae.exe

MD5 a128f3490a3d62ec1f7c969771c9cb52
SHA1 73f71a45f68e317222ac704d30319fcbecdb8476
SHA256 4040769cb6796be3af8bd8b2c9d4be701155760766fddbd015b0bcb2b4fca52a
SHA512 ccf34b78a577bc12542e774574d21f3673710868705bf2c0ecdf6ce3414406ec63d5f65e3ff125f65e749a54d64e642492ee53d91a04d309228e2a73d7ab0a19

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\624248bae0b4f_Mon2315c1392c.exe

MD5 dc3a42af98906ce86ad0e67ce7153b45
SHA1 83141ef3b732302806b27e1bd4332d2964418f07
SHA256 399d9c5dc78b7696e0984cc265c6b142d70949694e86a8e38474aedcda4ff6f1
SHA512 f3df4c782941bd130d302d63323edaccddf59a1cbad10ca3262118c948c78df6dc520bff67ec26918c31b575dce6580d72da0d6c170cabe34c98f52acadb9cb6

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\624248871e3ed_Mon2348d8b4e.exe

MD5 327366acede3d33a1d9b93396aee3eb9
SHA1 3df53825a46673b9fb97e68b2372f9dc27437b7f
SHA256 12183f88314a86429c1685dacb2cd7f87d1eac7094d52a19a92b45432800e051
SHA512 a7ce948ede1b8d02972322bb88498d6607dce39fd215df37ca58f016f5658436a556ec2425207f2434db7728b1ad1c19c7ec05110d82c094525c4bae7bf4894f

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\624248845c537_Mon23d60fef.exe

MD5 5bc6b4fcbdb2edbd8ca492b9ba9059f9
SHA1 6ad0140809c7f71769bf7bdd652442ffc4c2bc35
SHA256 f0d2a8fa7d23f6546e377a0c6dc9019cf513d6474afc462bba517c82e5c1d4b8
SHA512 953cb941a5fc7ea44b36bf70b984990a5d0b6c2b4cb614dcedbf254dbb1b6940d345dd8531ef1f489b0d467ac98208533c8b94e44a53c931d4e9bc91f5af2718

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\62424882a2d43_Mon2366e91c07.exe

MD5 52142a360efa5a88aa469593f3961bb4
SHA1 bb06f4b274789d3998ea3cbdc7d2056d4a99950f
SHA256 3a53d2f99cf9562803815dc1df898557919db19d54956b53840cbcf89c696dad
SHA512 de1e51dfb2a06bd0ad3142f7b2f33d78f5c2b07d0effc23074011d76a12a0d0591ea8a1b4fe753cf1482f8a438d2927fb92c4fb7a184029f35721e8b3f7fb5cc

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\62424880dba59_Mon2373ae22.exe

MD5 81cf5e614873508b9ecba216112c276b
SHA1 cb3115f68ffe4f428fc141f113dff477530f17fb
SHA256 fae5984ff3106551dddee32196332ab4b9cabfe40476b80dd5aa8e1c9fcba413
SHA512 48fba232d56c6acd0a3e97a64d096a6782000cc4d6d34f7d2379a54e6339bf373c14e95ba966a1fd8ecc05582cfad4e9dea6d61bb5492a570fdc1f637db7d29f

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\6242487fd82aa_Mon2391599e.exe

MD5 7bdeeadd41822f3c024fba58b16e2cdc
SHA1 13a3319b0545e7ff1d17f678093db9f8785bba5a
SHA256 d46ceb96d549e329a60607d9d4acca2d62560f8daaaa5fc60b50823567b9c24f
SHA512 1942f19d694616c56f874fc8df73da26beed8f290cf619d9f8443a03289c5d36ae830d1f6bf0e8adf79eddf062c9e48373677e0a2d593ee1666fae5148a3e4ad

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\6242487ebee69_Mon2360fbbe475.exe

