Malware Analysis Report

2024-12-01 03:04

Sample ID 241108-lfw7sazgjq
Target Pedido de Cotação-241107.bat.exe
SHA256 6a1c2df0bd6aacd1b69d3ab82b88b71f5552beaec7c452c36af1a3fed04c5bf2
Tags
discovery execution vipkeylogger collection keylogger spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6a1c2df0bd6aacd1b69d3ab82b88b71f5552beaec7c452c36af1a3fed04c5bf2

Threat Level: Known bad

The file Pedido de Cotação-241107.bat.exe was found to be: Known bad.

Malicious Activity Summary

discovery execution vipkeylogger collection keylogger spyware stealer

Vipkeylogger family

VIPKeylogger

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Checks computer location settings

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Browser Information Discovery

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

outlook_office_path

outlook_win_path

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-08 09:29

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-08 09:29

Reported

2024-11-08 09:31

Platform

win7-20241010-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1700 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\schtasks.exe
PID 1700 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\schtasks.exe
PID 1700 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\schtasks.exe
PID 1700 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\schtasks.exe
PID 1700 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 1700 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe

"C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\npFBVXl.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\npFBVXl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7DF6.tmp"

C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe

"C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"

C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe

"C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"

C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe

"C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"

C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe

"C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"

C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe

"C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"

Network

N/A

Files

memory/1700-0-0x000000007441E000-0x000000007441F000-memory.dmp

memory/1700-1-0x0000000000340000-0x000000000041C000-memory.dmp

memory/1700-2-0x0000000074410000-0x0000000074AFE000-memory.dmp

memory/1700-3-0x0000000000780000-0x000000000079C000-memory.dmp

memory/1700-4-0x000000007441E000-0x000000007441F000-memory.dmp

memory/1700-5-0x0000000074410000-0x0000000074AFE000-memory.dmp

memory/1700-6-0x0000000001E40000-0x0000000001ECC000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\35098XV14NOOV4961KLD.temp

MD5 1db7acaffa7f3b62b07e8637369453b5
SHA1 5427563749664e161d21513e751528217b3f6164
SHA256 3617ee9888987f64adeb92ba41b0d6f48cb7b0e70a06a1e5c4af877008293eb1
SHA512 baa9e561753263ddd8701869c2a4ed4a127e3b4c8eb46c99be54453f7a9fe6c7a4fea9297b5bdeef12c9969a138bf12173966bdb1b0e5435d375e64f120a0bad

C:\Users\Admin\AppData\Local\Temp\tmp7DF6.tmp

MD5 681afa652e506ccb98dc38c89e2d70e7
SHA1 6b335cecc3844d2bcee400af84c10f281f59919e
SHA256 7b04c7e9b17fcedddda23b70d7cc2b123413a5b21c66909d8370c8f5e375ea88
SHA512 5c903745be43fafa1878ea3b6ec92e8d64aefd39b09ca5982722d55bf8acd03b7dcb0f3f20c29aabb28ce4f42c83472c1da63bf68ae1757f369ca408a3f63881

memory/1700-19-0x0000000074410000-0x0000000074AFE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-08 09:29

Reported

2024-11-08 09:31

Platform

win10v2004-20241007-en

Max time kernel

123s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4964 set thread context of 948 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4964 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4964 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4964 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4964 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4964 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4964 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4964 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\schtasks.exe
PID 4964 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\schtasks.exe
PID 4964 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Windows\SysWOW64\schtasks.exe
PID 4964 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 4964 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 4964 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 4964 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 4964 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 4964 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 4964 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe
PID 4964 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe

"C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\npFBVXl.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\npFBVXl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB0E1.tmp"