MD5 98c3385d313ae6d4cf1f192830f6b555
SHA1 31c572430094e9adbf5b7647c3621b2e8dfa7fe8
SHA256 4b2e2adafc390f535254a650a90e6a559fb3613a9f13ce648a024c078fcf40be
SHA512 fdd0406ef1abee43877c2ab2be9879e7232e773f7dac48f38a883b14306907c82110c712065a290bafac3cc8b0f4c0a13694847ad60a50a2b87e6aed2fd73aff

memory/3172-81-0x000000006B280000-0x000000006B2A6000-memory.dmp

memory/3172-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/3172-79-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/3172-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/3172-77-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/3172-75-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/3172-74-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/3172-72-0x000000006494A000-0x000000006494F000-memory.dmp

memory/3172-71-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/3172-70-0x0000000000EF0000-0x0000000000F7F000-memory.dmp

memory/3172-69-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/3172-63-0x000000006B280000-0x000000006B2A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\libcurlpp.dll

MD5 e6e578373c2e416289a8da55f1dc5e8e
SHA1 b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA256 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA512 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

C:\Users\Admin\AppData\Local\Temp\7zS8F611AC7\libwinpthread-1.dll

MD5 1e0d62c34ff2e649ebc5c372065732ee
SHA1 fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA512 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

memory/432-135-0x0000000007790000-0x0000000007833000-memory.dmp

memory/432-134-0x0000000006D60000-0x0000000006D7E000-memory.dmp

memory/432-124-0x0000000070340000-0x000000007038C000-memory.dmp

memory/432-123-0x0000000006D80000-0x0000000006DB2000-memory.dmp

memory/432-136-0x0000000008130000-0x00000000087AA000-memory.dmp

memory/432-137-0x0000000007AF0000-0x0000000007B0A000-memory.dmp

memory/432-138-0x0000000007B70000-0x0000000007B7A000-memory.dmp

memory/432-139-0x0000000007D60000-0x0000000007DF6000-memory.dmp

memory/432-140-0x0000000007CF0000-0x0000000007D01000-memory.dmp

memory/432-141-0x0000000007D20000-0x0000000007D2E000-memory.dmp

memory/432-142-0x0000000007D30000-0x0000000007D44000-memory.dmp

memory/432-143-0x0000000007E20000-0x0000000007E3A000-memory.dmp

memory/432-144-0x0000000007E10000-0x0000000007E18000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-08 00:48

Reported

2024-11-08 00:51

Platform

win7-20241010-en

Max time kernel

13s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"

Signatures

NullMixer

dropper nullmixer

Nullmixer family

nullmixer

Socelars

stealer socelars

Socelars family

socelars

Socelars payload

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\setup_installer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2536 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe
PID 2536 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe
PID 2536 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe
PID 2536 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe
PID 2536 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe
PID 2536 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe
PID 2536 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe
PID 2752 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe

"C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 6242487ebee69_Mon2360fbbe475.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 6242487fd82aa_Mon2391599e.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 62424880dba59_Mon2373ae22.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 62424882a2d43_Mon2366e91c07.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248845c537_Mon23d60fef.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248871e3ed_Mon2348d8b4e.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bae0b4f_Mon2315c1392c.exe /mixtwo

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bc6d13c_Mon235f07b88ae.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bd917de_Mon2341a56212.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bf51749_Mon23fd163f29.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248c03c802_Mon23cf6fc42c67.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248c2870d6_Mon23e0b3b0.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248c3cb9af_Mon237bf16061.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\setup_install.exe

MD5 83c766fb0a8d71f559d79d600ea05297
SHA1 8f4e1868bef695539f2b7cb83b3e336e959f3087
SHA256 3572b5d2013141cee24aa859fdd60398ef7d1c4ac40d2c080ecdb12129cb70ee
SHA512 1a49b39dc87ef672308b4a8bab0d1f9f9c0c51296b46f5cc46fa39312f94edf7f2bf1936367e0f7dc75c3ecb052558a75ced42189b4a4b218e8fe715ab163d88

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\libwinpthread-1.dll

MD5 1e0d62c34ff2e649ebc5c372065732ee
SHA1 fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA512 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\libcurlpp.dll

MD5 e6e578373c2e416289a8da55f1dc5e8e
SHA1 b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA256 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA512 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

memory/2752-54-0x000000006B280000-0x000000006B2A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\libcurl.dll

MD5 d09be1f47fd6b827c81a4812b4f7296f
SHA1 028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA256 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

memory/2752-58-0x000000006B440000-0x000000006B4CF000-memory.dmp

\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\libgcc_s_dw2-1.dll

MD5 9aec524b616618b0d3d00b27b6f51da1
SHA1 64264300801a353db324d11738ffed876550e1d3
SHA256 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA512 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\libstdc++-6.dll

MD5 5e279950775baae5fea04d2cc4526bcc
SHA1 8aef1e10031c3629512c43dd8b0b5d9060878453
SHA256 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

memory/2752-71-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/2752-70-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/2752-76-0x0000000064940000-0x0000000064959000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\624248bd917de_Mon2341a56212.exe

MD5 0913c141934828228be4bee6b08cadfe
SHA1 caf2f7ea94afc62792d91c1f2c1b99c05b1a2a1f
SHA256 3fa1c49f7dd6657c195dc68c13b50a0d7e2f3ec641f7108ffb3e041ea3713c95
SHA512 29bece87e4080db7098115f568dc9f5c25206147020d94438bff7ef5f17a918fae8a7546932e310648bf31be27bc4a29edf3e49051dd6e72aa9cf82e0ecd254b

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\624248c03c802_Mon23cf6fc42c67.exe

MD5 79c79760259bd18332ca17a05dab283d
SHA1 b9afed2134363447d014b85c37820c5a44f33722
SHA256 e6eb127214bbef16c7372fbe85e1ba453f7aceee241398d2a8e0ec115c3625d3
SHA512 a4270de42d09caa42280b1a7538dc4e0897f17421987927ac8b37fde7e44f77feb9ce1386ffd594fe6262ebb817c2df5a2c20a4adb4b0261eae5d0b6a007aa06

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\624248bae0b4f_Mon2315c1392c.exe

MD5 dc3a42af98906ce86ad0e67ce7153b45
SHA1 83141ef3b732302806b27e1bd4332d2964418f07
SHA256 399d9c5dc78b7696e0984cc265c6b142d70949694e86a8e38474aedcda4ff6f1
SHA512 f3df4c782941bd130d302d63323edaccddf59a1cbad10ca3262118c948c78df6dc520bff67ec26918c31b575dce6580d72da0d6c170cabe34c98f52acadb9cb6

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\624248845c537_Mon23d60fef.exe

MD5 5bc6b4fcbdb2edbd8ca492b9ba9059f9
SHA1 6ad0140809c7f71769bf7bdd652442ffc4c2bc35
SHA256 f0d2a8fa7d23f6546e377a0c6dc9019cf513d6474afc462bba517c82e5c1d4b8
SHA512 953cb941a5fc7ea44b36bf70b984990a5d0b6c2b4cb614dcedbf254dbb1b6940d345dd8531ef1f489b0d467ac98208533c8b94e44a53c931d4e9bc91f5af2718

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\62424880dba59_Mon2373ae22.exe

MD5 81cf5e614873508b9ecba216112c276b
SHA1 cb3115f68ffe4f428fc141f113dff477530f17fb
SHA256 fae5984ff3106551dddee32196332ab4b9cabfe40476b80dd5aa8e1c9fcba413
SHA512 48fba232d56c6acd0a3e97a64d096a6782000cc4d6d34f7d2379a54e6339bf373c14e95ba966a1fd8ecc05582cfad4e9dea6d61bb5492a570fdc1f637db7d29f

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\6242487ebee69_Mon2360fbbe475.exe

MD5 98c3385d313ae6d4cf1f192830f6b555
SHA1 31c572430094e9adbf5b7647c3621b2e8dfa7fe8
SHA256 4b2e2adafc390f535254a650a90e6a559fb3613a9f13ce648a024c078fcf40be
SHA512 fdd0406ef1abee43877c2ab2be9879e7232e773f7dac48f38a883b14306907c82110c712065a290bafac3cc8b0f4c0a13694847ad60a50a2b87e6aed2fd73aff

memory/2752-98-0x0000000064940000-0x0000000064959000-memory.dmp

memory/2752-99-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/2752-97-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/2752-96-0x000000006B280000-0x000000006B2A6000-memory.dmp

memory/2752-94-0x000000006EB40000-0x000000006EB63000-memory.dmp

memory/2752-90-0x0000000000400000-0x000000000051C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\624248c3cb9af_Mon237bf16061.exe