C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe

"C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-241107.bat.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
US 158.101.44.242:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 242.44.101.158.in-addr.arpa udp
US 8.8.8.8:53 134.177.67.172.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 mail.lisotel.com udp
PT 94.46.181.151:587 mail.lisotel.com tcp
US 8.8.8.8:53 151.181.46.94.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

memory/4964-0-0x000000007464E000-0x000000007464F000-memory.dmp

memory/4964-1-0x0000000000AA0000-0x0000000000B7C000-memory.dmp

memory/4964-2-0x0000000005900000-0x0000000005EA4000-memory.dmp

memory/4964-3-0x0000000005430000-0x00000000054C2000-memory.dmp

memory/4964-4-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/4964-5-0x0000000005420000-0x000000000542A000-memory.dmp

memory/4964-6-0x0000000005740000-0x00000000057DC000-memory.dmp

memory/4964-7-0x0000000006770000-0x000000000678C000-memory.dmp

memory/4964-8-0x000000007464E000-0x000000007464F000-memory.dmp

memory/4964-9-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/4964-10-0x0000000004DF0000-0x0000000004E7C000-memory.dmp

memory/3200-15-0x00000000027B0000-0x00000000027E6000-memory.dmp

memory/3200-16-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/3200-18-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/3200-17-0x0000000005310000-0x0000000005938000-memory.dmp

memory/3200-19-0x0000000074640000-0x0000000074DF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB0E1.tmp

MD5 61d87d1a785292232bfc9d8299dfd396
SHA1 d1c43eba6af37b1a3378f5583157364608a7dcb2
SHA256 e1e956954638f19ad68488fad89bbb8b8d2e56e533dd6966baebc6fa8fc6501c
SHA512 79b03c069c9c15bff37fcfd438f53a076579c922d385a9146bef0949fcde441e40e4674927d69da70ca685a2722ccf9ed67841c5c4b042a26e0c277b59ea243a

memory/3200-23-0x0000000005A50000-0x0000000005AB6000-memory.dmp

memory/2232-24-0x0000000074640000-0x0000000074DF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rldy1bxr.sga.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/948-35-0x0000000000400000-0x000000000044A000-memory.dmp

memory/2232-36-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/3200-30-0x0000000005AC0000-0x0000000005E14000-memory.dmp

memory/2232-38-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/4964-48-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/3200-22-0x00000000059E0000-0x0000000005A46000-memory.dmp

memory/3200-21-0x0000000005940000-0x0000000005962000-memory.dmp

memory/2232-49-0x0000000005540000-0x000000000555E000-memory.dmp

memory/2232-50-0x0000000005B40000-0x0000000005B8C000-memory.dmp

memory/3200-62-0x0000000006680000-0x000000000669E000-memory.dmp

memory/3200-69-0x00000000072D0000-0x0000000007373000-memory.dmp

memory/2232-63-0x0000000070DB0000-0x0000000070DFC000-memory.dmp

memory/3200-52-0x0000000070DB0000-0x0000000070DFC000-memory.dmp

memory/3200-51-0x00000000066A0000-0x00000000066D2000-memory.dmp

memory/3200-75-0x0000000007400000-0x000000000741A000-memory.dmp

memory/3200-74-0x0000000007A40000-0x00000000080BA000-memory.dmp

memory/3200-76-0x0000000007470000-0x000000000747A000-memory.dmp

memory/2232-77-0x0000000007070000-0x0000000007106000-memory.dmp

memory/3200-78-0x0000000007600000-0x0000000007611000-memory.dmp

memory/3200-79-0x0000000007630000-0x000000000763E000-memory.dmp

memory/2232-80-0x0000000007030000-0x0000000007044000-memory.dmp

memory/2232-81-0x0000000007130000-0x000000000714A000-memory.dmp

memory/3200-82-0x0000000007720000-0x0000000007728000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bae47e3a3b2b00b165ff2452166b5243
SHA1 188f5b115d0269b331e0c2128315f1cff9438ced
SHA256 625f5900da258173072944c8ffed36d93006779bb300d5ea0a36e88dc649563c
SHA512 5c59610f1485b7bb745772e97f8e3f68249cb18cd1b9b8eb67ac00a07fed4da34c3bd549f129878dd3c912bfa01ec900bd7ffd0259922b5776606e1f3517c8e5

memory/3200-88-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/2232-89-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/948-90-0x0000000006E60000-0x0000000007022000-memory.dmp

memory/948-91-0x0000000006CE0000-0x0000000006D30000-memory.dmp

memory/948-92-0x0000000007560000-0x0000000007A8C000-memory.dmp