MD5 815d3b5cdc4aea7e8c8fe78434061694
SHA1 40aa8a3583d659aa86edf78db14f03917db6dda8
SHA256 226d6fc908bee0a523a09d1912f0b6b6958173ccd77997d45121d9091a7199b4
SHA512 b8cc6f302f86cbf3eea3c95ceda9302f543ebb6ed3cbbe5c038a1417a1536345cd44f8e89ec48579bc699d71c994eccd1dcbd43dca669931377f738072c2f95a

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\624248c2870d6_Mon23e0b3b0.exe

MD5 9e7d2e1b5aac4613d906efa021b571a1
SHA1 b9665c6248bc56e1cbb8797d27aa6b0db5ba70f1
SHA256 52c5dea41a299961b4776d3794864ce84e9d51ac1858dd6afb395e0a638bc666
SHA512 5dfd847513b94feb7df2569518c5abf56723cf165a424e2ebfea9fb4b5d2d70a9d0a962d5f7c7f68b3fd9a005c7aeb1bf20d9c7bfb1ee7ed0a23455d78516549

memory/2752-75-0x000000006494A000-0x000000006494F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\624248bf51749_Mon23fd163f29.exe

MD5 98362f1952eb1349f17f77bb70a9fbcc
SHA1 e8a2273215c3cea3100fa40536b0791fea27af8f
SHA256 9aa8aeb0262bc901878bda3a41b6ac7f727f1c3fe4e7bb9afa0000c371750321
SHA512 6faceb7a7d6c0b3d7ebd8afbd2e4dcfb95a6407bb4acf1012d50f462713b8f34adf51c2dc7f82281a6b84dfcb8bc0cbea68318f12ad9ad95558b9361500e0679

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\624248bc6d13c_Mon235f07b88ae.exe

MD5 a128f3490a3d62ec1f7c969771c9cb52
SHA1 73f71a45f68e317222ac704d30319fcbecdb8476
SHA256 4040769cb6796be3af8bd8b2c9d4be701155760766fddbd015b0bcb2b4fca52a
SHA512 ccf34b78a577bc12542e774574d21f3673710868705bf2c0ecdf6ce3414406ec63d5f65e3ff125f65e749a54d64e642492ee53d91a04d309228e2a73d7ab0a19

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\624248871e3ed_Mon2348d8b4e.exe

MD5 327366acede3d33a1d9b93396aee3eb9
SHA1 3df53825a46673b9fb97e68b2372f9dc27437b7f
SHA256 12183f88314a86429c1685dacb2cd7f87d1eac7094d52a19a92b45432800e051
SHA512 a7ce948ede1b8d02972322bb88498d6607dce39fd215df37ca58f016f5658436a556ec2425207f2434db7728b1ad1c19c7ec05110d82c094525c4bae7bf4894f

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\62424882a2d43_Mon2366e91c07.exe

MD5 52142a360efa5a88aa469593f3961bb4
SHA1 bb06f4b274789d3998ea3cbdc7d2056d4a99950f
SHA256 3a53d2f99cf9562803815dc1df898557919db19d54956b53840cbcf89c696dad
SHA512 de1e51dfb2a06bd0ad3142f7b2f33d78f5c2b07d0effc23074011d76a12a0d0591ea8a1b4fe753cf1482f8a438d2927fb92c4fb7a184029f35721e8b3f7fb5cc

C:\Users\Admin\AppData\Local\Temp\7zS8E9E44D7\6242487fd82aa_Mon2391599e.exe

MD5 7bdeeadd41822f3c024fba58b16e2cdc
SHA1 13a3319b0545e7ff1d17f678093db9f8785bba5a
SHA256 d46ceb96d549e329a60607d9d4acca2d62560f8daaaa5fc60b50823567b9c24f
SHA512 1942f19d694616c56f874fc8df73da26beed8f290cf619d9f8443a03289c5d36ae830d1f6bf0e8adf79eddf062c9e48373677e0a2d593ee1666fae5148a3e4ad

memory/2752-69-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/2752-68-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/2752-67-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/2752-66-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/2752-65-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/2752-74-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/2752-73-0x000000006B280000-0x000000006B2A6000-memory.dmp

memory/2752-72-0x000000006B280000-0x000000006B2A6000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-08 00:48

Reported

2024-11-08 00:51

Platform

win10v2004-20241007-en

Max time kernel

95s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"

Signatures

NullMixer

dropper nullmixer

Nullmixer family

nullmixer

Socelars

stealer socelars

Socelars family

socelars

Socelars payload

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\setup_installer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\setup_installer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1508 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe
PID 1508 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe
PID 1508 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe
PID 1928 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1472 wrote to memory of 3788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1472 wrote to memory of 3788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1472 wrote to memory of 3788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe

"C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 6242487ebee69_Mon2360fbbe475.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 6242487fd82aa_Mon2391599e.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 62424880dba59_Mon2373ae22.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 62424882a2d43_Mon2366e91c07.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248845c537_Mon23d60fef.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248871e3ed_Mon2348d8b4e.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bae0b4f_Mon2315c1392c.exe /mixtwo

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bc6d13c_Mon235f07b88ae.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bd917de_Mon2341a56212.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248bf51749_Mon23fd163f29.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248c03c802_Mon23cf6fc42c67.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248c2870d6_Mon23e0b3b0.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 624248c3cb9af_Mon237bf16061.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\setup_install.exe

MD5 83c766fb0a8d71f559d79d600ea05297
SHA1 8f4e1868bef695539f2b7cb83b3e336e959f3087
SHA256 3572b5d2013141cee24aa859fdd60398ef7d1c4ac40d2c080ecdb12129cb70ee
SHA512 1a49b39dc87ef672308b4a8bab0d1f9f9c0c51296b46f5cc46fa39312f94edf7f2bf1936367e0f7dc75c3ecb052558a75ced42189b4a4b218e8fe715ab163d88

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\libcurl.dll

MD5 d09be1f47fd6b827c81a4812b4f7296f
SHA1 028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA256 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\libcurlpp.dll

MD5 e6e578373c2e416289a8da55f1dc5e8e
SHA1 b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA256 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA512 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

memory/1928-64-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/1928-65-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/1928-63-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/1928-62-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/1928-61-0x0000000064940000-0x0000000064959000-memory.dmp

memory/1928-60-0x0000000064941000-0x000000006494F000-memory.dmp

memory/1928-59-0x00000000007A0000-0x000000000082F000-memory.dmp

memory/1928-58-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/1928-57-0x000000006B280000-0x000000006B2A6000-memory.dmp

memory/1928-67-0x000000006FE40000-0x000000006FFC6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\libstdc++-6.dll

MD5 5e279950775baae5fea04d2cc4526bcc
SHA1 8aef1e10031c3629512c43dd8b0b5d9060878453
SHA256 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\libgcc_s_dw2-1.dll

MD5 9aec524b616618b0d3d00b27b6f51da1
SHA1 64264300801a353db324d11738ffed876550e1d3
SHA256 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA512 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\libwinpthread-1.dll

MD5 1e0d62c34ff2e649ebc5c372065732ee
SHA1 fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA512 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

memory/1928-71-0x000000006B280000-0x000000006B2A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\624248c3cb9af_Mon237bf16061.exe

MD5 815d3b5cdc4aea7e8c8fe78434061694
SHA1 40aa8a3583d659aa86edf78db14f03917db6dda8
SHA256 226d6fc908bee0a523a09d1912f0b6b6958173ccd77997d45121d9091a7199b4
SHA512 b8cc6f302f86cbf3eea3c95ceda9302f543ebb6ed3cbbe5c038a1417a1536345cd44f8e89ec48579bc699d71c994eccd1dcbd43dca669931377f738072c2f95a

memory/1928-85-0x0000000000400000-0x000000000051C000-memory.dmp

memory/3788-95-0x0000000002650000-0x0000000002686000-memory.dmp

memory/3788-96-0x0000000004E00000-0x0000000005428000-memory.dmp

memory/3788-97-0x0000000004C50000-0x0000000004C72000-memory.dmp

memory/3788-99-0x00000000055A0000-0x0000000005606000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2xfpqw20.1ie.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3788-98-0x0000000005530000-0x0000000005596000-memory.dmp

memory/3788-109-0x0000000005710000-0x0000000005A64000-memory.dmp

memory/3788-110-0x0000000005C20000-0x0000000005C3E000-memory.dmp

memory/1928-94-0x000000006B280000-0x000000006B2A6000-memory.dmp

memory/3788-111-0x0000000005C60000-0x0000000005CAC000-memory.dmp

memory/1928-93-0x0000000064940000-0x0000000064959000-memory.dmp

memory/1928-92-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/1928-91-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/1928-89-0x000000006EB40000-0x000000006EB63000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\624248c03c802_Mon23cf6fc42c67.exe

MD5 79c79760259bd18332ca17a05dab283d
SHA1 b9afed2134363447d014b85c37820c5a44f33722
SHA256 e6eb127214bbef16c7372fbe85e1ba453f7aceee241398d2a8e0ec115c3625d3
SHA512 a4270de42d09caa42280b1a7538dc4e0897f17421987927ac8b37fde7e44f77feb9ce1386ffd594fe6262ebb817c2df5a2c20a4adb4b0261eae5d0b6a007aa06

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\624248bf51749_Mon23fd163f29.exe

MD5 98362f1952eb1349f17f77bb70a9fbcc
SHA1 e8a2273215c3cea3100fa40536b0791fea27af8f
SHA256 9aa8aeb0262bc901878bda3a41b6ac7f727f1c3fe4e7bb9afa0000c371750321
SHA512 6faceb7a7d6c0b3d7ebd8afbd2e4dcfb95a6407bb4acf1012d50f462713b8f34adf51c2dc7f82281a6b84dfcb8bc0cbea68318f12ad9ad95558b9361500e0679

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\624248bd917de_Mon2341a56212.exe

MD5 0913c141934828228be4bee6b08cadfe
SHA1 caf2f7ea94afc62792d91c1f2c1b99c05b1a2a1f
SHA256 3fa1c49f7dd6657c195dc68c13b50a0d7e2f3ec641f7108ffb3e041ea3713c95
SHA512 29bece87e4080db7098115f568dc9f5c25206147020d94438bff7ef5f17a918fae8a7546932e310648bf31be27bc4a29edf3e49051dd6e72aa9cf82e0ecd254b

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\624248bc6d13c_Mon235f07b88ae.exe

MD5 a128f3490a3d62ec1f7c969771c9cb52
SHA1 73f71a45f68e317222ac704d30319fcbecdb8476
SHA256 4040769cb6796be3af8bd8b2c9d4be701155760766fddbd015b0bcb2b4fca52a
SHA512 ccf34b78a577bc12542e774574d21f3673710868705bf2c0ecdf6ce3414406ec63d5f65e3ff125f65e749a54d64e642492ee53d91a04d309228e2a73d7ab0a19

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\624248bae0b4f_Mon2315c1392c.exe

MD5 dc3a42af98906ce86ad0e67ce7153b45
SHA1 83141ef3b732302806b27e1bd4332d2964418f07
SHA256 399d9c5dc78b7696e0984cc265c6b142d70949694e86a8e38474aedcda4ff6f1
SHA512 f3df4c782941bd130d302d63323edaccddf59a1cbad10ca3262118c948c78df6dc520bff67ec26918c31b575dce6580d72da0d6c170cabe34c98f52acadb9cb6

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\624248871e3ed_Mon2348d8b4e.exe

MD5 327366acede3d33a1d9b93396aee3eb9
SHA1 3df53825a46673b9fb97e68b2372f9dc27437b7f
SHA256 12183f88314a86429c1685dacb2cd7f87d1eac7094d52a19a92b45432800e051
SHA512 a7ce948ede1b8d02972322bb88498d6607dce39fd215df37ca58f016f5658436a556ec2425207f2434db7728b1ad1c19c7ec05110d82c094525c4bae7bf4894f

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\624248845c537_Mon23d60fef.exe

MD5 5bc6b4fcbdb2edbd8ca492b9ba9059f9
SHA1 6ad0140809c7f71769bf7bdd652442ffc4c2bc35
SHA256 f0d2a8fa7d23f6546e377a0c6dc9019cf513d6474afc462bba517c82e5c1d4b8
SHA512 953cb941a5fc7ea44b36bf70b984990a5d0b6c2b4cb614dcedbf254dbb1b6940d345dd8531ef1f489b0d467ac98208533c8b94e44a53c931d4e9bc91f5af2718

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\62424882a2d43_Mon2366e91c07.exe

MD5 52142a360efa5a88aa469593f3961bb4
SHA1 bb06f4b274789d3998ea3cbdc7d2056d4a99950f
SHA256 3a53d2f99cf9562803815dc1df898557919db19d54956b53840cbcf89c696dad
SHA512 de1e51dfb2a06bd0ad3142f7b2f33d78f5c2b07d0effc23074011d76a12a0d0591ea8a1b4fe753cf1482f8a438d2927fb92c4fb7a184029f35721e8b3f7fb5cc

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\62424880dba59_Mon2373ae22.exe

MD5 81cf5e614873508b9ecba216112c276b
SHA1 cb3115f68ffe4f428fc141f113dff477530f17fb
SHA256 fae5984ff3106551dddee32196332ab4b9cabfe40476b80dd5aa8e1c9fcba413
SHA512 48fba232d56c6acd0a3e97a64d096a6782000cc4d6d34f7d2379a54e6339bf373c14e95ba966a1fd8ecc05582cfad4e9dea6d61bb5492a570fdc1f637db7d29f

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\6242487fd82aa_Mon2391599e.exe

MD5 7bdeeadd41822f3c024fba58b16e2cdc
SHA1 13a3319b0545e7ff1d17f678093db9f8785bba5a
SHA256 d46ceb96d549e329a60607d9d4acca2d62560f8daaaa5fc60b50823567b9c24f
SHA512 1942f19d694616c56f874fc8df73da26beed8f290cf619d9f8443a03289c5d36ae830d1f6bf0e8adf79eddf062c9e48373677e0a2d593ee1666fae5148a3e4ad

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\6242487ebee69_Mon2360fbbe475.exe

MD5 98c3385d313ae6d4cf1f192830f6b555
SHA1 31c572430094e9adbf5b7647c3621b2e8dfa7fe8
SHA256 4b2e2adafc390f535254a650a90e6a559fb3613a9f13ce648a024c078fcf40be
SHA512 fdd0406ef1abee43877c2ab2be9879e7232e773f7dac48f38a883b14306907c82110c712065a290bafac3cc8b0f4c0a13694847ad60a50a2b87e6aed2fd73aff

memory/1928-70-0x000000006B280000-0x000000006B2A6000-memory.dmp

memory/1928-69-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/1928-68-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/1928-66-0x000000006FE40000-0x000000006FFC6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS4E546787\624248c2870d6_Mon23e0b3b0.exe

MD5 9e7d2e1b5aac4613d906efa021b571a1
SHA1 b9665c6248bc56e1cbb8797d27aa6b0db5ba70f1
SHA256 52c5dea41a299961b4776d3794864ce84e9d51ac1858dd6afb395e0a638bc666
SHA512 5dfd847513b94feb7df2569518c5abf56723cf165a424e2ebfea9fb4b5d2d70a9d0a962d5f7c7f68b3fd9a005c7aeb1bf20d9c7bfb1ee7ed0a23455d78516549

memory/3788-112-0x00000000061E0000-0x0000000006212000-memory.dmp

memory/3788-113-0x0000000070CC0000-0x0000000070D0C000-memory.dmp

memory/3788-123-0x0000000006BE0000-0x0000000006BFE000-memory.dmp

memory/3788-124-0x0000000006D40000-0x0000000006DE3000-memory.dmp

memory/3788-125-0x0000000007670000-0x0000000007CEA000-memory.dmp

memory/3788-126-0x0000000006C80000-0x0000000006C9A000-memory.dmp

memory/3788-127-0x0000000006D10000-0x0000000006D1A000-memory.dmp

memory/3788-128-0x00000000071D0000-0x0000000007266000-memory.dmp

memory/3788-129-0x0000000007150000-0x0000000007161000-memory.dmp

memory/3788-130-0x0000000007180000-0x000000000718E000-memory.dmp

memory/3788-131-0x0000000007190000-0x00000000071A4000-memory.dmp

memory/3788-132-0x0000000007290000-0x00000000072AA000-memory.dmp

memory/3788-133-0x0000000007270000-0x0000000007278000-memory.dmp